← All research

Updated 2026-09-01 · CC BY 4.0

How many CRA harmonised standards are cited in the Official Journal?

None of the 18 ETSI EN 304 vertical Cyber Resilience Act standards is cited in the Official Journal of the European Union, so Article 27 presumption of conformity is available for no Annex III product category. 17 have a publicly downloadable draft and 10 record an open ETSI approval procedure that closes between mid-September and mid-November 2026.

18

Deliverables

17

Public draft

10

In approval

0

Cited in the OJ

Key takeaways

  • Three different measures get conflated in coverage of this series. Having a public draft, being in the approval procedure and being cited in the Official Journal are separate states, and only the last one triggers Article 27.
  • Every one of these ETSI work items carries a Harmonised Standard flag reading Yes. That flag marks a candidate for harmonisation under standardisation request M/606 and is not a citation.
  • ETSI announced 17 final drafts under Public Enquiry on 13 August 2026. The work programme records a finer per-deliverable status, so this dataset carries the row rather than the aggregate.
  • EN 304 642 is the one deliverable absent from the ETSI publication directory, which is why a count of the series returns 18 and a count of the published drafts returns 17.
  • Nine Annex III and Annex IV points sit outside the ETSI series entirely, with CEN and CENELEC committees instead.

Status by deliverable

DeliverableAnnex pointWork programme statusVersionCited
Browsers
Annex III, Class I, point 2Deliverable approval procedure initiatedOpened 2026-08-13V1.0.02026-08-13No
Password managers
Annex III, Class I, point 3EC assessment before EV receivedV0.2.22026-06-22No
Anti-malware software
Annex III, Class I, point 4Deliverable approval procedure initiatedOpened 2026-07-20V1.0.02026-07-20No
VPN products
Annex III, Class I, point 5Deliverable approval procedure initiatedOpened 2026-08-13V1.0.02026-08-13No
Network management systems
Annex III, Class I, point 6Deliverable approval procedure initiatedOpened 2026-08-13V1.0.52026-08-13No
SIEM systems
Annex III, Class I, point 7Deliverable approval procedure initiatedOpened 2026-08-13V1.0.02026-08-13No
Boot managers
Annex III, Class I, point 8EC assessment before EV receivedV0.1.32026-06-17No
PKI and certificate issuance
Annex III, Class I, point 9EC assessment before EV requestedV1.0.02026-08-06No
Network interfaces
Annex III, Class I, point 10Deliverable approval procedure initiatedOpened 2026-08-10V1.0.02026-08-10No
Operating systems
Annex III, Class I, point 11Deliverable approval procedure initiatedOpened 2026-08-13V1.0.12026-08-13No
Routers, modems and switches
Annex III, Class I, point 12EC assessment before EV receivedV1.0.12026-07-09No
Smart home virtual assistants
Annex III, Class I, point 16Deliverable approval procedure initiatedOpened 2026-07-20V1.0.02026-07-20No
Smart home security products
Annex III, Class I, point 17Deliverable approval procedure initiatedOpened 2026-07-20V1.0.02026-07-20No
Internet-connected toys
Annex III, Class I, point 18Deliverable approval procedure initiatedOpened 2026-07-20V1.0.02026-07-20No
Personal wearables
Annex III, Class I, point 19EC assessment before EV requestedV1.0.02026-07-23No
Hypervisors and container runtimes
Annex III, Class II, point 1EC assessment before EV receivedV1.0.12026-06-25No
Firewalls and IDS/IPS
Annex III, Class II, point 2EC assessment before EV receivedV1.0.02026-07-13No
EN 304 642
Telecom network functions
No Annex III or Annex IV pointEarly draftNo

Status, version and cover date come from each deliverable's own ETSI Work Programme work item report. Verified 2026-09-01.

Method and limits

Curated compilation of public primary sources. Not a measurement study.

Two ETSI surfaces describe the same batch at different resolutions and both are correct. The press release states that 17 final drafts are under Public Enquiry. The work programme records a finer per-deliverable status. This dataset carries the per-deliverable status, because a reader checking one product needs the row rather than the aggregate.

Every one of these ETSI work items carries a field labelled Harmonised Standard reading Yes. That field marks a candidate for harmonisation under M/606 and is not a citation. The separate Official Journal field is what records a citation, and it was empty on all 18 deliverables when checked.

This dataset carries metadata about the standards and reproduces no clause text. The standards are ETSI copyright. The CC BY 4.0 licence covers this compilation and its annotations.

Limits

  • A stage reflects what a public source showed on the verification date. A deliverable may be further along inside ETSI than any public source can show.
  • A deliverable with no publicly downloadable draft is recorded as a work item with no version, rather than given an inferred stage.
  • Work item status strings are ETSI's own workflow vocabulary and are reproduced rather than paraphrased.

Sources

Download and cite

The dataset is CC BY 4.0. Reuse it anywhere, including commercially, as long as the source is named. The correct attribution travels inside the file.

CVD Portal, "CRA Standards Progress: the ETSI EN 304 vertical series under standardisation request M/606", 2026-09-01. https://cvdportal.com/research/cra-standards-progress (CC BY 4.0)