Seventeen draft standards intended to support the European Union's Cyber Resilience Act (CRA) are currently open for public comment. These drafts aim to provide the technical specifics necessary for manufacturers to demonstrate compliance with the CRA, which mandates cybersecurity requirements for products with digital elements sold within the European Economic Area.
The CRA, which becomes fully effective by the end of 2027, outlines the cybersecurity outcomes manufacturers must achieve but does not detail the technical methods. The draft standards are designed to fill this gap, offering a clear path for compliance. Manufacturers who adhere to these Harmonised Standards, once finalized, will benefit from a "presumption of conformity," meaning their products will be considered compliant with the law unless proven otherwise.
The current drafts are candidates for this harmonized status and cover products categorized as higher-risk, including password managers, antivirus software, smart home assistants, connected toys, and wearables. The process of developing these standards is led by groups such as TC CYBER-EUSR, which focuses on translating the CRA's legislative requirements into actionable technical specifications.
The drafts were distributed to 41 member organizations, including national standardization bodies across the European Economic Area, for an initial phase of feedback. Additionally, four societal partner organizations—ANEC (consumer interests), ECOS (environmental), ETUC (labor), and SBS (small businesses)—are invited to provide input, ensuring a broad range of perspectives are considered before the standards are finalized.
The comment period for these drafts is staggered, with closing dates varying by product vertical, generally falling between mid-September and mid-November 2026. This timeline emphasizes the importance for affected parties to engage now, as the final text will reflect the input received during this phase.
The CRA's scope extends beyond firmware developers to include importers, distributors, service providers, and developers of commercially available hardware and software, all of whom face the same compliance deadline of late 2027. For many small and medium-sized enterprises, navigating the compliance route, including identifying relevant standards, testing tools, and potential funding, remains an ongoing challenge.
