--- title: "CRA Harmonised Standards FAQ" canonical_url: "https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/harmonised-standards-and-common-specifications" source_url: "https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/harmonised-standards-and-common-specifications" author: "Sorena AI" description: "Cyber Resilience Act FAQ on how harmonised standards, common specifications, certification schemes, and OJ publication affect CRA conformity evidence." published_at: "2026-03-10" updated_at: "2026-03-10" keywords: - "CRA harmonised standards" - "Cyber Resilience Act common specifications" - "CRA presumption of conformity" - "CRA certification schemes" - "CRA M/606" - "Cyber Resilience Act" - "CRA FAQ" - "EU compliance" - "CRA harmonised standards FAQ" --- **[SORENA](https://www.sorena.io/)** - AI-Powered GRC Platform [Home](https://www.sorena.io/) | [Solutions](https://www.sorena.io/solutions) | [Artifacts](https://www.sorena.io/artifacts) | [About Us](https://www.sorena.io/about-us) | [Contact](https://www.sorena.io/contact) | [Portal](https://app.sorena.io) --- # CRA Harmonised Standards FAQ Cyber Resilience Act FAQ on how harmonised standards, common specifications, certification schemes, and OJ publication affect CRA conformity evidence. *FAQ* *EU* *Cyber Resilience Act* ## EU Cyber Resilience Act FAQ Harmonised Standards and Common Specifications Understand when CRA harmonised standards, common specifications, and European cybersecurity certification schemes help prove conformity, and where that evidence stops. For product, engineering, certification, legal, and compliance teams preparing CRA technical documentation and conformity assessment routes. The Cyber Resilience Act uses harmonised standards, common specifications, and selected European cybersecurity certification schemes as evidence tools. They can create presumption of conformity for the CRA requirements they cover, but they do not replace the legal requirements, the manufacturer's cybersecurity risk assessment, or the need to document gaps. ## What are harmonised standards, common specifications, and European cybersecurity certification schemes under the CRA? They are technical conformity tools for showing how a product with digital elements and the manufacturer's processes meet the CRA's essential cybersecurity requirements. Harmonised standards are European standards requested and assessed through the EU standardisation system. Common specifications are Commission implementing acts that can be used only as an exceptional fallback where the Article 27 conditions are met. European cybersecurity certification schemes can support CRA conformity only to the extent the relevant certificate or EU statement of conformity covers the CRA requirements. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 27 establishes the CRA legal effects for harmonised standards, common specifications, and European cybersecurity certification schemes. - [European Commission CRA standardisation page](https://digital-strategy.ec.europa.eu/en/policies/cra-standardisation?ref=sorena.io) - The Commission explains that CRA harmonised standards translate essential cybersecurity requirements into technical specifications. ## Are harmonised standards mandatory under the Cyber Resilience Act? No. Applying harmonised standards is voluntary, but the manufacturer must still demonstrate conformity with the CRA's essential cybersecurity requirements. If a manufacturer does not use a relevant harmonised standard, or uses only part of it, the technical documentation needs to explain the other solutions and technical specifications used for the requirements not covered by the standard. Sources for this answer: - [European Commission CRA implementation FAQs](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Commission FAQ section 4.1.7 says harmonised standards are a means to demonstrate compliance, not the only route. - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Annex VII point 5 requires technical documentation to list applied harmonised standards or describe other solutions. ## Does every European, ISO, IEC, or ETSI standard create CRA presumption of conformity? No. For a harmonised standard to create CRA presumption of conformity, its reference must be published in the Official Journal of the European Union for the relevant coverage. A non-harmonised international, European, ISO, IEC, or ETSI standard may still be useful evidence, but it does not by itself create CRA presumption of conformity. The Blue Guide also warns that where a European standard is based on ISO or IEC text, the presumption attaches to the European version published by reference in the OJEU, not automatically to the source international text. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 27(1) ties CRA presumption of conformity for harmonised standards to OJ-published references. - [Blue Guide 2022](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:52022XC0629(04)&ref=sorena.io) - Blue Guide sections 4.1.2.2 and 4.1.2.3 explain OJEU publication and the European-version limit. ## What does CRA presumption of conformity mean in practice? It means authorities should presume conformity with the specific CRA essential cybersecurity requirements covered by the applied harmonised standard, common specification, or qualifying certification evidence. The presumption is not product-wide unless the applied conformity tool covers all relevant CRA requirements and risks for that product and the manufacturer's processes. If coverage is partial, the presumption is partial. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 27(1), 27(5), and 27(8) limit presumption to the essential requirements covered by the relevant tool. - [Blue Guide 2022](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:52022XC0629(04)&ref=sorena.io) - Blue Guide section 4.1.2.2 explains that the scope of presumption depends on the requirements the standard aims to cover. ## Do CRA harmonised standards replace the manufacturer's cybersecurity risk assessment? No. The cybersecurity risk assessment remains the starting point for deciding which CRA essential requirements are relevant to the product. The Commission FAQ says that even when a harmonised standard is used, the manufacturer remains responsible for assessing product risks, selecting suitable standards or other specifications, and checking whether the standard covers all relevant risks. Sources for this answer: - [European Commission CRA implementation FAQs](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Commission FAQ section 4.1.7 directly addresses the relationship between harmonised standards and the manufacturer risk assessment. - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 13(2) and Annex VII require the manufacturer's cybersecurity risk assessment and its inclusion in technical documentation. ## What if a CRA harmonised standard covers only part of the product or only part of the requirements? Then only that part benefits from presumption of conformity. For the remaining requirements or risks, the manufacturer must use other technical specifications or solutions, explain them in the technical documentation, and show why those solutions meet the applicable CRA requirements. Sources for this answer: - [European Commission CRA implementation FAQs](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Commission FAQ section 4.1.7 says partial standard coverage must be supplemented by other specifications or solutions. - [Blue Guide 2022](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:52022XC0629(04)&ref=sorena.io) - Blue Guide section 4.1.2.3 confirms that partial application gives presumption only to the covered extent. ## What did the CRA standardisation request M/606 ask CEN, CENELEC, and ETSI to develop? The Commission says M/606 requests a set of harmonised standards in support of CRA compliance, with both horizontal and vertical standards. Horizontal standards are intended to provide a common framework, methodology, taxonomy, and processes such as vulnerability handling. Vertical standards are product-specific and focus on risks tied to particular intended purposes and reasonably foreseeable uses, especially for important and critical product categories in CRA Annexes III and IV. Sources for this answer: - [European Commission CRA standardisation page](https://digital-strategy.ec.europa.eu/en/policies/cra-standardisation?ref=sorena.io) - The Commission CRA standardisation page describes M/606 and the horizontal/vertical split. - [European Commission CRA implementation FAQs](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Commission FAQ section 6.10 describes horizontal and vertical standards and the ESO development work. ## Does the CRA standardisation request itself create presumption of conformity? No. M/606 starts and frames the standards-development work; it is not the same as an OJ-published harmonised standard. Even after an ESO adopts a European standard, Article 27(6) requires the Commission to assess it before publishing its reference in the Official Journal. Until the relevant reference is published, the standard does not create CRA presumption of conformity. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 27(6) requires Commission assessment before OJ publication of a harmonised standard reference. - [Blue Guide 2022](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:52022XC0629(04)&ref=sorena.io) - Blue Guide section 4.1.2.3 says OJEU publication starts the presumption and is not automatic. ## What happens under the CRA if no relevant harmonised standard exists yet? The product can still be compliant, but the manufacturer must demonstrate conformity by other means. The absence of a harmonised standard can also affect route selection. For important products of class I, if relevant harmonised standards, common specifications, or qualifying certification schemes do not exist, Article 32(2) requires a third-party conformity assessment route for the corresponding essential cybersecurity requirements. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 32(2) sets the class I route consequence when relevant harmonised standards, common specifications, or schemes do not exist or are not applied. - [Blue Guide 2022](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:52022XC0629(04)&ref=sorena.io) - Blue Guide section 4.1.3 explains that manufacturers may use other means but must demonstrate conformity themselves. ## When can the Commission adopt CRA common specifications? Only in the fallback situations set out in Article 27. The Commission may adopt common specifications after it has requested harmonised standards and the request was not accepted, the standards were not delivered on time, or the standards do not comply with the request. Article 27 also requires that no relevant OJ-published harmonised-standard reference exists and no such reference is expected within a reasonable period. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 27(2)-(4) defines the conditions and consultation steps for common specifications. ## Are CRA common specifications a general mandatory substitute for harmonised standards? No. Common specifications are an exceptional fallback tool, not the normal first-line standardisation route. If common specifications are adopted and applied, they can create presumption of conformity for the CRA requirements they cover. If a manufacturer does not apply them, Annex VII still requires the technical documentation to describe the alternative solutions and relevant technical specifications used. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 27(2) and 27(5) define common specifications as fallback implementing acts that can create presumption for covered requirements. - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Annex VII point 5 requires documentation of other solutions when common specifications are not applied. ## Do CRA common specifications stay in place once a relevant harmonised standard is published? Not for the overlapping essential cybersecurity requirements. When the reference of a harmonised standard is published in the Official Journal, Article 27(6) requires the Commission to repeal the common specifications, or parts of them, that cover the same CRA requirements. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 27(6) requires repeal of overlapping common specifications after OJ publication of the relevant harmonised standard reference. ## Can a manufacturer rely on non-harmonised standards or its own technical specifications instead? Yes, but that route does not carry the same presumption. The Blue Guide says manufacturers may use other standards, non-OJ European standards, international standards, other technical specifications, or their own specifications. The practical consequence is a heavier evidence burden: the technical file must show in more detail how those choices meet the CRA requirements. Sources for this answer: - [Blue Guide 2022](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:52022XC0629(04)&ref=sorena.io) - Blue Guide section 4.1.3 lists other possibilities and explains the additional demonstration burden. - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Annex VII point 5 requires a list of other relevant technical specifications when harmonised standards or common specifications are not applied. ## How do European cybersecurity certification schemes interact with CRA presumption of conformity? They can create presumption of conformity only for the CRA requirements covered by the certificate or EU statement of conformity. Article 27(8) gives this limited presumption for products and manufacturer processes covered by a European cybersecurity certification scheme under Regulation (EU) 2019/881. Article 27(9) separately lets the Commission specify schemes that can be used to demonstrate CRA conformity; where such a scheme issues a European cybersecurity certificate at assurance level at least substantial, the manufacturer does not have to carry out a separate third-party CRA conformity assessment for the corresponding requirements. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 27(8)-(9) defines certification-scheme presumption and the assurance-level effect for corresponding third-party CRA assessment duties. ## Does any EU cybersecurity certificate automatically replace CRA conformity assessment? No. The certificate must be under a relevant European cybersecurity certification scheme, must cover the corresponding CRA requirements, and Article 27(9) requires the Commission to specify which schemes can be used to demonstrate CRA conformity. A certificate or EU statement of conformity that covers only some requirements gives evidence only for those requirements. It does not prove unrelated CRA requirements, unsupported product functions, vulnerability-handling processes, or technical documentation completeness. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 27(8)-(9) limits certificate effect to covered requirements and Commission-specified schemes. - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Annex VII point 5 still requires technical documentation to identify applied certification schemes and parts applied. ## Can important or critical CRA products be compliant without harmonised standards? Yes, because harmonised standards are voluntary. But for important and critical products, route selection may change. For important products of class I, Article 32(2) moves the corresponding requirements into Module B plus C or Module H if the manufacturer has not applied, has applied only in part, or cannot use relevant harmonised standards, common specifications, or qualifying certification schemes at assurance level at least substantial. Class II and critical products have their own third-party or certification routes under Article 32. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 32(2)-(4) sets conformity assessment routes for class I, class II, and critical products. - [European Commission CRA implementation FAQs](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Commission FAQ section 7.4 confirms harmonised standards are a means to demonstrate compliance, not the only means. ## Can a manufacturer integrate important or critical components that were not designed using harmonised standards? Yes. The Commission FAQ says manufacturers may integrate important or critical components that were not designed in accordance with harmonised standards, whether or not such standards are available. That does not remove the integrator's CRA work. The manufacturer of the final product still needs to assess component risks, decide whether the final product itself has the core functionality of an important or critical category, and keep technical documentation showing how the final product meets the CRA requirements. Sources for this answer: - [European Commission CRA implementation FAQs](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Commission FAQ section 7.4 directly answers whether important or critical components may be integrated without harmonised standards. ## What must CRA technical documentation say about harmonised standards, common specifications, and certification schemes? It must identify the conformity tools applied in full or in part, and it must identify the gaps. Annex VII requires a list of applied OJ-published harmonised standards, Article 27 common specifications, and European cybersecurity certification schemes. If they are partly applied, the documentation must specify which parts. If they are not applied, it must describe the solutions adopted to meet the CRA requirements and list other relevant technical specifications. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Annex VII point 5 gives the specific documentation fields for standards, common specifications, certification schemes, partial application, and alternatives. - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 31 requires technical documentation to contain the means used to ensure CRA conformity and to be kept updated where appropriate. ## What happens if CRA standards, common specifications, or certification schemes change after series production starts? The manufacturer must take those changes into account for continuing conformity. CRA Article 13(14) requires procedures for series production to remain in conformity and specifically mentions changes in harmonised standards, common specifications, and certification schemes by reference to which conformity is declared or verified. The Blue Guide adds that revised harmonised standards may have OJEU coexistence periods, after which only the revised standard gives presumption for new conformity assessments. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 13(14) requires manufacturers to account for changes to standards, common specifications, or certification schemes used for conformity. - [Blue Guide 2022](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:52022XC0629(04)&ref=sorena.io) - Blue Guide section 4.1.2.5 explains withdrawal dates and coexistence periods for revised harmonised standards. ## Can OJ-published CRA harmonised standards be restricted, withdrawn, or challenged? Yes. OJ publication creates the legal effect, but that legal effect can be restricted, prevented, or withdrawn. The Blue Guide explains that the Commission may publish a reference with restrictions or later maintain, restrict, or withdraw the reference. Under the CRA safeguard process, if non-compliance is attributed to shortcomings in harmonised standards, common specifications, or certification schemes, the Commission may trigger the relevant standardisation objection or amendment process. Sources for this answer: - [Blue Guide 2022](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:52022XC0629(04)&ref=sorena.io) - Blue Guide sections 4.1.2.4 and 4.1.2.5 explain restriction, withdrawal, and revision of harmonised-standard references. - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Articles 54(6)(b) and 55(3)-(5) address non-compliance attributed to shortcomings in standards, schemes, or common specifications. ## What evidence limits should CRA teams record when relying on standards, common specifications, or certification schemes? Record the exact version, OJ reference status where relevant, requirements covered, parts applied, product functions covered, processes covered, tests or assessments performed, and remaining risks or requirements handled by other means. The key evidence limit is coverage. A standard, common specification, certificate, or EU statement of conformity supports only the CRA requirements it covers. Technical documentation should therefore map each applicable Annex I requirement to the applied conformity tool or to another documented solution, rather than treating a standard name or certificate as blanket proof. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Annex VII point 5 supports requirement-by-requirement documentation of applied tools, parts applied, alternatives, and technical specifications. - [European Commission CRA implementation FAQs](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Commission FAQ section 4.1.7 supports recording uncovered risks and requirements when standards are partial or not used. ## Primary sources - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Official Cyber Resilience Act legal text supporting this FAQ and its article-level compliance conclusions. ## Topic Guides - [CRA Applicability Test for Products With Digital Elements](/artifacts/eu/cyber-resilience-act/applicability-test.md): Check whether the EU Cyber Resilience Act applies to a hardware, software, firmware, open-source, or connected product before conformity planning. - [CRA Article 14 Reporting Obligations for Vulnerabilities and Incidents](/artifacts/eu/cyber-resilience-act/reporting-obligations.md): Article 14 guide to CRA reports for actively exploited vulnerabilities and severe product-security incidents, including deadlines, CSIRT routing, users, and evidence. - [CRA Blue Guide Concepts FAQ | Placing on the Market, Making Available, Distance Sales](/artifacts/eu/cyber-resilience-act/faq/blue-guide-concepts.md): CRA FAQ explaining Blue Guide market-access concepts for products with digital elements: placing on the market, making available, imports, CE marking, operator roles, online sales, stock, and testing exceptions. - [CRA CE Marking FAQ | Conformity Assessment, EU Declaration, Evidence](/artifacts/eu/cyber-resilience-act/faq/ce-marking.md): Practical CRA CE marking answers for products with digital elements: conformity assessment, EU declaration, technical documentation, standards, software placement, and launch evidence. - [CRA Component Due Diligence FAQ | Third-Party Software, FOSS, SBOMs](/artifacts/eu/cyber-resilience-act/faq/component-due-diligence.md): Cyber Resilience Act FAQ on manufacturer due diligence for integrated components, third-party software, FOSS dependencies, SBOMs, vulnerability handling, and evidence records. - [CRA Conformity Assessment and CE Marking](/artifacts/eu/cyber-resilience-act/conformity-assessment-and-ce-marking.md): How to choose a Cyber Resilience Act conformity route, prepare technical documentation, issue the EU declaration of conformity, and affix CE marking. - [CRA Conformity Assessment Routes FAQ | Module A, Module B+C, Module H, Important and Critical Products](/artifacts/eu/cyber-resilience-act/faq/conformity-assessment-routes.md): Cyber Resilience Act FAQ on when manufacturers can use module A, when module B+C or module H is required, and how important and critical products affect the route. - [CRA Cybersecurity Risk Assessment FAQ | Article 13, Annex I, Updates](/artifacts/eu/cyber-resilience-act/faq/cybersecurity-risk-assessment.md): CRA FAQ on Article 13 cybersecurity risk assessments, Annex I applicability, intended purpose, foreseeable use, technical documentation, and update evidence. - [CRA deadlines and compliance calendar | EU Cyber Resilience Act](/artifacts/eu/cyber-resilience-act/deadlines-and-compliance-calendar.md): Track the Cyber Resilience Act entry into force, staged application dates, Article 14 reporting deadlines, transitional rules, and review dates. - [CRA Declaration of Conformity FAQ | Annex V, Simplified Declaration, CE Marking](/artifacts/eu/cyber-resilience-act/faq/declaration-of-conformity.md): FAQ on the Cyber Resilience Act EU Declaration of Conformity: Annex V contents, simplified Annex VI wording, CE marking link, technical documentation, retention, updates, and operator duties. - [CRA Economic Operators FAQ | Manufacturers, Importers, Distributors, Authorised Representatives](/artifacts/eu/cyber-resilience-act/faq/economic-operators.md): CRA FAQ on economic-operator roles: manufacturers, importers, distributors, authorised representatives, substantial modification, traceability, and evidence controls. - [CRA Essential Cybersecurity Requirements FAQ | Annex I Part I and Part II](/artifacts/eu/cyber-resilience-act/faq/essential-cybersecurity-requirements.md): CRA FAQ on Annex I product cybersecurity requirements, vulnerability handling, secure-by-default design, risk assessment, documentation, lifecycle duties, and user information. - [CRA Essential Cybersecurity Requirements in Annex I](/artifacts/eu/cyber-resilience-act/essential-cybersecurity-requirements.md): An official source guide to the Cyber Resilience Act Annex I requirements for product security, vulnerability handling, secure-by-design controls, documentation, and evidence. - [CRA Hardware and Software Boundaries FAQ | Product Scope, Components, RDPS](/artifacts/eu/cyber-resilience-act/faq/hardware-software-boundaries.md): FAQ on Cyber Resilience Act hardware and software boundaries: combined products, standalone software, source code, components, remote data processing, SaaS and market-placement changes. - [CRA Important and Critical Products FAQ | Annex III, Annex IV, Conformity Assessment](/artifacts/eu/cyber-resilience-act/faq/important-and-critical-products.md): FAQ on CRA important and critical products, Annex III and Annex IV classification, core functionality, and conformity assessment consequences. - [CRA Integrated Components and Dependencies FAQ | Third-Party Software and SBOM Evidence](/artifacts/eu/cyber-resilience-act/faq/integrated-components-and-dependencies.md): Cyber Resilience Act FAQ on integrated components, third-party software, remote data processing, SBOM-style evidence, upstream fixes, FOSS dependencies, and manufacturer responsibility. - [CRA Interplay With EU Product Laws FAQ | RED, Machinery, Data Act](/artifacts/eu/cyber-resilience-act/faq/interplay-with-other-eu-laws.md): Official source CRA FAQ on overlap with the Radio Equipment Directive, Machinery Regulation, GPSR, Data Act, exclusions, declarations, documentation, and existing certificates. - [CRA Known Exploitable Vulnerabilities at Launch FAQ](/artifacts/eu/cyber-resilience-act/faq/known-exploitable-vulnerabilities-at-launch.md): FAQ for Cyber Resilience Act launch decisions: known exploitable vulnerabilities, CVEs, component flaws, secure-by-default settings, release gates, Article 14 reporting, and evidence. - [CRA Legacy Products FAQ | Pre-11 December 2027 Products](/artifacts/eu/cyber-resilience-act/faq/legacy-products.md): Cyber Resilience Act FAQ on products placed on the market before 11 December 2027, Article 14 reporting, substantial modification, distributor stock, spare parts, and records. - [CRA Manufacturer Obligations FAQ | Article 13, Annex I, CE Marking](/artifacts/eu/cyber-resilience-act/faq/manufacturer-obligations.md): FAQ for Cyber Resilience Act manufacturers covering Article 13 duties, risk assessment, Annex I, vulnerability handling, support periods, documentation, conformity assessment, reporting, CE marking, and evidence controls. - [CRA Market Surveillance and Enforcement FAQ | Authorities, Corrective Action, Safeguards](/artifacts/eu/cyber-resilience-act/faq/market-surveillance-and-enforcement.md): Cyber Resilience Act FAQ on market-surveillance authorities, investigations, corrective action, withdrawal, recall, safeguards, sweeps, documentation access, and penalties. - [CRA Module B+C FAQ | EU-Type Examination, Conformity to Type, Notified Bodies](/artifacts/eu/cyber-resilience-act/faq/module-b-c.md): CRA Module B+C FAQ explaining EU-type examination, conformity to type, notified-body evidence, production control, CE marking, declarations, and certificate changes. - [CRA Module H FAQ | Full Quality Assurance, Notified Body Surveillance, CE Marking](/artifacts/eu/cyber-resilience-act/faq/module-h.md): CRA Module H FAQ explaining the full-quality-assurance route, notified-body assessment, quality-system scope, technical documentation, CE marking, declarations, and records. - [CRA Notified Bodies FAQ | Scope, Modules B+C and H, Certificates](/artifacts/eu/cyber-resilience-act/faq/notified-bodies.md): Practical CRA FAQ on when notified bodies are needed, how CRA bodies are designated, what their notified scope means, and how Module B+C and Module H assessments work. - [CRA Open-Source Software FAQ | FOSS Scope, Stewards, Manufacturers](/artifacts/eu/cyber-resilience-act/faq/open-source-software.md): Cyber Resilience Act FAQ for free and open-source software: commercial activity, steward duties, manufacturer due diligence, vulnerability handling, public documentation, and user obligations. - [CRA Over-the-Air Updates FAQ](/artifacts/eu/cyber-resilience-act/faq/over-the-air-updates.md): Cyber Resilience Act FAQ on OTA updates, automatic security updates, secure update distribution, support-period evidence, and offline update paths. - [CRA penalties and fines FAQ | Article 64 fine caps](/artifacts/eu/cyber-resilience-act/faq/penalties-and-fines.md): FAQ on EU Cyber Resilience Act Article 64 penalties: maximum fine tiers, turnover caps, national enforcement, economic operators, reporting duties, and open-source steward carve-outs. - [CRA Penalties and Fines: Article 64 Caps and Enforcement Context](/artifacts/eu/cyber-resilience-act/penalties-and-fines.md): Article 64 of the EU Cyber Resilience Act sets administrative fine ceilings for Annex I, manufacturer, reporting, economic-operator, notified-body, and information-request breaches. - [CRA Product Families FAQ | Variants, Shared Assessments, Family Reuse, Conformity Scope](/artifacts/eu/cyber-resilience-act/faq/product-families.md): CRA FAQ on product families, variant grouping, shared technical documentation, conformity evidence, and when cybersecurity-relevant differences need separate assessment. - [CRA Products with Digital Elements Scope | EU Cyber Resilience Act](/artifacts/eu/cyber-resilience-act/products-with-digital-elements-scope.md): Apply the EU Cyber Resilience Act scope test for software, hardware, remote data processing, components, open-source software, exclusions, and economic-operator roles. - [CRA Products With Digital Elements Scope FAQ](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md): EU Cyber Resilience Act FAQ on products with digital elements, software, firmware, remote data processing, components, exclusions, market placement, and CRA operator boundaries. - [CRA Remote Data Processing Solutions FAQ | Product Scope, Cloud and Backend Boundaries](/artifacts/eu/cyber-resilience-act/faq/remote-data-processing-solutions.md): FAQ on how the EU Cyber Resilience Act treats remote data processing solutions, manufacturer-controlled backends, third-party cloud services, SaaS, risk assessment, documentation, and user information. - [CRA Reporting Obligations FAQ | Article 14, CSIRTs, ENISA, User Notices](/artifacts/eu/cyber-resilience-act/faq/reporting-obligations.md): Cyber Resilience Act FAQ on Article 14 reporting for actively exploited vulnerabilities and severe incidents, including timing, CSIRT routing, ENISA access, user notices, and evidence. - [CRA Requirements | Annex I, Manufacturer Duties and CE Evidence](/artifacts/eu/cyber-resilience-act/requirements.md): Map Cyber Resilience Act requirements from Annex I to manufacturer duties, vulnerability handling, user information, technical documentation, declaration of conformity, and CE marking evidence. - [CRA SBOM and Vulnerability Management Template](/artifacts/eu/cyber-resilience-act/sbom-and-vulnerability-management-template.md): Build a CRA-ready SBOM and vulnerability handling record with component inventory, triage, remediation, disclosure, reporting, update, and technical documentation fields. - [CRA Secure-by-Default FAQ | Default Configuration and Annex I Controls](/artifacts/eu/cyber-resilience-act/faq/secure-by-default.md): Cyber Resilience Act FAQ on secure-by-default configuration, automatic security updates, attack surface reduction, authentication, data minimisation, user information, and tailor-made products. - [CRA Security Updates vs Functionality Updates FAQ](/artifacts/eu/cyber-resilience-act/faq/security-updates-vs-functionality-updates.md): Cyber Resilience Act FAQ on classifying security updates, functionality updates, support-period duties, automatic updates, user notices, and substantial-modification review. - [CRA Substantial Modification FAQ | Updates, Repairs, Manufacturer Duties](/artifacts/eu/cyber-resilience-act/faq/substantial-modification.md): Cyber Resilience Act FAQ on when software updates, repairs, spare parts, and post-market changes become substantial modifications and trigger CRA manufacturer, evidence, and conformity duties. - [CRA Support Period FAQ | Expected Product Lifetime, Security Updates, User Information](/artifacts/eu/cyber-resilience-act/faq/support-period.md): Practical CRA FAQ on how manufacturers determine support periods, disclose support end dates, keep security updates available, and document support-period evidence. - [CRA Tailor-Made Products FAQ | Bespoke Products, Market Placement, Evidence](/artifacts/eu/cyber-resilience-act/faq/tailor-made-products.md): FAQ on when a bespoke product may be treated as tailor-made under the EU Cyber Resilience Act, what the carve-out changes, and what manufacturers still need to document. - [CRA Technical Documentation FAQ | Annex VII Evidence and Technical File](/artifacts/eu/cyber-resilience-act/faq/technical-documentation.md): CRA FAQ explaining Annex VII technical documentation, risk assessment evidence, conformity assessment files, vulnerability handling records, product families, RDPS, language, and authority access. - [CRA Transition Period FAQ | Entry Into Force, Application Dates, Reporting, Legacy Products](/artifacts/eu/cyber-resilience-act/faq/transition-period.md): CRA FAQ on the transition period covering entry into force, 2026 reporting, 2027 application, legacy products, stock, customs timing, and software versions. - [CRA Update Availability and Software Archives FAQ](/artifacts/eu/cyber-resilience-act/faq/update-availability-and-archives.md): FAQ on CRA security-update availability, support-period notices, optional public software archives, historical versions, and Article 13(10) software-version limits. - [CRA User Information and Transparency FAQ | Annex II Instructions](/artifacts/eu/cyber-resilience-act/faq/user-information-and-transparency.md): Practical CRA FAQ on Annex II user instructions, support-period disclosure, vulnerability contacts, update notices, importer and distributor information. - [CRA vs RED Cybersecurity Delegated Act](/artifacts/eu/cyber-resilience-act/cra-vs-red-cybersecurity-delegated-act.md): Compare the EU Cyber Resilience Act with the RED cybersecurity delegated act for connected and radio equipment, including scope, timing, evidence, and transition treatment. - [CRA vs UK PSTI Act | Cyber Resilience Act Comparison](/artifacts/eu/cyber-resilience-act/cra-vs-uk-psti-act.md): Compare cited EU Cyber Resilience Act duties with UK PSTI planning points, with UK legal details clearly marked for separate source review. - [CRA Vulnerability Handling and Disclosure | Article 14 Reporting and Security Updates](/artifacts/eu/cyber-resilience-act/vulnerability-handling-and-disclosure.md): How EU Cyber Resilience Act manufacturers should run vulnerability intake, remediation, coordinated disclosure, Article 14 reporting, secure updates, and evidence records. - [CRA Vulnerability Handling FAQ | Support Periods, Components, Reporting](/artifacts/eu/cyber-resilience-act/faq/vulnerability-handling.md): Practical CRA FAQ on vulnerability handling: SBOMs, remediation, coordinated disclosure, component issues, security updates, support periods, Article 14 reporting, and user notices. - [Cyber Resilience Act Module A FAQ | Internal Production Control](/artifacts/eu/cyber-resilience-act/faq/module-a.md): FAQ on when CRA Module A internal production control is available, when it is blocked, and what documentation, testing, standards, and evidence it still requires. - [EU CRA Compliance Program for Manufacturers and Economic Operators](/artifacts/eu/cyber-resilience-act/compliance.md): Build a Cyber Resilience Act compliance program around product scope, Annex I security requirements, conformity assessment, technical documentation, vulnerability reporting, and market surveillance. - [EU Cyber Resilience Act Checklist for Product Security and CE Marking](/artifacts/eu/cyber-resilience-act/checklist.md): A CRA checklist for products with digital elements: scope, Annex I security controls, vulnerability handling, Article 14 reporting, technical documentation, conformity assessment, CE marking, and support-period evidence. - [EU Cyber Resilience Act Core Functionality FAQ | CRA Product Classification](/artifacts/eu/cyber-resilience-act/faq/core-functionality.md): CRA FAQ on core functionality, product boundaries, remote data processing, integrated components, ancillary functions, and software changes that affect product classification. - [EU Cyber Resilience Act FAQ](/artifacts/eu/cyber-resilience-act/faq.md): Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance. - [EU Cyber Resilience Act Repairs and Spare Parts FAQ](/artifacts/eu/cyber-resilience-act/faq/repairs-and-spare-parts.md): CRA FAQ for repairs, spare parts, legacy products, security updates, substantial modification, and responsibility after product changes. - [EU Cyber Resilience Act Technical Documentation and Audit File](/artifacts/eu/cyber-resilience-act/technical-documentation-and-audit-file.md): Build an audit-ready CRA technical file around Article 31 and Annex VII: product scope, risk assessment, vulnerability handling, conformity evidence, testing, and retention. *Recommended next step* *Placement: after key answers* ## Map CRA standards evidence to actual requirements Research Copilot helps teams turn CRA standards, common specifications, and certification evidence into cited requirement coverage, gap records, and technical documentation inputs. - [Open Research Copilot](/solutions/research-copilot.md): Map each CRA Annex I requirement to harmonised standards, common specifications, certificates, tests, and uncovered gaps. - [Talk through implementation](/contact.md): Review route selection, standards coverage, documentation gaps, and evidence limits before conformity assessment. --- [Privacy Policy](https://www.sorena.io/privacy) | [Terms of Use](https://www.sorena.io/terms-of-use) | [DMCA](https://www.sorena.io/dmca) | [About Us](https://www.sorena.io/about-us) (c) 2026 Sorena AB (559573-7338). All rights reserved. Source: https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/harmonised-standards-and-common-specifications