Secure CE Marking under the Cyber Resilience Act
CE marking under the Cyber Resilience Act (CRA) is essential for market access of digital products in the EU.
From December 2027, digital products without CE marking can no longer be sold in the EU. The Cyber Resilience Act (CRA) makes CE marking mandatory for software, IoT devices and connected products. We guide you through conformity assessment, technical documentation and EU declaration of conformity to achieve compliant CE marking.
We offer you comprehensive support for CE marking under the Cyber Resilience Act, from the initial assessment through conformity evaluation to successful market launch.
2 service modules
Comprehensive assessment of CRA applicability to your products and their classification.
Execution of the complete conformity assessment and preparation of all required documentation.
5 phases
We guide you through all phases of CE marking under the Cyber Resilience Act in a structured manner.
Your contact
Sarah Richter
Head of Information Security, Cyber Security
10+ years of experience, CISA, CISM, Lead Auditor, DORA, NIS2, BCM, Cyber and Information Security
CE marking under the CRA will be mandatory from 2027 for digital products with cybersecurity relevance. Early preparation is essential for timely market readiness.
7 QUESTIONS, BRIEFLY ANSWERED
CE marking under the CRA certifies that a digital product meets the EU essential cybersecurity requirements. From December 2027, it will be mandatory for all products with digital elements, software, IoT devices and connected hardware, sold on the EU market. Without CE marking, market access will no longer be permitted.
The CRA applies to all products with digital elements that can be directly or indirectly connected to a network. This includes standalone software, operating systems, IoT devices, smart home products, industrial control systems, apps and embedded software. Only products already covered by specific EU regulations (e.g. medical devices, aviation) are exempt.
The path to CE marking involves five steps: 1) Product classification (Default, Class I, Class II or Critical), 2) Meeting the cybersecurity requirements from Annex I, 3) Performing the appropriate conformity assessment (self-assessment or third-party audit), 4) Preparing technical documentation and EU declaration of conformity, 5) Affixing the CE marking.
Default category products can perform an internal conformity assessment (self-assessment). Class I, Class II and critical products require assessment by an independent Conformity Assessment Body (Notified Body). The first CABs will begin operations from June 2026.
Key deadlines: From September 2026, manufacturers must report actively exploited vulnerabilities and serious security incidents. From June 2026, Conformity Assessment Bodies begin operations. From December 2027, all CRA requirements apply in full, no EU market access without CE marking.
Non-compliance with the essential cybersecurity requirements can result in fines of up to EUR 15 million or 2.5% of global annual turnover, whichever is higher. Additionally, national market surveillance authorities can order product recalls or market bans.
Technical documentation must include a risk analysis, description of cybersecurity measures, Software Bill of Materials (SBOM), test results, vulnerability management concept and evidence of compliance with Annex I requirements. This documentation must be retained for 10 years.
Our clients trust our expertise in digital transformation, compliance, and risk management
Schedule a strategic consultation with our experts now
Book Strategy Session30 Minutes • Non-binding • Immediately available
Direct hotline for decision-makers
Strategic inquiries via email
For complex inquiries or if you want to provide specific information in advance