CE Marking (Cybersecurity)

The CE mark ('Conformité Européenne') is a mandatory product marking used across EU product safety legislation to indicate that a product meets applicable EU requirements. Under the CRA, manufacturers of products with digital elements must affix the CE mark before placing their product on the EU market — it serves as a declaration that the product meets the Annex I essential cybersecurity requirements and that the appropriate conformity assessment procedure has been completed. The CE mark does not indicate EU government approval or third-party certification in all cases; for Default and Class I products under harmonised standards, it represents the manufacturer's own declaration backed by technical documentation.

Before affixing the CE mark for CRA compliance, a manufacturer must:

1. Confirm the product is a product with digital elements within the CRA's scope.
2. Determine the product's Annex III classification (Default, Class I, Class II, Critical).
3. Complete the applicable conformity assessment procedure (self-assessment for Default and Class I with harmonised standards; notified body for Class II and Critical).
4. Compile technical documentation demonstrating compliance with Annex I requirements.
5. Sign an EU Declaration of Conformity (EU DoC).
6. Register the product in the EU database (required for Important and Critical class products).

Only after steps 1–6 may the CE mark be affixed.

CE marking under the CRA is not a one-time certification — the manufacturer's ongoing compliance obligations continue after the mark is affixed. Key post-marking obligations:

• Vulnerability monitoring — the manufacturer must continue monitoring for vulnerabilities in the product and patching them.
• Advisory publication — security advisories must be published when patches are released.
• ENISA notification — actively exploited vulnerabilities must be reported within 24 hours.
• Technical documentation updates — documentation must be kept current as the product evolves.
• Significant modifications — if the product is substantially modified after CE marking, the conformity assessment must be repeated and a new DoC signed.

Market surveillance authorities can require withdrawal of the CE mark if ongoing obligations are not met.

Many products are subject to multiple EU regulatory frameworks, each with its own CE marking requirements. For example, a connected consumer device may need to satisfy both the Radio Equipment Directive (RED) and the CRA. Where multiple frameworks apply:

• A single CE mark is used, but the product must meet the requirements of all applicable frameworks.
• The technical documentation must address all applicable requirements.
• The DoC must reference all applicable EU legislation.
• If frameworks conflict, the more specific regulation takes precedence.

From August 2025, the Radio Equipment Directive's cybersecurity delegated regulation (EU 2022/30) applied — CRA compliance will largely supersede this for in-scope products, but manufacturers must track the transition carefully.