CE Marking and the New Legislative Framework
CE marking decides whether a product may be sold in the European Economic Area (EEA) at all. Behind the two letters is a set of rules that the EU brought together in 2008 as the New Legislative Framework (NLF). It consists of a regulation on accreditation, a decision with the building blocks for conformity assessment procedures, and, since 2021, a separate regulation on market surveillance.
Until now, this framework mainly affected manufacturers of physical products. With the Cyber Resilience Act, pure software will also carry CE marking from December 11, 2027. The same rules apply that have so far governed machinery, radio equipment, and pressure equipment.
Contents
What CE marking says and what it does not
By affixing CE marking, the manufacturer declares that the product complies with all Union harmonisation legislation that provides for this marking. The Commission's Blue Guide describes CE marking as a “key indicator (but not proof) of a product’s compliance with EU legislation”. It applies in the EEA and in Turkey, regardless of where the product was manufactured.
The most common misconception we see in projects is that CE marking is a certification. It is not. CE marking is a declaration by the manufacturer, not a certificate. A certificate is issued by a third party, it is usually voluntary, and in the end it is a marketing tool offered by testing organizations; IEC 62443 certification is one example. CE marking is the opposite in every respect: it is mandatory, the manufacturer declares it, and it is no use for advertising. The Blue Guide is unusually direct about this for an EU document: “CE marking does not serve commercial purposes i.e. it is not a marketing tool.”
| CE marking means | CE marking does not mean |
|---|---|
| The manufacturer declares conformity with all applicable legal acts | An authority has tested and approved the product |
| The conformity assessment procedure has been completed | A notified body was involved (only the identification number after the marking shows this) |
| The product may circulate freely in the EEA and Turkey | The product was made in the EU |
| Where several legal acts apply: conformity with all of them | The product is particularly secure or of particularly high quality |
Market surveillance authorities may restrict the placing on the market of a CE-marked product only if they can show that it does not comply. The burden of proof therefore lies first with the authority.
The New Legislative Framework: three acts, three tasks
The NLF is a toolbox that sector-specific legal acts draw on. The RED, the Machinery Regulation, and the CRA are all built on this pattern, which is why their structure looks so similar.
| Legal act | What it governs today |
|---|---|
| Regulation (EC) No 765/2008 | Accreditation of conformity assessment bodies, and the definition, form, and general principles of CE marking |
| Decision No 768/2008/EC | The building blocks for new product legislation: definitions, obligations of economic operators, and modules A to H for conformity assessment |
| Regulation (EU) 2019/1020 | Market surveillance and controls on products entering the EU; applies to the Union harmonisation legislation listed in its Annex I (70 acts in the original version; Article 66 of the CRA added the CRA as point 72) |
Many descriptions online are out of date on this point. The market surveillance provisions were originally part of Regulation 765/2008. They were repealed with effect from July 16, 2021, and replaced by Regulation 2019/1020. What remains of Regulation 765/2008 is accreditation and CE marking.
Decision 768/2008/EC is the reason why it pays to look at a familiar legal act before reading a new one. If you know the obligations of manufacturers under the Machinery Regulation, you will find the same system in the Radio Equipment Directive and in the CRA, sometimes word for word.
CE marking in six steps
1. Identify the applicable legal acts and harmonized standards. Several legal acts often apply to a product at the same time. A connected industrial machine falls under the Machinery Regulation and the EMC Directive, and under the RED if it has radio modules. From December 2027, it also falls under the CRA, provided it is within the scope of the CRA. Harmonized standards are voluntary, but they give a presumption of conformity. For the CRA, this set of standards is currently being developed under the umbrella of EN 40000.
2. Check the product-specific requirements. Each legal act has an annex with essential requirements. For the CRA, this is Annex I, divided into product properties and vulnerability handling processes.
3. Determine whether a notified body must be involved. This depends on the risk of the product category. Under the CRA, the product categories decide: for products outside the lists, internal control under module A is enough; for important products of class II, a third party is always involved. CRA conformity assessment compares modules A, B+C, and H.
4. Test the product and establish conformity. The test results must show that each individual requirement is met, and they belong in the technical documentation.
5. Draw up the technical documentation and keep it up to date. It covers design, manufacture, operation, and the risk assessment. The retention period under the classic NLF is 10 years after the product has been placed on the market.
6. Affix the CE marking and issue the EU declaration of conformity. The marking is affixed before the product is placed on the market. It must be visible, legible, and indelible, and as a rule at least 5 mm high. Where several legal acts apply, the manufacturer issues a single declaration of conformity that lists all of them.
The building blocks in detail
CE marking involves six building blocks. The manufacturer produces four of them, a notified body provides one where required, and market surveillance only starts once the product is already on sale.
Conformity assessment procedures
The procedures come as modules from Decision 768/2008/EC. They range from internal production control (module A) through EU-type examination (module B, followed by module C) to full quality assurance (module H). The relevant legal act sets out which module is allowed, depending on the risk of the product.
Notified bodies
A notified body is an organization designated by a Member State to carry out conformity assessments for certain products. Its identification number follows the CE marking only if the body was involved in the production control phase. A body that only carried out the EU-type examination under module B never appears there. The basis for its notification is accreditation.
Technical documentation
The technical documentation shows that the product meets the requirements: design and manufacturing documents, risk assessment, test reports, and instructions. You must present it to national authorities on request, in a language the authority can understand.
EU declaration of conformity
This is the manufacturer's formal declaration that the product complies with all the legal acts it lists. It identifies the product, the legal acts and standards applied, and the manufacturer. It is signed by a person acting for the manufacturer or for its authorized representative in the EU.
Affixing the marking
The marking goes on the product or its data plate. Where the nature of the product requires it, it can go on the packaging or the accompanying documents instead. The proportions of the lettering are fixed and must be kept when the marking is enlarged or reduced. You must not omit or move the marking for purely aesthetic reasons. For online sales, the CE marking should be visible on the website before the customer buys.
Market surveillance
Once a product has been placed on the market, national authorities check it under the rules of Regulation 2019/1020. If a product does not comply, measures range from corrective action to withdrawal from the market. Controls cover the whole supply chain: importers and distributors must also check that the CE marking and the declaration of conformity are in place before they pass a product on.
What the Cyber Resilience Act changes in the CE process
The CRA adopts the NLF system but has to adapt it to products you cannot hold in your hand. For software, the CE marking is therefore no longer on the product. It is affixed to the EU declaration of conformity or on the website accompanying the software product. That section of the website must be easily and directly accessible to consumers (Article 30(1) of the CRA). The marking may be smaller than 5 mm if the nature of the product requires it and the marking remains visible and legible (Article 30(2)). The CE marking may also be followed by a pictogram indicating a special cybersecurity risk or use (Article 30(3)). The Commission defines these pictograms by implementing act (Article 30(6)).
Retention also changes. Where the classic NLF requires 10 years, the CRA requires at least 10 years after placing on the market or the support period, whichever is longer (Article 13(13)). For an industrial controller with 15 years of support, that means 15 years.
CE marking for software is new, and it will change more than these three technical details. Software manufacturers have so far not gone through any conformity assessment procedure. They will have to, and that requires a risk assessment, test reports, and a documented decision on what goes into a release. This fits poorly with very agile ways of working, because all of it requires planning. Software that only matures once it is in the customer's hands, what German developers call “banana software”, will hopefully become less common.
The same applies to the technical documentation. Today, at best part of it is finished on release day, and the rest is added later, if at all. What then gets reconstructed is what nobody wrote down during development. Article 31(2) of the CRA no longer allows this. The technical documentation must be drawn up before the product is placed on the market. It must be continuously updated, where appropriate, at least during the support period. Together with the penalties under the CRA, this means for manufacturers: contribute to the technical documentation continuously instead of patching it together before the release, and maintain it regularly afterwards. The obligations of manufacturers under the CRA explain which duties are linked to it.
The CRA does not apply in Great Britain. Separate rules apply there, with the UKCA marking. For most product areas, however, Great Britain continues to recognize the CE marking without an end date.
The Blue Guide as a reference
The Commission's “Blue Guide” explains how EU product rules are to be applied. It covers terms such as placing on the market and making available, the obligations of manufacturers, importers, and distributors, conformity assessment, accreditation, and market surveillance. It is clear about its own status: it is intended “purely as a guidance document”. Only the Union harmonisation acts themselves have legal force, and the binding interpretation of EU law lies with the Court of Justice of the European Union. Even so, it is the first place to look when you need to know how a term is meant.
The current version dates from 2022 and was published in the Official Journal C 247 of June 29, 2022. Older references online often still point to the 2016 version, which predates the move of market surveillance to Regulation 2019/1020.
The Blue Guide on the implementation of EU product rules 2022 (EUR-Lex)
Where does your product stand on CRA conformity?
Not sure how far your product is from meeting the requirements of the Cyber Resilience Act? In a short call, we look at where the biggest gaps are likely to be.