Technology standards across Europe are evolving to prepare manufacturers for the EU Cyber Resilience Act (CRA) that takes full effect in December 2027.
The European Telecommunications Standards Institute (ETSI), one of the three official standards organizations recognized by the EU, launched an approval process for 17 key cybersecurity standards European vendors will have to meet under the CRA.
The final draft standards, made available on August 13, cover 17 major product categories spanning network and edge devices, security solutions and internet-of-things (IoT) appliances:
The proposed standards set out a list of minimum-security features manufacturers must implement to be CRA-compliant, allowing for the sale of their products in the EU from December 2027.
Several of these proposed standards mandate modern cryptography, secure-by-default settings, a software bill of materials (SBOM) – a machine-readable inventory of software dependencies – and post-sale update capabilities.
The standards have been submitted to 41 member organizations across Europe, including the national standardization bodies of the European Economic Area and Europe-wide industry and standards organizations, and are currently under public enquiry as part of the first phase of the approval procedure.
Stakeholders are welcome to issue comments until mid-September to mid-November 2026, depending on the vertical.
The final versions of these 17 cybersecurity standards are expected to be available by December 2026.
They will apply to all manufacturers, importers, distributors, service providers and developers of commercially available hardware and software products sold in the EU from the end of 2027.
ETSI and the other two EU-approved standardization bodies, the European Committee for Standardization (CEN) and the European Committee for Electrotechnical Standardization (CENELEC), have organized a series of workshops across Europe to help European small and medium businesses to comply to the CRA when it’s enforced.
Read more about the CRA: Two-Thirds of Open Source Community Unaware of Cyber Resilience Act
