Cyber Resilience Act
CRA standards tracker
Every European standard written for the Cyber Resilience Act under standardisation request M/606, with its stage and the deadline it answers. We update the table when a committee moves a standard.
No harmonised standard for the CRA is cited in the Official Journal yet. No product can claim presumption of conformity under Article 27 today. Assess against the essential requirements of Annex I directly. Commission list of harmonised standards
The deadlines in the last column come from a draft amendment to request M/606, notified by the Commission on 7 July 2026 with feedback closed on 3 August 2026. It is not adopted. The original deadlines are shown crossed out. Commission notification of the draft
- 10 Work item
- 27 Draft for enquiry
- 2 Formal vote
Checked on 16 October 2026. A summary, not legal advice. Always check the official text for your case.
Horizontal standards
| Reference | Title | Stage | Stage date | M/606 deadline |
|---|---|---|---|---|
| EN 40000-1-1 JTC 13 WG 9 | Cybersecurity requirements for products with digital elements, Part 1-1: Vocabulary | Formal vote | 1 October 2026 | – |
| EN 40000-1-2 JTC 13 WG 9 | Part 1-2: Principles, product risk management and lifecycle activities | Formal vote | 1 October 2026 | 30 October 2026 |
| prEN 40000-1-3 JTC 13 WG 9 | Part 1-3: Vulnerability handling | Draft for enquiry | 5 March 2026 | 30 October 2026 |
| prEN 40000-1-4 JTC 13 WG 9 | Part 1-4: Generic security requirements | Work item | 5 March 2025 | 30 October 2027 |
Vertical standards, ETSI
| Reference | Title | Stage | Stage date | M/606 deadline |
|---|---|---|---|---|
| EN 304 617 TC CYBER WG EUSR | Cybersecurity requirements for browsers | Draft for enquiry | 13 August 2026 | 31 December 2026 |
| EN 304 618 TC CYBER WG EUSR | Cybersecurity requirements for password managers | Draft for enquiry | 13 August 2026 | 31 December 2026 |
| EN 304 619 TC CYBER WG EUSR | Cybersecurity requirements for software that searches for, removes or quarantines malicious software | Draft for enquiry | 13 August 2026 | 31 December 2026 |
| EN 304 620 TC CYBER WG EUSR | Cybersecurity requirements for virtual private networks | Draft for enquiry | 13 August 2026 | 31 December 2026 |
| EN 304 621 TC CYBER WG EUSR | Cybersecurity requirements for network management systems | Draft for enquiry | 13 August 2026 | 31 December 2026 |
| EN 304 622 TC CYBER WG EUSR | Cybersecurity requirements for security information and event management systems | Draft for enquiry | 13 August 2026 | 31 December 2026 |
| EN 304 623 TC CYBER WG EUSR | Cybersecurity requirements for boot managers | Draft for enquiry | 13 August 2026 | 31 December 2026 |
| EN 304 624 TC CYBER WG EUSR | Cybersecurity requirements for public key infrastructure and digital certificate issuance software | Draft for enquiry | 13 August 2026 | 31 December 2026 |
| EN 304 625 TC CYBER WG EUSR | Cybersecurity requirements for physical and virtual network interfaces | Draft for enquiry | 13 August 2026 | 31 December 2026 |
| EN 304 626 TC CYBER WG EUSR | Cybersecurity requirements for operating systems | Draft for enquiry | 13 August 2026 | 31 December 2026 |
| EN 304 627 TC CYBER WG EUSR | Cybersecurity requirements for routers, modems intended for the connection to the internet and switches | Draft for enquiry | 13 August 2026 | 31 December 2026 |
| EN 304 631 TC CYBER WG EUSR | Cybersecurity requirements for smart home general purpose virtual assistants | Draft for enquiry | 13 August 2026 | 31 December 2026 |
| EN 304 632 TC CYBER WG EUSR | Cybersecurity requirements for smart home products with security functionalities | Draft for enquiry | 13 August 2026 | 31 December 2026 |
| EN 304 633 TC CYBER WG EUSR | Cybersecurity requirements for internet connected toys with social interactive or location tracking features | Draft for enquiry | 13 August 2026 | 31 December 2026 |
| EN 304 634 TC CYBER WG EUSR | Cybersecurity requirements for personal wearable health monitoring products and children's wearables | Draft for enquiry | 13 August 2026 | 31 December 2026 |
| EN 304 635 TC CYBER WG EUSR | Cybersecurity requirements for hypervisors and container runtime systems | Draft for enquiry | 13 August 2026 | 31 December 2026 |
| EN 304 636 TC CYBER WG EUSR | Cybersecurity requirements for firewalls, intrusion detection and prevention systems | Draft for enquiry | 13 August 2026 | 31 December 2026 |
| EN 304 642 TC CYBER WG EUSR | Cybersecurity requirements for network functions of telecommunications systems | Work item | 31 July 2026 | – |
Vertical standards, CEN and CENELEC
| Reference | Title | Stage | Stage date | M/606 deadline |
|---|---|---|---|---|
| prEN 40000-10 TC 224 WG 17 | Part 10: Products with digital elements used in identity management systems and privileged access management software and hardware, including authentication and access control readers | Draft for enquiry | 13 August 2026 | 31 December 2026 |
| prEN 40000-11 TC 224 WG 17 | Part 11: Hardware devices with security boxes | Draft for enquiry | 13 August 2026 | 31 December 2026 |
| prEN 18330 TC 224 | Cybersecurity requirements for smartcards or similar devices, including secure elements, application layer | Draft for enquiry | 9 April 2026 | 31 December 2026 |
| prEN 40001-3 TC 47X | Cybersecurity requirements for microprocessors and microcontrollers with security-related functionalities | Draft for enquiry | 10 April 2026 | 31 December 2026 |
| prEN 40002-3 TC 47X | Cybersecurity requirements for tamper-resistant microprocessors and microcontrollers | Draft for enquiry | 10 April 2026 | 31 December 2026 |
| prEN 40003-3 TC 47X | Cybersecurity requirements for platforms of smartcards and similar devices including secure elements | Draft for enquiry | 10 April 2026 | 31 December 2026 |
| prEN 40004-3 TC 47X | Cybersecurity requirements for FPGAs and ASICs with security-related functionalities | Draft for enquiry | 25 September 2026 | 31 December 2026 |
Industrial automation (OT) and supporting work
| Reference | Title | Stage | Stage date | M/606 deadline |
|---|---|---|---|---|
| prEN 50770-1 TC 65X WG 3 | Security for operational technologies, Part 1: Security profile for firewalls and intrusion detection and prevention systems (based on EN IEC 62443) | Work item | 21 October 2025 | 31 December 2026 |
| prEN 50770-2 TC 65X WG 3 | Part 2: Security profile for network management systems | Work item | 27 December 2025 | 31 December 2026 |
| prEN 50770-3 TC 65X WG 3 | Part 3: Security profile for physical and virtual network interfaces | Work item | 27 December 2025 | 31 December 2026 |
| prEN 50770-4 TC 65X WG 3 | Part 4: Security profile for products with the function of VPN | Work item | 21 October 2025 | 31 December 2026 |
| prEN 50770-5 TC 65X WG 3 | Part 5: Security profile for routers, modems intended for the connection to the internet and switches | Work item | 21 October 2025 | 31 December 2026 |
| prEN 50770-6 TC 65X WG 3 | Part 6: Security profile for SIEM systems | Work item | 21 October 2025 | 31 December 2026 |
| EN IEC 62443-4-1:2018/prAA:2026 TC 65X | Secure product development lifecycle requirements, CRA-related amendment | Draft for enquiry | 5 June 2026 | – |
| EN IEC 62443-4-2:2019/prAA:2026 TC 65X | Technical security requirements for IACS components, CRA-related amendment | Draft for enquiry | 5 June 2026 | – |
| EN IEC 62443-3-3:2019/prAA TC 65X | System security requirements and security levels, amendment | Work item | 27 June 2024 | – |
| prEN (smart meter gateway) JTC 13 WG 6 | Cybersecurity requirements for products with digital elements, smart meter gateway | Work item | 9 March 2026 | 31 December 2026 |