The EU CRA Standardization Process Accelerates: General and Sector-Specific Standards Advance in Parallel, Draft General Standard Open for Public Consultation

The standardization work related to the EU Cyber Resilience Act (CRA) is accelerating comprehensively. According to the latest developments, both the horizontal and vertical CRA standards now have clear timelines, ensuring that full implementation conditions will be in place by the end of 2027.

According to the plan, the CRA horizontal standard (general requirements) is expected to be completed in August 2026. This standard will provide a unified foundational security framework for all applicable digital products. Meanwhile, the CRA vertical standards (sector-specific requirements) are expected to be finalized in October 2027. Together, these standards will ensure that the EU has the technical and normative basis required for mandatory CRA enforcement by December 2027.

During this process, the core general standard draft EN 40000-1-2 has been officially released and entered the public consultation stage. The draft, led by the British Standards Institution (BSI), is currently soliciting feedback from industries, enterprises, and professional organizations.

The public consultation period for the EN 40000-1-2 draft is October 13, 2025 to December 2, 2025.

Website: https://standardsdevelopment.bsigroup.com/Projects/2025-01809

As CRA standardization enters a critical stage, digital product manufacturers, supply-chain enterprises, and relevant technology providers need to prepare in advance and actively participate in the standard-setting process, jointly promoting the improvement and enhancement of the EU cybersecurity ecosystem.