CRA harmonised standards: M/606, JTC 13 and the EN 40000 timeline

The Commission's own standardisation page describes M/606 as covering a set of 41 standards split into horizontal standards (product-agnostic, applying across every CRA product category) and vertical standards (product-specific, covering the Annex III "important" and Annex IV "critical" product categories named in the Regulation, from routers and smart home devices to smartcards). CEN, CENELEC and ETSI formally accepted the request on 3 April 2025. The Commission's priority ordering puts the Annex III/IV product-category standards and a set of shared support deliverables — terminology, a sectoral risk-assessment methodology and a common threat catalogue — first, ahead of the remaining horizontal standards.

Two separate standards tracks are running in parallel. On the CEN-CENELEC side, the horizontal EN 40000 series — described by the European Standardisation Organisations as the cornerstone of the CRA standards framework — is drafted inside CEN-CLC/JTC 13 Working Group 9, with WG 6, CEN/TC 224 WG 17, CLC/TC 65X WG 3 and CLC/TC 47X contributing related horizontal and sector-specific work. On the ETSI side, a dedicated internal group was created inside ETSI Technical Committee CYBER, called the EUSR, specifically to produce the vertical, product-specific standards (the EN 304 6xx series) assigned to ETSI under the mandate. The two tracks publish independently and are at different stages of approval.

The EN 40000 series is split into four parts: EN 40000-1-1 (vocabulary), EN 40000-1-2 (cyber resilience principles), EN 40000-1-3 (vulnerability handling) and EN 40000-1-4 (generic security requirements). As of early November 2026: EN 40000-1-1 and EN 40000-1-2 had cleared their CENELEC formal vote, which closed 1 October 2026, and were heading toward CENELEC publication later in November 2026; EN 40000-1-3 had closed its public enquiry and was in post-enquiry approval; EN 40000-1-4, the generic security-requirements part, was still under active drafting with no completed public enquiry. On the vertical side, ETSI opened the formal public enquiry on 17 draft EN 304 6xx standards on 13 August 2026, with comment windows running from mid-September to mid-November 2026 across the different product categories — ETSI's own newsroom frames this as "the launch of the approval process," not a finished, citable standard.

No. CRA Article 27 is explicit that presumption of conformity with the Regulation's essential cybersecurity requirements attaches only once the Commission has published a harmonised standard's reference in the Official Journal of the European Union, and only for the specific requirements that standard addresses — the same rule EN 18031 describes for the Radio Equipment Directive's delegated act. CENELEC's internal approval stages (public enquiry, formal vote, ratification) and ETSI's equivalent process are necessary precursors, not substitutes, for that citation. As of this guide's research date, no CRA harmonised standard had reached the Official Journal, so every EN 40000 and EN 304 6xx draft remains, at most, good engineering evidence for a device maker's own CRA technical documentation and risk assessment — not a self-assessment shortcut.

Not on the original schedule. M/606 set 30 August 2026 as the delivery deadline for the horizontal Type A (cyber resilience principles) standard and the vulnerability-handling standard, and 30 October 2026 for the vertical, product-specific standards. The 30 August 2026 date passed with nothing cited in the Official Journal. On 7 July 2026 the Commission circulated a draft amendment to Implementing Decision C(2025) 618 proposing to push those dates to 31 October 2026 (horizontal) and 31 December 2026 (vertical); that amendment had not itself been formally adopted and published as of this guide's research date, so treat the revised dates as proposed, not yet legally fixed, until confirmed against the Commission's own register.

A device maker working toward the CRA's 11 December 2027 application date cannot wait for a finished harmonised standard before starting technical documentation, SBOM generation and vulnerability-handling work — the standards are still a moving target a year out. SoftWSP's firmware security assessments build the SBOM and vulnerability evidence CRA Annex I and Annex VII require directly from a device's firmware image today, so that work does not have to restart once a specific EN 40000 or EN 304 6xx part is finally cited in the Official Journal. See device & firmware security services for how that fits into CRA preparation.

This guide is based on the Commission's Implementing Decision C(2025) 618 final document register entry, the Commission's own digital-strategy CRA standardisation page, CEN-CENELEC's and ETSI's own news releases on the standardisation request and the EN 304 6xx public enquiry, Regulation (EU) 2024/2847's Article 27 text, and the independent cyberresilienceact.eu tracker (cross-checked against the official sources rather than relied on alone), all read for this guide in November 2026. Standards status changes quickly; re-verify current publication status against eur-lex.europa.eu and the Commission's own pages before citing a specific standard as CRA-harmonised in a compliance submission. This guide does not constitute legal advice.