.png&w=3840&q=75&dpl=dpl_4WWtFHEr9P8wkcdWCGky2WYKjEiM)
Does the Cyber Resilience Act require CE marking?
Direct answer
Yes. From 11 December 2027, products with digital elements need CE marking under the Cyber Resilience Act, and CRA compliance becomes a precondition for that mark. This makes the CRA a hard prerequisite for market access, so non-EU manufacturers relying on the CE mark for distribution are in scope even if they never sell directly into the EU.
Key takeaways
- CE marking is required and signifies CRA conformity (Art. 28, 30).
- Conformity assessment procedures are governed by Article 32; the route depends on the product class.
- Steps: technical documentation (Annex VII) · conformity assessment (Art. 32) · EU declaration of conformity (Art. 28, Annex V) · affix CE mark (Art. 30).
- Applies from 11 December 2027.
- CRA compliance is a prerequisite for CE marking, so it gates EU market access for non-EU makers too.
The full answer
Yes. Products with digital elements must carry the CE marking, and under the CRA that mark now signifies conformity with the regulation's cybersecurity requirements (Art. 28, 30).
The sequence is fixed: compile the technical documentation (Annex VII) and keep it for ten years; carry out the conformity assessment appropriate to the product class under Article 32 (default products may self-assess under Module A, important class I and II products require third-party involvement, critical products require mandatory certification); draw up the EU declaration of conformity (Art. 28, Annex V); and affix the CE marking (Art. 30).
Because the CE mark is a precondition for placing most products on the EU market, the CRA becomes a hard prerequisite for market access. A manufacturer established outside the EU that relies on the CE mark for international distribution is therefore in scope, even if it does not sell directly into the Union. The obligation applies from 11 December 2027.
How Acuna GRC handles it
- Solution
CRA
Track every vulnerability to a verified fix, keep CRA technical documentation, record exploited vulnerabilities, check component suppliers and reuse NIS2.
- Core workspace
Comply
The frameworks you select, the scopes and tags that segment your organization, the common measures library and the mapping of measures across frameworks.
- Core workspace
Assure
KPIs and measurements, reports, records, audits, issues and corrective actions.
Sources
- CRA Article 28 (EU declaration of conformity)
- CRA Article 30 (CE marking rules)
- CRA Article 32 (conformity assessment procedures)
- CRA Annex V (EU declaration of conformity)
- CRA Annex VII (technical documentation)
This page explains the rules in general terms and is not legal advice.
See how Acuna GRC runs this.
Tell us your frameworks and your team. We show you how Acuna GRC runs the program.
Hosted in Switzerland, the EU or the US