Which CRA harmonised standard applies to your product, and how far along is it? It is the question I get asked most often by manufacturers, conformity assessment bodies and trade associations. The answer is spread across three European Standardisation Organisations, six technical bodies and more than forty work items, so I mapped every standard under standardisation request M/606 on one page: who is writing it, which CRA product category it covers, and where it stands as of mid-October 2026.
How to read the map
Each box is one deliverable. The number in brackets, for example (#15), is the item in the M/606 standardisation request it answers. The coloured bar on the left shows which CRA category the item relates to:
- Horizontal: standards that apply to all products with digital elements (the EN 40000-1 series).
- Important products, Class I and Class II: vertical standards for the product categories listed in Annex III of the CRA.
- Critical products: vertical standards for the categories in Annex IV.
- Not in M/606: related work that supports the CRA but is not itself a request deliverable, such as the EN 18037 guidance documents and the IEC 62443 amendments.
The badge on each box shows the current stage. The simplified path a standard follows is: NWI → prEN draft → prEN vote → EN draft → EN vote (Formal Vote) → EN adoption → HAS assessment → citation in the Official Journal. Only after citation in the Official Journal of the European Union does a harmonised standard give manufacturers presumption of conformity with the CRA.
Milestone to watch: EN 40000-1-3 (vulnerability handling)
The draft of EN 40000-1-3 for Formal Vote has been agreed in CEN/CLC/JTC 13 WG 9. If no objections are raised by 23 October 2026, it moves to Formal Vote. It would then join EN 40000-1-1 and EN 40000-1-2, which have already been adopted as European Standards.
As Rapporteur in WG 9, I have followed this document from its first working draft through more than 2,000 resolved comments. If you want the background on how it changed, see my earlier article: prEN 40000-1-3 Reaches the Pre-Formal Vote HAS Assessment.
CEN/CLC JTC 13 WG 9: the horizontal foundation is in place
The horizontal standards apply to every product with digital elements, whatever its category. Two of them are already adopted:
- EN 40000-1-2 covers principles, product risk management and the lifecycle.
- EN 40000-1-1 covers vocabulary.
EN 40000-1-4 (generic security requirements) answers M/606 items #2 to #14 and contains the catalogue of security controls. It is awaiting HAS comments and addressing them to prepare for enquiry.
| Standard | M/606 item | Scope | Status |
|---|---|---|---|
| EN 40000-1-1 | – | Vocabulary | Adopted |
| EN 40000-1-2 | #1 | Principles, risk management, lifecycle | Adopted |
| EN 40000-1-3 | #15 | Vulnerability handling | Formal Vote pending |
| EN 40000-1-4 | #2–14 | Generic security requirements | prEN draft |
| TR (no. tbc) | – | Proof of concept: EN 18037 for the CRA | prEN draft |
| TS (no. tbc) | – | Guidance: applying EN 18037 for the CRA | prEN draft |
ETSI TC CYBER: the vertical standards are moving fast
ETSI is writing the vertical standards for most important products. All 17 of its CRA enquiry drafts have now received the European Commission’s second HAS assessment.
- 10 drafts have already addressed the comments and are heading for final endorsement. They cover password managers, anti-malware, boot managers, routers and switches, virtual assistants, smart home security, connected toys, wearables, hypervisors and firewalls/IDS/IPS.
- 7 drafts are still working through the HAS comments. They cover browsers, VPNs, network management, SIEM, PKI software, network interfaces and operating systems.
| Standard | M/606 item | Product category | CRA class | Status |
|---|---|---|---|---|
| EN 304 617 | #17a+b | Browsers | Class I | prEN vote |
| EN 304 618 | #18 | Password managers | Class I | EN draft |
| EN 304 619 | #19 | Anti-malware | Class I | EN draft |
| EN 304 620 | #20a | VPN | Class I | prEN vote |
| EN 304 621 | #21a | Network management | Class I | prEN vote |
| EN 304 622 | #22a | SIEM | Class I | prEN vote |
| EN 304 623 | #23 | Boot managers | Class I | EN draft |
| EN 304 624 | #24 | PKI software | Class I | prEN vote |
| EN 304 625 | #25a | Network interfaces | Class I | prEN vote |
| EN 304 626 | #26 | Operating systems | Class I | prEN vote |
| EN 304 627 | #27a | Routers / switches | Class I | EN draft |
| EN 304 631 | #31 | Virtual assistants | Class I | EN draft |
| EN 304 632 | #32 | Smart home security | Class I | EN draft |
| EN 304 633 | #33 | Connected toys | Class I | EN draft |
| EN 304 634 | #34 | Wearables | Class I | EN draft |
| EN 304 635 | #35 | Hypervisors / container runtime systems | Class II | EN draft |
| EN 304 636 | #36a | Firewalls, IDS / IPS | Class II | EN draft |
| EN 304 642 | – | Telecom network functions | Not in M/606 | prEN draft |
CLC/TC 65X: OT has its own track
For operational technology, CLC/TC 65X is writing the EN 50770 security profiles on top of IEC 62443. Several product categories therefore have two deliverables. Firewalls, for example, are covered by ETSI as item #36a and by EN 50770-1 as item #36b. The same pattern applies to network management, network interfaces, VPN, routers and SIEM.
EN 50770-1 has been split into firewalls (-1-1) and IDS/IPS (-1-2). All EN 50770 parts are currently at prEN draft stage.
| Standard | M/606 item | Product category | CRA class | Status |
|---|---|---|---|---|
| EN 50770-1-1 | #36b | Firewalls | Class II | prEN draft |
| EN 50770-1-2 | #36b | IDS / IPS | Class II | prEN draft |
| EN 50770-2 | #21b | Network management | Class I | prEN draft |
| EN 50770-3 | #25b | Network interfaces | Class I | prEN draft |
| EN 50770-4 | #20b | VPN | Class I | prEN draft |
| EN 50770-5 | #27b | Routers, switches | Class I | prEN draft |
| EN 50770-6 | #22b | SIEM | Class I | prEN draft |
| EN IEC 62443-4-1/prAA | – | Secure development lifecycle | Not in M/606 | EN draft |
| EN IEC 62443-4-2/prAA | – | Component requirements | Not in M/606 | EN draft |
| EN IEC 62443-3-3/prAA | – | System requirements and security levels | Not in M/606 | NWI |
Hardware and critical products: very different stages
Three committees cover hardware and the critical products in Annex IV:
- CLC/TC 47X covers semiconductors and trusted chips.
- CEN/TC 224 covers personal identification devices.
- CEN/CLC JTC 13 WG 6 covers smart meter gateways.
The critical products are at very different stages:
- The smartcard standards, EN 40002-3 (platforms) and EN 18330 (application layer), are in final drafting.
- The standard for hardware devices with security boxes, EN 40000-11, is being reworked.
- Smart meter gateways are still at an early draft stage.
| Committee | Standard | M/606 item | Product category | CRA class | Status |
|---|---|---|---|---|---|
| CLC/TC 47X | EN 40001-3 / prEN 50765 | #28, #29 | Microprocessors and microcontrollers | Class I | EN draft |
| CLC/TC 47X | EN 40004-3 / prEN 50767 | #30 | FPGAs and ASICs | Class I | prEN vote |
| CLC/TC 47X | EN 40003-3 / prEN 50766 | #37, #38 | Tamper-resistant MPUs / MCUs | Class II | EN draft |
| CLC/TC 47X | EN 40002-3 / prEN 50764 | #41a | Smartcard and secure element platforms | Critical | EN draft |
| CEN/TC 224 | EN 40000-10 | #16 | Identity and privileged access management | Class I | EN draft |
| CEN/TC 224 | EN 40000-11 | #39 | Hardware devices with security boxes | Critical | EN draft |
| CEN/TC 224 | EN 18330 | #41b | Smartcards and secure elements, application layer | Critical | EN draft |
| CEN/CLC JTC 13 WG 6 | EN (no. tbc) | #40 | Smart meter gateways | Critical | prEN draft |
What this means for manufacturers
Don’t wait for the Official Journal citation. The CRA’s reporting obligations have applied since 11 September 2026, and the main obligations follow on 11 December 2027. The time between now and then is short compared with a typical product development cycle.
- Find your product category on the map. Check whether your product is a default product, an important product (Class I or II) or a critical product. This determines which conformity assessment route is open to you.
- Identify your vertical standard, if one exists, and check where it stands. If you build for both IT and OT markets, look at both the ETSI and the EN 50770 track.
- Build on the horizontal standards. EN 40000-1-2 is already adopted, and EN 40000-1-3 is the closest of the remaining horizontal standards to final. Vulnerability handling is the area where you can, and should, start implementing today.
References
- Regulation (EU) 2024/2847 (Cyber Resilience Act)
- Standardisation request M/606, CEN-CENELEC work programme
- CEN, CENELEC and ETSI accept M/606
- DIN/DKE, Normungsprojekte zum CRA – status October 2026
- ETSI TC CYBER work programme, status 16 October 2026
- CEN-CENELEC webinar on smart meter gateways, February 2026
- BOSS – Guidance on the standard development process
Help needed for your compliance journey?
If your organisation is preparing for the Cyber Resilience Act and wants to know which standards apply to its products, and how ready its processes are, feel free to get in touch. Vulnir helps manufacturers translate regulatory requirements into practical implementation and conformity assessment readiness.
Get In Touch