CRA Cyber Resilience Act CE-Marking

CE marking under the CRA certifies that a digital product meets the EU essential cybersecurity requirements. From December 2027, it will be mandatory for all products with digital elements, software, IoT devices and connected hardware, sold on the EU market. Without CE marking, market access will no longer be permitted.

The CRA applies to all products with digital elements that can be directly or indirectly connected to a network. This includes standalone software, operating systems, IoT devices, smart home products, industrial control systems, apps and embedded software. Only products already covered by specific EU regulations (e.g. medical devices, aviation) are exempt.

The path to CE marking involves five steps: 1) Product classification (Default, Class I, Class II or Critical), 2) Meeting the cybersecurity requirements from Annex I, 3) Performing the appropriate conformity assessment (self-assessment or third-party audit), 4) Preparing technical documentation and EU declaration of conformity, 5) Affixing the CE marking.

Default category products can perform an internal conformity assessment (self-assessment). Class I, Class II and critical products require assessment by an independent Conformity Assessment Body (Notified Body). The first CABs will begin operations from June 2026.

Key deadlines: From September 2026, manufacturers must report actively exploited vulnerabilities and serious security incidents. From June 2026, Conformity Assessment Bodies begin operations. From December 2027, all CRA requirements apply in full, no EU market access without CE marking.

Non-compliance with the essential cybersecurity requirements can result in fines of up to EUR 15 million or 2.5% of global annual turnover, whichever is higher. Additionally, national market surveillance authorities can order product recalls or market bans.

Technical documentation must include a risk analysis, description of cybersecurity measures, Software Bill of Materials (SBOM), test results, vulnerability management concept and evidence of compliance with Annex I requirements. This documentation must be retained for 10 years.