Harmonised standards are late: what to do until they are in the Official Journal

There's confusion around the CRA's harmonised standards — and it helps to know why. In short: the standards meant to make your life easier aren't out yet. Let's explain what that means for a small company and how to work with it until the situation is resolved.

What harmonised standards are for

A harmonised standard is a technical document that "translates" a regulation's general requirements into concrete, verifiable steps. Its main benefit is a presumption of conformity: apply the standard in full and you are presumed to meet the relevant CRA requirements. For important class I it's even a condition of being able to self-assess (rather than use a notified body) — more in the classes article.

Status as of this article's date

The catch is that these standards are still being written. As of this article's date, no CRA harmonised standard is published in the EU Official Journal. According to interim information, the horizontal standards (secure development and vulnerability handling) were expected around late October 2026, with others — vertical and product-specific — later, some into 2027. The exact dates are a moving target and have shifted; treat them as indicative and check the current status at the time of reading.

Without a standard in the Official Journal, there simply is no presumption of conformity — you have no "ready-made recipe" to lean on.

What to do in the meantime

The good news: you don't have to wait. Conformity can — and must — be assessed directly against the essential requirements of Annex I (Part I secure-by-design properties, Part II vulnerability handling). A standard is an aid, not the only route. A practical approach:

1. Work from Annex I. Tie your risk assessment and measures directly to Annex I requirements — that's what the CRA wants from you anyway.
2. Document against articles and annexes, not standard numbers. When your technical documentation cites "Art. 13" or "Annex I Part II point 1", it stays valid even after standards appear. A reference to a standard number that doesn't exist yet would have to be rewritten.
3. Plan for a remap. When standards arrive, you map your existing measures to their points. If you documented honestly against Annex I, it's a mapping, not a rewrite.

What "presumption of conformity" means in practice

Think of it as two routes to the same goal. With a standard: you apply a harmonised standard in full and are presumed to meet the relevant requirement — an authority needn't dig further. Without a standard: you reach the same goal by demonstrating conformity directly against Annex I, just without that "shortcut of trust". Both are legal; a standard is a convenience, not a condition of existence (except for important class I, where full application of standards decides whether you may self-assess).

Concretely: when today you document "secure distribution of updates" against Annex I Part II, you describe your actual solution (signed packages, a verified channel). When a standard later refines this, you map your description to its points. If you wrote against the annex, it's a mapping; had you written against a standard number that didn't exist, you'd be rewriting.

Why this is no reason to delay

Late standards are sometimes an excuse to "wait and see". That's a mistake for two reasons. First, reporting under Article 14 applies from 11 September 2026 regardless of standards — and it won't wait. Second, things like an SBOM, a reporting channel and vulnerability monitoring don't depend on any standard; they're processes you'll need either way. A standard changes at most the form of evidence, not the substance of what you must do.

What it means for each class

The impact of the delay isn't the same for everyone:

1. Default class: standards don't change the fact that you self-assess (Module A) against Annex I. You do it either way.
2. Important class I: here it's noticeable — self-assessment is possible only with full application of harmonised standards. Until they exist, a notified body is expected. So watch closely for when they appear.
3. Important class II and critical: a third party is required either way, so the delay in horizontal standards changes less here.

FAQ

1. Can conformity be demonstrated without standards? Yes — conformity can be demonstrated even without harmonised standards, directly against the essential requirements of Annex I. A standard only gives a presumption of conformity; it isn't the only route.
2. Where do I find the current status? Watch publications in the EU Official Journal and interim standardisation-status overviews; the dates change.
3. Should we wait on the documentation? No — write it against the articles and annexes; once standards appear you just remap.

Bottom line

Harmonised standards are meant to give manufacturers a "presumption of conformity" — a convenient shortcut of trust. But until they're in the EU Official Journal, that shortcut doesn't exist, which is the state as of this article's date. It changes nothing about the fact that you can and must assess conformity directly against Annex I. A standard is an aid, not the only route (the exception is important class I, where full application of standards decides whether you may self-assess). Three practical rules: work from Annex I, document against articles and annexes (not non-existent standard numbers), and plan for a later remap. Above all — late standards are no reason to delay. Article 14 reporting applies from 11 September 2026 regardless, and processes like an SBOM, a channel and monitoring don't depend on standards. Document honestly against the annex and, once standards appear, you just map, not rewrite.

Key point

Harmonised standards are meant to give manufacturers a "presumption of conformity" — a convenient shortcut of trust. But until they're in the Official Journal of the EU, that shortcut doesn't exist, and that's the situation as of this article's date. It changes nothing about the fact that you can and must assess conformity directly against Annex I. A standard is an aid, not the only route (the exception is important class I, where full application of standards decides whether self-assessment is possible). Three practical principles: work from Annex I, document against articles and annexes (not against non-existent standard numbers), and expect a later remapping. And above all — late standards are no reason to delay. Article 14 reporting applies from 11 September 2026 regardless of standards, and processes like an SBOM, channel or monitoring don't depend on them. Whoever documents honestly against the annex will, once standards are out, only map — not rewrite.

How CRAguard helps

CRAguard documents and versions the inputs with references to the regulation's articles and annexes, not to non-existent standard numbers — so when standards arrive, remapping is a matter of assignment, not rewriting. Vulnerability monitoring and the reporting channel run independently of the standards' status. Find out whether the CRA applies to you, or join the waitlist.

This article is informational and not legal advice. It is based on Regulation (EU) 2024/2847 (Annex I; presumption of conformity from harmonised standards) and the interim standardisation status (no harmonised standard has yet been published in the EU Official Journal; dates are a moving target). Verify the current standards status before relying on it.