The CE mark has attested product safety for decades. From 11 December 2027 it also attests cybersecurity. When the essential requirements of the Cyber Resilience Act fully apply, a product with digital elements may only carry the CE marking if it conforms to Annex I, and affixing the mark is the manufacturer's public declaration of exactly that. For most hardware manufacturers this changes the meaning of a mark they already use. For software publishers it introduces a conformity marking regime many have never dealt with.
The mark comes last in a sequence that starts with your conformity route and runs through documentation. If you have not yet worked through that sequence, start with the four conformity assessment routes and the self-attestation methodology for Module A. This post covers the marking itself.
What the CE mark declares under the CRA
Affixing the CE marking to a product with digital elements declares that the product complies with the essential cybersecurity requirements of Annex I and that the manufacturer has completed the applicable conformity assessment procedure. The declaration is the manufacturer's own and carries personal responsibility. Article 29 makes the CRA marking subject to the general principles of Regulation (EC) 765/2008, which means the familiar rules apply. Only the manufacturer affixes it, affixing it presumes full conformity with every applicable Union act that requires it, and misusing it is a sanctionable act in every member state.
The practical consequence is that the mark is the visible tip of an evidence chain. Behind it market surveillance expects to find a documented risk assessment, an Annex I requirements position, a technical file per Annex VII, and a signed EU Declaration of Conformity. The mark asserts the chain exists.
The Article 30 affixing rules
Article 30 sets the mechanics, and they are specific.
- Visible, legible, indelible. The marking must be affixed visibly, legibly and indelibly to the product with digital elements.
- Packaging and DoC fallback. Where the nature of the product does not allow or warrant marking the product itself, the mark goes on the packaging and on the EU Declaration of Conformity. This is the route for software, where the mark accompanies the declaration and, where one exists, the packaging or download page.
- Before placing on the market. The marking is affixed before the product is placed on the EU market. It cannot be retrofitted to units already shipped as a paperwork exercise.
- Proportions preserved. The graphical rules of Regulation (EC) 765/2008 apply, including the minimum 5 mm height and fixed proportions, though the CRA permits a smaller mark for small products as long as it stays legible.
When a notified body number joins the mark
If your conformity route involved a notified body under Module H, the CE marking must be followed by the identification number of that notified body. The number is affixed by the notified body itself or, under its instructions, by the manufacturer. Products assessed under Module A self-assessment carry the CE mark alone, with no number. This makes the mark itself informative for buyers and authorities. A bare CE mark on an important product signals that the manufacturer applied harmonised standards under the conditions that permit self-assessment, while a numbered mark signals third-party involvement.
Critical-class products that obtained a European cybersecurity certificate follow the certification scheme's own presentation rules alongside the marking.
The sequence that must be complete before you affix
The mark is step six of six. Affixing it earlier inverts the legal logic and creates a false declaration. The order that survives an audit is the following.
- Classify the product under Annex III and IV and derive the conformity route from Article 32.
- Run and document the cybersecurity risk assessment required by Article 13.
- Close the Annex I position, covering both the Part I product requirements and the Part II vulnerability handling requirements.
- Assemble the technical documentation per Annex VII, including the support period determination.
- Draw up and sign the EU Declaration of Conformity per Annex V.
- Affix the CE marking, adding the notified body number where Module H applied.
The dates matter here. The Article 14 reporting obligations start on 11 September 2026 regardless of marking status, and the full conformity obligations, including the marking regime, apply from 11 December 2027. A product placed on the market from that date without the mark, or with the mark but without the chain behind it, is non-compliant either way.
What market surveillance does about a wrong mark
Market surveillance authorities treat the marking as a formal non-compliance trigger. Where the mark has been affixed in violation of the rules, the authority requires the manufacturer to end the non-compliance, and where it persists the authority can restrict or prohibit the product's availability on the market or order a withdrawal or recall. Behind the formal trigger sits the substantive one. If the authority requests the technical documentation and the file does not support the conformity the mark declares, the case shifts from a marking irregularity to a breach of the essential obligations, where the Article 64 fines reach 15 million euros or 2.5 percent of total worldwide annual turnover, whichever is higher.
A wrongly affixed mark also creates commercial exposure beyond the regulator. Distributors and importers carry their own CRA duties to verify that the products they handle bear the marking and are accompanied by the required documentation, so a defective marking position propagates down the supply chain and into contractual claims.
What this means for manufacturers now
Treat the CE mark as the output of your conformity work rather than a label to schedule. Two preparations pay off before December 2027. First, fix the marking mechanics per product family now, deciding where the mark physically goes, how software products present it alongside the Declaration of Conformity, and whether any product needs a notified body number. Second, make the evidence chain retrievable, because the mark invites the documentation request. The manufacturers who struggle with CE marking are rarely tripped up by the graphics rules. They are tripped up by a mark that promises a technical file that cannot be produced within the deadline an authority sets. Start from the Annex V declaration template and the Article 30 explainer and work the sequence backwards from the mark you intend to affix.