Skip to main content

Standards and regulatory alignment

The Standards hub (https://cvdportal.com/standards) explains how CVD Portal maps to the European standards and bodies that sit underneath the EU Cyber Resilience Act (CRA). Each page states plainly which standards confer a presumption of conformity and which are supporting references, so you can see where your evidence carries legal weight and where it is good practice.

What is on the hub​

The hub links a page for each standard or body:

  • CEN/CENELEC FprEN 40000-1-2 (FprEN 40000-1-2 Hub) — the horizontal standard for CRA Annex I Part I product security, risk management (Clause 6), and lifecycle activities (Clause 7). CEN ratified it as EN 40000-1-2 on 2 November 2026, and CEN gives 18 November 2026 as the date its text becomes available. Its CEN record says "No citation expected for Directive 2024/2847", so its publication is not expected to confer presumption of conformity. Detailed clause-by-clause guides map every requirement ID (RMA-01 to RMA-09, CLA-01 to CLA-10) directly to platform features.
  • CEN/CENELEC EN 40000-1-3 (https://cvdportal.com/standards/en-40000-1-3) — the draft harmonised standard for CRA vulnerability handling, with a full clause-to-feature mapping. CEN has closed its Enquiry and lists it as Under Approval. It is still a draft, so it does not yet confer presumption of conformity. It is the one EN 40000-1 part whose CEN record says "Citation expected for Directive 2024/2847". Once it is cited in the Official Journal of the EU, fully applying it will support presumption of conformity for the Annex I vulnerability-handling requirements under Article 27.
  • ENISA, the EUVD and Article 14 (https://cvdportal.com/standards/enisa) — how the platform aligns with ENISA's role: the Article 14 Single Reporting Platform, the European Vulnerability Database (EUVD), and national CSIRTs. The page shows a live EUVD feed, the same feed the platform uses for vulnerability monitoring.
  • ETSI EN 304 6xx vertical standards (https://cvdportal.com/standards/etsi-en-304) — the 18 product-specific CRA standards ETSI is drafting under standardisation request M/606, one for each Annex III product category, from browsers and password managers through to firewalls and hypervisors. The page maps every Annex III and Annex IV point to the standard being written for it, names the nine points ETSI is not covering and who drafts them instead, and lists the parallel CENELEC prEN 50770 series for operational technology. All of it is draft, so none of it confers presumption of conformity.
  • ETSI EN 303 645 (https://cvdportal.com/standards/etsi-en-303-645) — the consumer-IoT cybersecurity baseline that accredited labs test against, with all 13 provisions mapped to CRA Annex I evidence and platform features. It predates the CRA and is separate from ETSI's EN 304 work. The page tells you to ask a test lab for the latest published EN 303 645 with the matching ETSI TS 103 701 test specification, and for both versions in the test report. On 7 November 2026 these were EN 303 645 V3.1.3 (2024-09) and TS 103 701 V2.1.1 (2025-05). TS 103 701 V1.1.1 (2021-08) tests the earlier EN 303 645 V2.1.1 (2020-06).
  • EN 18031 series (https://cvdportal.com/standards/en-18031). EN 18031 is the series of three harmonised standards for the cybersecurity points of the Radio Equipment Directive, which Delegated Regulation (EU) 2022/30 made mandatory from 1 August 2025. The page names the restrictions the Commission attached when it cited the series, maps the test evidence to CRA Annex I, and states that Delegated Regulation (EU) 2026/339 repeals Delegated Regulation (EU) 2022/30 from 11 December 2027.
  • ISO/IEC 27001 and IEC 62443 (https://cvdportal.com/standards/iso-62443-27001) — the information-security management system standard and the industrial (OT) security series, mapped to CRA process and product requirements.
  • ENISA Secure by Design and Default Playbook (https://cvdportal.com/standards/enisa-sbd) — all 22 ENISA playbooks with their release gates, mapped to CRA Annex I using ENISA's own Annex C, plus the requirements that rest on a single playbook. It is agency guidance rather than a standard, so it confers no presumption of conformity.
  • OSCAL catalog (https://cvdportal.com/standards/oscal) — the CRA vulnerability-handling requirements expressed as a machine-readable OSCAL catalog for automated compliance tooling.
  • Machine-processable attestation (https://cvdportal.com/standards/machine-processable-attestation) — section 5 of the ENISA playbook: the control, implementation and assessment cascade, the split between a publicly verifiable attestation layer and a restricted technical overlay, and the eleven formats in that ecosystem. The section deliberately defines no schema, and the page says which of the four layers this platform emits machine-readable output for today.
  • Notified bodies and testing labs (https://cvdportal.com/standards/notified-bodies) — a directory of EU conformity-assessment bodies and cybersecurity testing laboratories.

Which other EU laws relate to the CRA?​

The hub also has a table of 16 EU laws that apply beside the CRA or change how it applies (https://cvdportal.com/standards#related-eu-laws). Each row names the CRA article or recital that sets the link and links the official text on EUR-Lex. The relations were checked against EUR-Lex on 7 November 2026.

  • Three laws overlap with the CRA essential requirements. These are the Radio Equipment Directive delegated act (EU) 2022/30, the AI Act (CRA Article 12) and the Machinery Regulation (CRA recital 53). Delegated Regulation (EU) 2026/339 repeals the radio equipment act from 11 December 2027, the day the CRA applies in full.
  • A certificate under the Cybersecurity Act gives presumption of conformity for the Annex I requirements it covers (CRA Article 27(8)).
  • NIS2 sets where Article 14 reports go, to the CSIRT designated as coordinator (CRA Article 14). The Market Surveillance Regulation (EU) 2019/1020 governs enforcement (CRA Article 52).
  • Five laws apply beside the CRA. These are the Product Liability Directive, the General Product Safety Regulation, the GDPR, the Data Act and the eIDAS Regulation.
  • Five sector laws take a product out of CRA scope (CRA Article 2). These cover medical devices, in vitro diagnostic devices, vehicles, certified civil aviation products and marine equipment.

Which standards give a presumption of conformity?​

Only a standard cited in the Official Journal of the EU confers a presumption of conformity with the CRA, and no CRA harmonised standard has been cited yet.

Two families of draft standards are being written under standardisation request M/606, and neither confers anything today. The horizontal family, CEN/CENELEC's EN 40000 series including EN 40000-1-3 for vulnerability handling, applies across all products with digital elements. In that family, CEN expects an Official Journal citation only for prEN 40000-1-3. EN 40000-1-1 and EN 40000-1-2 are due as published standards on 18 November 2026, and CEN expects no citation for them. The vertical family covers one Annex III product category each: mostly ETSI's EN 304 6xx series, with CENELEC handling the semiconductor, smartcard and metering categories. A manufacturer of an important product will likely need both.

ETSI EN 303 645, ISO/IEC 27001 and IEC 62443 are supporting standards: applying them produces reusable evidence for a CRA technical file and is what accredited labs test against, but it does not by itself grant presumption of conformity. Each page states this clearly.

If you want to know which vertical standard is being drafted for your product, the product classifier (https://cvdportal.com/classify) names it alongside your Annex III class and conformity assessment route.

Platform support boundaries: Default vs. Important/Critical​

CVD Portal is built around clear compliance boundaries:

  • Default-class products (Module A): CVD Portal provides the complete, automated compliance path. You perform the risk assessment, satisfy the Annex I checklist, generate the EU Declaration of Conformity, and maintain the Annex VII technical documentation directly within the platform, without needing a third-party notified body.
  • Important products (Class I & Class II) and Critical products (Annex IV): Class II and critical products always need third-party conformity assessment (Module B+C, Module H, or a European cybersecurity certification scheme such as EUCC). Class I products need it for as long as they do not fully apply a harmonised standard cited in the Official Journal, a common specification or such a scheme. No CRA harmonised standard is cited yet. When one is cited, CVD Portal opens Module A for a Class I product only when the recorded standards name the cited standard for the product's own category. Applying a product-specific vertical standard is voluntary, as it is for every harmonised standard. It gives presumption of conformity only after the Official Journal cites it. CVD Portal does not conduct laboratory testing or issue notified-body certificates. For these products, CVD Portal helps you assemble the risk assessment, vulnerability-handling records, and technical file to submit to your designated notified body.

Notified bodies directory​

The notified bodies page (https://cvdportal.com/standards/notified-bodies) lists EU conformity-assessment bodies and cybersecurity testing laboratories, filterable by country, standard and status. It also explains when you actually need a notified body.

Most products with digital elements use internal control (Module A): the manufacturer self-assesses, affixes the CE marking, and needs no notified body. A third-party conformity assessment, and therefore a notified body, applies to important products in Class II, critical products under Annex IV, and Class I products where the manufacturer does not fully apply the relevant harmonised standards. If you are unsure which route applies, run the free product classifier (https://cvdportal.com/classify) or the CRA self-assessment (https://cvdportal.com/cra-self-assessment).

The directory carries an important caveat. At the time of writing, the European Commission had not yet published notified bodies designated specifically under the CRA in the official NANDO database. The organisations listed are established conformity-assessment bodies and accredited testing laboratories that a manufacturer on a third-party route is likely to engage. None is presented as holding a CRA designation, and no NANDO number is shown for a body until one is confirmed. Always verify current designation status directly in NANDO before relying on any body for a CRA conformity assessment.