Is there a CRA harmonised standard for my product category yet?

Article 27(1) obliges the Commission to request harmonised standards for the Annex I essential requirements.^[1] It did so through standardisation request M/606, issued by Commission Implementing Decision C(2025) 618 final and accepted by CEN, CENELEC and ETSI on 3 April 2025. The request covers 41 standards.^[3][4]

They divide into two kinds, and the distinction decides which work programme is relevant to you.

Horizontal standards apply to every product with digital elements and express the essential requirements in general terms. That is the EN 40000 series from CEN-CENELEC JTC 13, covering vocabulary, cyber resilience principles, vulnerability handling and generic security requirements.

Vertical standards cover one Annex III product category each. Most went to ETSI TC CYBER, which is drafting them as the EN 304 6xx series. A manufacturer of an important product will likely need both families: the horizontal standards for the general requirements and the vulnerability handling process, and the vertical standard for what that specific product type has to do.

The ETSI numbering is mechanical rather than arbitrary. A deliverable number is 304 600 plus its M/606 line item, so line item 17 for standalone and embedded browsers becomes EN 304 617, and line item 36 for firewalls and intrusion detection or prevention systems becomes EN 304 636.^[5]

That rule explains the gaps. There is no EN 304 628, 629 or 630 because those line items cover microprocessors, microcontrollers and programmable circuits with security functionalities, which went to CENELEC rather than ETSI.

The categories ETSI is not covering are worth knowing early, because watching the ETSI work programme will tell a manufacturer in one of them nothing at all:

• Identity management and privileged access management, at CEN/TC 224 WG 17.
• Microprocessors, microcontrollers, ASICs and FPGAs with security-related functionalities, and their tamper-resistant variants, at CENELEC CLC/TC 47X.
• All three Annex IV critical categories: hardware devices with security boxes, smart meter gateways, and smartcards including secure elements.

The full mapping from every Annex III and Annex IV point to its standard sets out which committee holds each one.

Article 27(1) attaches the presumption to harmonised standards, or parts of them, the references of which have been published in the Official Journal of the European Union.^[1] A draft confers nothing under that article, however closely a product follows it and however advanced the draft is.

That matters most for Annex III Class I products. Article 32(2) removes the module A self-assessment option where the manufacturer has not applied, or has applied only in part, harmonised standards, common specifications or a European cybersecurity certification scheme at assurance level at least substantial, or where such standards do not exist.^[2] With nothing cited, the final limb is satisfied today for every category, so third-party assessment through module B and C or module H is the live route. Article 32(3) puts Class II products there regardless.

What a public draft does buy is a preview of the requirements. Several ETSI deliverables are open for comment, so a manufacturer can read what its category will be measured against and build the evidence now rather than after citation.^[5]

Firewalls, network management systems, physical and virtual network interfaces, VPN products, routers and switches, and SIEM systems each have two deliverables in progress. Alongside the ETSI vertical, CENELEC CLC/TC 65X WG 3 is drafting the prEN 50770 series on IEC 62443 foundations, aimed at operational technology.^[6]

The overlap is deliberate rather than accidental. The M/606 wording for the firewall line item reaches products intended for industrial use explicitly, and industrial deployments of these product types have a different threat model and a different installed base than their IT equivalents.

For a manufacturer selling the same product into both IT and OT markets, this may eventually become a choice of which standard to apply, or a need to satisfy both. Neither track is cited in the Official Journal, so it is a decision to revisit once citations appear rather than one to make now. What is worth doing today is reading whichever draft is closer to your market, since the underlying engineering will carry across either way.