CRA harmonised standards: where EN 18031, EN 40000 and IEC 62443 stand
As of 24 September 2026, no harmonised standard has been cited in the Official Journal under the Cyber Resilience Act (Regulation (EU) 2024/2847), so no standard yet gives presumption of conformity with it. EN 18031-1, -2 and -3 are harmonised under the Radio Equipment Directive, not the CRA, and those RED requirements stop applying on 11 December 2027. The standards written for the CRA — the horizontal EN 40000 series, and product-specific drafts from ETSI (EN 304) and CENELEC (EN 50770) — are still going through approval, and not every part is expected to be cited.
A plain-English map, not legal advice. Standards statuses change; each entry shows when it was last checked and against which source. The regulation itself: Official text on EUR-Lex.
Showing 9 of 9
EN 18031-1:2024
- Covers
- Common security requirements for internet-connected radio equipment, supporting the RED requirement that equipment does not harm the network or misuse network resources (Article 3(3)(d) of Directive 2014/53/EU).
- Status
- Harmonised under the Radio Equipment Directive by Implementing Decision (EU) 2025/138 of 28 January 2025, with restrictions. The RED requirements it supports apply from 1 August 2025 (Delegated Regulation (EU) 2022/30, as amended by (EU) 2023/2444); Delegated Regulation (EU) 2026/339 removes them with effect from 11 December 2027.
- Relation to CRA Annex I
- The CRA's essential requirements include all the elements of the RED requirements this standard supports, so its controls are useful evidence toward Annex I Part I. It does not address the vulnerability handling processes in Annex I Part II.
- Presumption of conformity under the CRA?
- No. It is harmonised under the Radio Equipment Directive, not the CRA. Under the CRA it can be listed in the technical documentation as another technical specification applied.
Checked 24 September 2026 against Commission Implementing Decision (EU) 2025/138, EUR-Lex.
EN 18031-2:2024
- Covers
- Common security requirements for internet-connected, childcare, toy and wearable radio equipment, supporting the RED requirement to protect the user's personal data and privacy (Article 3(3)(e) of Directive 2014/53/EU).
- Status
- Harmonised under the Radio Equipment Directive by Implementing Decision (EU) 2025/138 of 28 January 2025, with restrictions, including one on parental or guardian access control for toy and childcare radio equipment.
- Relation to CRA Annex I
- The CRA's essential requirements include all the elements of the RED requirements this standard supports, so its controls are useful evidence toward Annex I Part I. It does not address the vulnerability handling processes in Annex I Part II.
- Presumption of conformity under the CRA?
- No. It is harmonised under the Radio Equipment Directive, not the CRA. Under the CRA it can be listed in the technical documentation as another technical specification applied.
Checked 24 September 2026 against Commission Implementing Decision (EU) 2025/138, EUR-Lex.
EN 18031-3:2024
- Covers
- Security requirements for internet-connected radio equipment that processes virtual money or monetary value, supporting the RED requirement on protection from fraud (Article 3(3)(f) of Directive 2014/53/EU).
- Status
- Harmonised under the Radio Equipment Directive by Implementing Decision (EU) 2025/138 of 28 January 2025, with restrictions. Its secure-update assessment criteria (clause 6.3.2.4) confer no presumption.
- Relation to CRA Annex I
- The CRA's essential requirements include all the elements of the RED requirements this standard supports, so its controls are useful evidence toward Annex I Part I. It does not address the vulnerability handling processes in Annex I Part II.
- Presumption of conformity under the CRA?
- No. It is harmonised under the Radio Equipment Directive, not the CRA. Under the CRA it can be listed in the technical documentation as another technical specification applied.
Checked 24 September 2026 against Commission Implementing Decision (EU) 2025/138, EUR-Lex.
prEN 40000-1 series (horizontal CRA standards)
- Covers
- Product-agnostic standards for every product with digital elements: vocabulary (1-1), principles, product risk management and lifecycle (1-2), vulnerability handling (1-3) and technical security controls (1-4).
- Status
- Drafts under standardisation request M/606. The CEN-CENELEC project database lists prEN 40000-1-3 (vulnerability handling) as under approval, with no ratification or publication date set. Reported by ibf solutions (not confirmed in an official publication): 1-3 is the part expected to be cited in the Official Journal, there are no current plans to cite 1-2, and 1-4 (technical security controls) is not scheduled for citation until autumn 2027.
- Relation to CRA Annex I
- Aimed at Annex I as a whole: 1-3 at the manufacturer's vulnerability handling processes (Part II), 1-4 at the security properties of the product (Part I).
- Presumption of conformity under the CRA?
- Not yet. Presumption starts only once a part's reference is published in the Official Journal, and only for the requirements that part covers — so a part that is never cited never gives it.
Checked 24 September 2026 against CEN-CENELEC project record for prEN 40000-1-3 and ibf solutions, CRA standardisation status (6 July 2026, secondary).
ETSI EN 304 6xx series (vertical CRA standards)
- Covers
- Product-specific standards for important product categories in Annex III, such as password managers, anti-virus software, smart home assistants, connected toys and wearables.
- Status
- 17 final drafts entered ETSI's approval procedure on 13 August 2026. ETSI said the procedure would run until mid-September to mid-November 2026 depending on the product category, so for some categories it has already closed.
- Relation to CRA Annex I
- Adds product-specific requirements for the Annex III categories on top of the horizontal series, according to the risks of each product type.
- Presumption of conformity under the CRA?
- Not yet. They aim to become harmonised standards, which needs approval and then publication of each reference in the Official Journal.
Checked 24 September 2026 against ETSI press release, 13 August 2026.
prEN 50770 series (product-specific OT standards)
- Covers
- Product-specific requirements for Annex III categories as they appear in industrial and operational technology settings.
- Status
- Drafts under standardisation request M/606. Reported by ibf solutions (not confirmed in an official publication): six parts, for firewalls, IDS and IPS (-1), network management systems (-2), network interfaces (-3), VPNs (-4), routers and switches (-5) and SIEM systems (-6), with a delivery deadline of 31 December 2026.
- Relation to CRA Annex I
- Adds category-specific requirements on top of the horizontal EN 40000 series for the Annex III products it covers.
- Presumption of conformity under the CRA?
- Not yet. Presumption needs each part's reference to be published in the Official Journal.
Checked 24 September 2026 against ibf solutions, CRA standardisation status (6 July 2026, secondary).
EN IEC 62443-4-1:2018
- Covers
- Secure product development lifecycle requirements for suppliers of industrial automation and control system products: security requirements, secure design and implementation, testing, defect and update management.
- Status
- Published European standard. CENELEC TC65X is preparing EN IEC 62443-4-1:2018/A11:2026 to align it with the CRA, with harmonisation under the CRA as the stated aim (CEN-CENELEC webinar, 9 September 2025). Whether it will be cited is uncertain: ibf solutions reports citation as highly unlikely. Not harmonised under the CRA.
- Relation to CRA Annex I
- Its process requirements map most closely to Annex I Part II (vulnerability handling) and the secure-development expectations behind Part I.
- Presumption of conformity under the CRA?
- No, not today. It can support the technical documentation as another technical specification applied. The A11 amendment would give presumption only if its reference is published in the Official Journal.
Checked 24 September 2026 against CEN-CENELEC webinar notice on EN IEC 62443 and the CRA and ibf solutions, CRA standardisation status (6 July 2026, secondary).
EN IEC 62443-4-2:2019
- Covers
- Technical security requirements for the components of industrial automation and control systems: embedded devices, network devices, host devices and software applications.
- Status
- Published European standard. CENELEC TC65X is preparing EN IEC 62443-4-2:2019/A11:2026 to align it with the CRA, with harmonisation under the CRA as the stated aim (CEN-CENELEC webinar, 9 September 2025). Whether it will be cited is uncertain: ibf solutions reports citation as highly unlikely. Not harmonised under the CRA.
- Relation to CRA Annex I
- Its component capabilities (identification and authentication, use control, data integrity and confidentiality, and so on) map most closely to Annex I Part I.
- Presumption of conformity under the CRA?
- No, not today. It can support the technical documentation as another technical specification applied. The A11 amendment would give presumption only if its reference is published in the Official Journal.
Checked 24 September 2026 against CEN-CENELEC webinar notice on EN IEC 62443 and the CRA and ibf solutions, CRA standardisation status (6 July 2026, secondary).
ETSI EN 303 645 V3.1.3
- Covers
- Baseline cybersecurity provisions for consumer IoT products, such as no universal default passwords, a way to report vulnerabilities, keeping software updated and secure communication.
- Status
- V3.1.3 published by ETSI in September 2024. Not harmonised under the Radio Equipment Directive or the CRA.
- Relation to CRA Annex I
- Overlaps with much of Annex I Part I, and its vulnerability disclosure provision touches Part II, but it was not written against the CRA's requirements.
- Presumption of conformity under the CRA?
- No. It is a widely used baseline and can be listed in the technical documentation as another technical specification applied.
Checked 24 September 2026 against ETSI deliverable archive for EN 303 645.
How presumption of conformity works under the CRA
A product and its manufacturer’s processes are presumed to meet the essential cybersecurity requirements in Annex I where they conform to a harmonised standard whose reference has been published in the Official Journal, but only for the requirements that standard covers (Article 27(1)). The Commission can also adopt common specifications that carry the same presumption, but only if harmonised standards are not delivered or not fit for purpose (Article 27(2) and (5)). A European cybersecurity certificate or EU statement of conformity under the Cybersecurity Act gives presumption too, to the extent it covers the requirements (Article 27(8)). Which certification schemes can be used is specified by Commission delegated act (Article 27(9)); a certificate at assurance level ‘substantial’ under such a scheme removes the need for third-party assessment of the requirements it covers.
A standard harmonised under another law does not count. EN 18031 gives presumption under the Radio Equipment Directive only, and IEC 62443 and ETSI EN 303 645 are not harmonised at all. Applying them is still worth recording: where no harmonised standard is applied, the technical documentation has to describe the solutions adopted to meet Annex I, including a list of other relevant technical specifications applied (Annex VII).
EN 18031 and the Radio Equipment Directive
Delegated Regulation (EU) 2022/30 made three cybersecurity requirements of the Radio Equipment Directive apply to certain radio equipment from 1 August 2025, a date set by Delegated Regulation (EU) 2023/2444, which moved it from 1 August 2024: network protection, personal data and privacy, and protection from fraud. EN 18031-1, -2 and -3 are the harmonised standards for those three, and Implementing Decision (EU) 2025/138 published their references with restrictions:
- the “rationale” and “guidance” sections give no presumption;
- none of the three gives presumption if, under clauses 6.2.5.1 and 6.2.5.2, the user is allowed not to set and use any password;
- EN 18031-2 gives none for toy and childcare radio equipment unless parental or guardian access control is ensured;
- EN 18031-3’s secure-update assessment criteria (clause 6.3.2.4) give none.
The CRA replaces this regime. Delegated Regulation (EU) 2026/339 repeals Delegated Regulation 2022/30 with effect from 11 December 2027, the day the CRA applies in full, because the CRA’s essential requirements include all the elements of the three RED requirements. Radio equipment placed on the market between 1 August 2025 and 10 December 2027 remains subject to market surveillance against the RED requirements.
Before CRA standards are cited
The gap matters most for important products in Class I. They can use internal control only if harmonised standards, common specifications or a certification scheme are applied in full; otherwise a notified body has to be involved (Article 32(2)). Until relevant standards are cited, internal control for a Class I product needs a common specification or a European cybersecurity certification scheme at assurance level ‘substantial’ or higher covering the requirements in full. If you are not sure which class your product is in (on fossa.com, opens in a new tab), the applicability checker works it out from the annexes.
The Commission’s standardisation request M/606, adopted by Implementing Decision C(2025) 618 on 3 February 2025, asks CEN, CENELEC and ETSI for 41 standards: horizontal standards for every product with digital elements, and product-specific standards for the Annex III and IV categories. Delivery is followed by the Commission’s assessment and then publication in the Official Journal, which is when presumption begins.
In July 2026 the Commission published a draft amendment to M/606 moving two deadlines back by two months: vulnerability-handling standards from 30 August to 31 October 2026, and product-specific standards from 30 October to 31 December 2026. As of 11 September 2026 it had not been adopted, as reported by cyberresilienceact.eu; this is not confirmed in an official publication.
Common questions
Does EN 18031 give presumption of conformity under the CRA?
No. It is harmonised under the Radio Equipment Directive only. Its controls are good evidence for Annex I Part I, and can be listed in the technical documentation, but they do not address the vulnerability handling processes in Part II.
Is IEC 62443 a CRA harmonised standard?
Not as of 24 September 2026. EN IEC 62443-4-1 and -4-2 are published European standards, and CENELEC is preparing A11:2026 amendments aimed at harmonisation under the CRA. Whether they will be cited is uncertain; ibf solutions reports it as highly unlikely.
Is ETSI EN 303 645 enough for the CRA?
It covers much of what Annex I Part I asks of a consumer IoT product, but it is not harmonised under the CRA and was not written against its requirements. Treat it as evidence, not as presumption of conformity.
What is the EN 40000 series?
The horizontal standards being drafted for the CRA by CEN and CENELEC, covering every product with digital elements. Part 1-3, on vulnerability handling, is listed as under approval in the CEN-CENELEC database and is the part reported as expected to be cited; 1-4, on technical security controls, is reported for autumn 2027. Both points come from ibf solutions and are not confirmed in an official publication.
When will CRA harmonised standards be cited?
No date is fixed. Standards have to be approved, delivered to the Commission, assessed, and then have their references published in the Official Journal. The delivery deadlines under M/606 run to the end of 2026 for the first standards, and a draft amendment would push them back two months. Watch the CRA timeline and news for citations as they happen.
No standard to lean on yet?
FOSSA’s Cyber Resilience Act guide works through the Annex I requirements directly, for teams that cannot wait for harmonised standards.
Read FOSSA’s CRA guide (on fossa.com, opens in a new tab)Mapping a standard we haven’t listed?
Ask practitioners how they are using EN 18031, IEC 62443 and EN 303 645 as CRA evidence.
Ask the community