The Proposed EU Standardization Regulation Comes Too Late for the CRA
On October 6, 2026, the European Commission presented its proposal for a new EU standardization regulation (COM(2026) 780). It is meant to replace Regulation (EU) No 1025/2012, which governs how harmonized standards are requested, developed, and cited in the Official Journal of the European Union. The proposal brings deadlines, an intermediate step that gives a presumption of conformity, and free access to harmonized standards. For the standards supporting the Cyber Resilience Act (Regulation (EU) 2024/2847), or CRA, it comes too late.
Harmonized standards take six years on average
According to the Commission's evaluation, it takes an average of six years from preparing the standardization request to citing a harmonized standard in the Official Journal. Over the past five years, the Commission had to extend 21% of its standardization requests after they were issued. The accompanying impact assessment (SWD(2026) 786) explicitly names the CRA as an example where the standards are expected to arrive after the deadline. Under the Radio Equipment Directive, the date of application of the cybersecurity requirements was postponed because the standards were missing.
There is also a legal problem. In March 2024, the Court of Justice of the European Union ruled on access to documents of the EU institutions (C-588/21 P). Since that judgment, harmonized standards are considered part of EU law and must be freely accessible. This affects CEN, CENELEC, and the national standardization bodies, such as DIN and DKE in Germany, which have so far sold harmonized standards. ETSI already provides its standards free of charge.
The Commission assessed three possible options and chose the middle one. CEN, CENELEC, and ETSI remain the central partners, but they face competition if they do not deliver. The Commission rejected an open system. In that system, it could have mandated any standardization organization, an EU standardization office would have steered the system, and harmonized standards would have appeared in full in the Official Journal.
What the new EU standardization regulation changes
The proposal builds on the existing system. The main changes, with their references in the proposal:
| Change | Content | Reference |
|---|---|---|
| Deadlines | The Commission endeavors to adopt the standardization request within 12 months of the response of the standardization organizations. It assesses delivered standards within 6 months and publishes the reference, where possible, within a further 3 months | Article 23(5), Article 25(2) and (3) |
| Harmonized standardization deliverables | Intermediate step with a presumption of conformity, for example a technical specification. Its reference is withdrawn as soon as the harmonized standard is cited | Article 2, point 7; Article 23(3)(g); Article 25(7) |
| Designated standards development organizations | Standardization requests can also go to other organizations if CEN, CENELEC, or ETSI decline, deliver late, or deliver a non-compliant standard. Designation and request by implementing act | Articles 26, 27, and 29 |
| Common specifications | Uniform fallback with a presumption of conformity. Repealed or adapted as soon as a harmonized standard covers the same requirements | Article 32 |
| Free access | Referenced standards free of charge online, readable, searchable, and printable, also after the reference has been withdrawn and also for standards already cited under Regulation 1025/2012 | Article 5, Recital 12 |
| Digital standards | The standardization organizations endeavor to use digital tools and a structured, machine-readable format | Article 6 |
| International first | International standards as the basis. Exception where an international standard is unsuitable for the objective pursued | Article 35 |
| Restricted participation | For standards on strategic assets, interests, or security of the Union, participation can be limited to organizations from the EU | Article 23(3)(h) |
The impact assessment breaks down today's duration by phase. This shows where the new deadlines apply.
| Phase | Average today | Proposal |
|---|---|---|
| Preparing the standardization request | 1.7 years | Response of the standardization organizations within 1 month, request where possible within 12 months after that |
| Developing the standard | just over 3 years | Deadline per standard set in the request, key performance indicators for the standardization organizations |
| Assessing and citing the standard | 14 months | Assessment within 6 months, publication where possible within a further 3 months |
The longest phase gets no fixed deadline. For the actual standards work, the Commission relies on key performance indicators (Article 13) and on consequences. A standardization organization may miss the deadline or deliver a non-compliant standard. The Commission can then amend the request, give it to a designated standards development organization, or adopt common specifications (Article 25(8)). The impact assessment itself names another brake: 65% of the delivered standards fail the Commission's first assessment.
CEN and CENELEC support the goal but warn against parallel standardization routes. They see the bottlenecks before and after the technical work, that is, in preparing standardization requests and in assessment and citation. They welcome the protection of standards against mass extraction.
What the proposal leaves open
Machine-readable, but protected. Under Article 6, the standardization organizations are to endeavor to develop standards in a structured, machine-readable format suitable for automated processing. Article 5 requires unrestricted free online access. Recital 12, however, allows access to be limited to the parts of a standard that are needed to comply with the legislation. It also allows digital rights management against the mass extraction of content, explicitly with a view to AI. The proposal does not say whether a manufacturer may import a freely accessible harmonized standard into its requirements management or a test tool.
“International first” with exceptions. Article 35(1) makes international standards the basis where they exist or their completion is imminent. Under Article 35(2), the Commission can exclude the use of an international standard in the standardization request if it considers that standard ineffective or inappropriate for the objective pursued. It can also restrict participation in standards on strategic assets, interests, autonomy, or security of the Union. Participation is then limited to organizations established in the EU and not controlled by third countries, or to organizations from third countries that effectively represent the interests of the Union. The proposal does not say when these conditions are met. This matters for the CRA, because central standards build on IEC 62443-4-1 and IEC 62443-4-2. A separate European path would force manufacturers who sell worldwide to provide duplicate evidence.
Standards based on ISO and IEC. Under Article 5(3), the standardization organizations must ensure that no arrangement restricts free access. This also affects the cooperation agreements with ISO and IEC on which many harmonized standards are based. The regulation cannot decide whether ISO and IEC agree to make their content available free of charge. The consequences of the judgment for ISO and IEC were unclear. According to the impact assessment, CEN and CENELEC therefore submitted no new ISO-based harmonized standard for assessment between May 2024 and October 2025. They submitted no new IEC-based one between March 2024 and January 2026. ISO and IEC themselves cannot become designated standards development organizations.
Timing. The European Parliament and the Council still have to approve the proposal. The regulation is to apply six months after its entry into force (Article 43). The impact assessment assumes that it will enter into force only after 2028.
Nothing changes for CRA manufacturers before the end of 2027
The CRA applies in full from December 11, 2027, and none of the new instruments takes effect before then. The first wave of CRA standards continues under Regulation 1025/2012. The impact assessment itself expects delays. The Commission and the standardization organizations had set up seven fast-track procedures with a target of 18 months, including projects on cybersecurity and cyber resilience. According to the Commission's first estimate, most of them will miss that target.
An industrial router that connects machines to the internet for remote maintenance shows what is at stake. Under Annex III of the CRA, such routers are important products of class I. Without a cited harmonized standard, a common specification, or a suitable certification, the manufacturer cannot demonstrate conformity through internal control alone and needs a notified body.
For planning up to 2027, IEC 62443-4-1, IEC 62443-4-2, and the drafts of the EN 40000 series remain the reference. If the standards do not arrive, the Commission can already adopt common specifications today under Article 27 of the CRA. The new standardization regulation would only make this option uniform.
In the medium term, the intermediate step is the most interesting instrument for products with digital elements. A harmonized standardization deliverable with a presumption of conformity fits software with short release cycles better than a standard that takes six years. If you base your conformity on such a deliverable, you must plan for the later switch to the harmonized standard. As soon as the reference of the harmonized standard is published, the Commission withdraws the reference of the deliverable (Article 25(7)).
Where do you stand with CRA implementation?
The CRA template package contains templates you can use to build processes and evidence without waiting for the harmonized standards.
A cautious reform with a tangible core
The Commission's press release suggested a much more agile standardization system. The text of the regulation falls short of that. It is also more cautious than the drafts that circulated beforehand. Strategic sovereignty and European values play a smaller role in the summary of the impact assessment than in those drafts. We therefore read the proposal as a reform that mainly preserves the existing system and is geared to the needs of industry. The resources fit this reading. For the new tasks, the Commission plans 7.5 additional full-time equivalents, 2 of them external staff and the rest through redeployment.
We see the most tangible progress in Article 6. Suppose standards are developed in a structured, machine-readable form with interoperable metadata. Standardization committees will then work more like software teams, with version control and structured formats such as Markdown, JSON Schema, or ISO STS. For manufacturers, this would be a real gain once requirements can be imported directly into development and test tools. For that, the digital rights management under Recital 12 must be designed to allow this use.
The legislative procedure will show whether Parliament and Council strengthen this core. CEN and CENELEC have already announced that they will oppose parallel standardization routes. Even so, the proposal is a modest step, and one in the right direction.
Plan CRA implementation without harmonized standards
In the CRA workshop, we clarify which standards apply to your products and which conformity assessment route remains open to you without harmonized standards.
