Which Harmonized Standards Apply under the CRA

Manufacturers of machinery, plant, and devices keep asking the same question about the Cyber Resilience Act (CRA): which standard should I apply to demonstrate that I meet the requirements? The answer depends on what you make. This overview explains which series of standards are being developed for the CRA and which products each one is meant for.

There will not be a single “CRA standard.” Instead, manufacturers will work with several series:

• the horizontal EN 40000 series for all products with digital elements
• product-specific ETSI standards for IT and consumer products
• the EN 50770 series for OT products, based on IEC 62443

This article explains which series are being developed, how they work together, and what manufacturers should prepare before the standards are cited in the Official Journal.

Contents

1. How the presumption of conformity works
2. What standardization work is under way for the CRA?
   1. Horizontal standards: the EN 40000 series
   2. Vertical standards for IT and consumer products: the ETSI EN 304 6xx series
   3. Vertical standards for OT: the EN 50770 series
3. Where do IEC 62443 and EN 18031 fit in?
4. What the current status means for manufacturers
5. Outlook

How the presumption of conformity works

The presumption of conformity is what makes harmonized standards worth the effort. A product with digital elements and the processes the manufacturer has put in place may conform to a harmonized standard whose reference is published in the Official Journal. They are then presumed to meet the essential requirements in Annex I, as far as the standard covers those requirements (Article 27(1) of the CRA).

As long as no such standard exists, the Commission can adopt common specifications by implementing act. Following them can also meet the essential requirements. For manufacturers, this means that standards are the preferred route to a presumption of conformity, but not the only one.

The CRA applies whether or not the standards are harmonized in time. Without a cited standard, you only lose the easier route of demonstrating conformity through the presumption. The requirements still apply, and you must demonstrate that you meet them with your own technical and organizational evidence.

What standardization work is under way for the CRA?

The work runs in three strands, carried by the European standardization organizations CEN, CENELEC, and ETSI. One horizontal strand covers all products with digital elements. Two vertical strands address particular product groups: one for IT and consumer products, one for operational technology (OT).

Strand	Standard series	Products covered	Basis
Horizontal	EN 40000 series	All products with digital elements	Baseline requirements
Vertical IT/consumer	ETSI EN 304 6xx	IT and consumer products	Product-specific
Vertical OT	EN 50770 series	OT products	Based on IEC 62443

All three series are still being developed. The ETSI series has been in the approval procedure as final drafts since August 2026. The first parts of the EN 40000 series are in the final vote (as of October 2026). No specific dates for harmonization or citation in the Official Journal have been set yet.

Horizontal standards: the EN 40000 series

The EN 40000 series is the horizontal foundation. It is meant to apply to all products with digital elements, regardless of product category. Four parts form the normative core, supplemented by an informative technical report. For a closer look, see our page on the EN 40000 series.

Part	Purpose
EN 40000-1-1	Terms and definitions for the whole series
EN 40000-1-2	Principles for cyber resilience
EN 40000-1-3	Vulnerability handling
EN 40000-1-4	Generic security requirements
TR 40000-1-5	Threats and security objectives (informative)

For manufacturers, EN 40000-1-2, EN 40000-1-3, and EN 40000-1-4 matter most. Principles and processes, vulnerability handling, and generic security requirements are likely to become the main areas in which you have to provide evidence.

Vertical standards for IT and consumer products: the ETSI EN 304 6xx series

For IT and consumer products, a vertical series is being developed under the name ETSI EN 304 6xx. It addresses individual product types, each with its own product-specific requirements. The product types named in the Commission's status overview of CRA standardization include browsers, password managers, VPN products, SIEM systems, operating systems, and routers and switches.

The drafts in this series have been in ETSI's approval procedure as final drafts since August 2026. Depending on the standard, the procedure runs until mid-November 2026. The drafts show the intended structure and the product-specific requirements. They can still change during approval, however, and without citation in the Official Journal they do not give a presumption of conformity. Our separate article gives an overview of the ETSI draft standards for the CRA.

Vertical standards for OT: the EN 50770 series

For operational technology, the EN 50770 series is being developed. It is relevant above all for machine builders, automation manufacturers, and suppliers of industrial components. The series defines security profiles for OT products, explicitly based on IEC 62443. Its parts cover product groups such as:

• VPN products
• network management systems
• SIEM systems
• physical and virtual network interfaces
• routers and switches
• firewalls and intrusion detection and prevention systems

Annex adaptations (prAA) of selected parts of IEC 62443 support this OT strand: IEC 62443-3-3 (system requirements), IEC 62443-4-1 (secure product development lifecycle), and IEC 62443-4-2 (technical component requirements). They serve as supporting standards for the vertical OT standards. The EN 50770 series is also still a draft.

Where do IEC 62443 and EN 18031 fit in?

IEC 62443 is the established series of standards for the security of industrial automation and control systems and forms the basis of the OT strand. Formally, the role of IEC 62443 within the CRA harmonization framework is still open. In practice, it remains a central reference for OT manufacturers, because the EN 50770 series explicitly builds on it. For the wider context, see our article on IEC 62443 for the CRA.

EN 18031 provides a different reference point. The current CRA draft standards already use it as a source of terms. For manufacturers whose products communicate by radio, this offers a possible reference point for the later transition from the Radio Equipment Directive to the CRA. What role EN 18031 will play in that transition depends on the CRA standards still to come. For details, see our pages on EN 18031 and the Radio Equipment Directive. For connected consumer products, ETSI EN 303 645 is a further cybersecurity standard.

What the current status means for manufacturers

As long as no CRA standard is cited in the Official Journal of the European Union, there is no presumption of conformity through harmonized standards. That does not mean manufacturers should wait. The essential requirements in Annex I of the Cyber Resilience Act still apply, and you must demonstrate that you meet them as part of the conformity assessment.

The current drafts already show the direction that the evidence will take. You can therefore check now which strand of standards is relevant for your products and which existing evidence you can reuse. The question is not only which standard will be harmonized later, but how you can demonstrate conformity reliably until then.

A pragmatic approach for manufacturers:

• Confirm that your product is a product with digital elements under the CRA.
• Check the product category: default product, important product, or critical product.
• Identify the matching series: horizontal, IT/consumer-specific, or OT-specific.
• Assess existing evidence from IEC 62443, EN 18031, ETSI EN 303 645, or your internal development processes.
• Derive the gaps against Annex I, vulnerability handling, and the technical documentation.
• Decide how you will demonstrate conformity until harmonized standards are cited.

The most common mistake is to wait for finished standards. The date from which the CRA applies does not depend on whether harmonized standards have been cited. If you leave vulnerability handling, the secure development process, technical documentation, and product evidence until later, you lose the time you need to build exactly these structures.

Outlook

The CRA standards fall into three strands. The EN 40000 series is horizontal. The ETSI series EN 304 6xx (IT and consumer products) and the EN 50770 series (OT) are vertical. None of the three series has been adopted yet, and citation in the Official Journal is still pending. The message for manufacturers is clear. The direction is set. Until the standards are cited, you demonstrate conformity directly against Annex I. Building the underlying processes pays off now. Our overview of the Cyber Resilience Act covers the overall framework.