Updated 2026-09-01 · CC BY 4.0
How many CRA harmonised standards are cited in the Official Journal?
None of the 18 ETSI EN 304 vertical Cyber Resilience Act standards is cited in the Official Journal of the European Union, so Article 27 presumption of conformity is available for no Annex III product category. 17 have a publicly downloadable draft and 10 record an open ETSI approval procedure that closes between mid-September and mid-November 2026.
18
Deliverables
17
Public draft
10
In approval
0
Cited in the OJ
Key takeaways
- Three different measures get conflated in coverage of this series. Having a public draft, being in the approval procedure and being cited in the Official Journal are separate states, and only the last one triggers Article 27.
- Every one of these ETSI work items carries a Harmonised Standard flag reading Yes. That flag marks a candidate for harmonisation under standardisation request M/606 and is not a citation.
- ETSI announced 17 final drafts under Public Enquiry on 13 August 2026. The work programme records a finer per-deliverable status, so this dataset carries the row rather than the aggregate.
- EN 304 642 is the one deliverable absent from the ETSI publication directory, which is why a count of the series returns 18 and a count of the published drafts returns 17.
- Nine Annex III and Annex IV points sit outside the ETSI series entirely, with CEN and CENELEC committees instead.
Status by deliverable
| Deliverable | Annex point | Work programme status | Version | Cited |
|---|---|---|---|---|
Browsers | Annex III, Class I, point 2 | Deliverable approval procedure initiatedOpened 2026-08-13 | V1.0.02026-08-13 | No |
Password managers | Annex III, Class I, point 3 | EC assessment before EV received | V0.2.22026-06-22 | No |
Anti-malware software | Annex III, Class I, point 4 | Deliverable approval procedure initiatedOpened 2026-07-20 | V1.0.02026-07-20 | No |
VPN products | Annex III, Class I, point 5 | Deliverable approval procedure initiatedOpened 2026-08-13 | V1.0.02026-08-13 | No |
Network management systems | Annex III, Class I, point 6 | Deliverable approval procedure initiatedOpened 2026-08-13 | V1.0.52026-08-13 | No |
SIEM systems | Annex III, Class I, point 7 | Deliverable approval procedure initiatedOpened 2026-08-13 | V1.0.02026-08-13 | No |
Boot managers | Annex III, Class I, point 8 | EC assessment before EV received | V0.1.32026-06-17 | No |
PKI and certificate issuance | Annex III, Class I, point 9 | EC assessment before EV requested | V1.0.02026-08-06 | No |
Network interfaces | Annex III, Class I, point 10 | Deliverable approval procedure initiatedOpened 2026-08-10 | V1.0.02026-08-10 | No |
Operating systems | Annex III, Class I, point 11 | Deliverable approval procedure initiatedOpened 2026-08-13 | V1.0.12026-08-13 | No |
Routers, modems and switches | Annex III, Class I, point 12 | EC assessment before EV received | V1.0.12026-07-09 | No |
Smart home virtual assistants | Annex III, Class I, point 16 | Deliverable approval procedure initiatedOpened 2026-07-20 | V1.0.02026-07-20 | No |
Smart home security products | Annex III, Class I, point 17 | Deliverable approval procedure initiatedOpened 2026-07-20 | V1.0.02026-07-20 | No |
Internet-connected toys | Annex III, Class I, point 18 | Deliverable approval procedure initiatedOpened 2026-07-20 | V1.0.02026-07-20 | No |
Personal wearables | Annex III, Class I, point 19 | EC assessment before EV requested | V1.0.02026-07-23 | No |
Hypervisors and container runtimes | Annex III, Class II, point 1 | EC assessment before EV received | V1.0.12026-06-25 | No |
Firewalls and IDS/IPS | Annex III, Class II, point 2 | EC assessment before EV received | V1.0.02026-07-13 | No |
EN 304 642 Telecom network functions | No Annex III or Annex IV point | Early draft | – | No |
Status, version and cover date come from each deliverable's own ETSI Work Programme work item report. Verified 2026-09-01.
Method and limits
Curated compilation of public primary sources. Not a measurement study.
Two ETSI surfaces describe the same batch at different resolutions and both are correct. The press release states that 17 final drafts are under Public Enquiry. The work programme records a finer per-deliverable status. This dataset carries the per-deliverable status, because a reader checking one product needs the row rather than the aggregate.
Every one of these ETSI work items carries a field labelled Harmonised Standard reading Yes. That field marks a candidate for harmonisation under M/606 and is not a citation. The separate Official Journal field is what records a citation, and it was empty on all 18 deliverables when checked.
This dataset carries metadata about the standards and reproduces no clause text. The standards are ETSI copyright. The CC BY 4.0 licence covers this compilation and its annotations.
Limits
- A stage reflects what a public source showed on the verification date. A deliverable may be further along inside ETSI than any public source can show.
- A deliverable with no publicly downloadable draft is recorded as a work item with no version, rather than given an inferred stage.
- Work item status strings are ETSI's own workflow vocabulary and are reproduced rather than paraphrased.
Sources
- ETSI Work Programme work item detail reports
Version, cover date, work item reference, approval status and the Official Journal field. Read one work item per deliverable, because the work item ids are not sequential by deliverable number.
- ETSI publication directory for the 304 600 to 304 699 block
The permanent version-addressed PDF for each deliverable. A deliverable absent from this directory has no public draft.
- ETSI CYBER-EUSR open consultation area
The consultation copy of each draft. Paths here move as drafts progress, which is why the publication directory is the citable link.
- ETSI press release, 13 August 2026
The announcement that 17 final drafts entered Public Enquiry, and the mid-September to mid-November 2026 closing window.
- CRA Standards Unlocked, the CEN, CENELEC and ETSI joint programme
Which committee holds each Annex III and Annex IV point outside the ETSI series.
- Regulation (EU) 2024/2847
Article 27 attaches presumption of conformity to a reference published in the Official Journal, which is the field this dataset records per deliverable.
Download and cite
The dataset is CC BY 4.0. Reuse it anywhere, including commercially, as long as the source is named. The correct attribution travels inside the file.
CVD Portal, "CRA Standards Progress: the ETSI EN 304 vertical series under standardisation request M/606", 2026-09-01. https://cvdportal.com/research/cra-standards-progress (CC BY 4.0)