EN 40000-1-1 and -1-2: the first CRA standards are approved, but none is cited yet
· 5 min read · CRA news
In short: according to several trackers, the first two horizontal CRA standards, EN 40000-1-1 (vocabulary) and EN 40000-1-2 (principles, risk management and lifecycle), cleared their final CEN-CENELEC vote and are due to be published in the second half of November 2026. Neither is expected to be cited in the Official Journal, so no presumption of conformity exists yet.
- The vulnerability handling part, EN 40000-1-3, is the one expected to be cited, and it is still in approval.
- Publication dates differ between sources (17, 18 and 25 November), so treat them as planned, not fixed.
- For an app team the practical value is a recognised structure for your technical file, not a legal shortcut.
What happened
The Cyber Resilience Act needs technical standards that spell out how a manufacturer can show it meets the essential requirements. The European Commission asked the standards bodies for them in 2025. This autumn, the first two of the horizontal EN 40000 series reached the end of the approval process.
We could not read the CEN-CENELEC record itself in this run, so what follows rests on four independent trackers, and they do not agree on every detail. The independent guide cyberresilienceact.eu says the two standards cleared the CEN-CENELEC formal vote on 1 October 2026 and that publication is scheduled for 17 November. The CVD Portal, in a status table dated 27 October, also gives 1 October for the close of the formal vote and plans publication on 18 November. CRA Evidence, updated on 6 November, says the standards were ratified on 2 November and will be available on 18 November. GlobalNorm, writing on 7 October, reported approval by CENELEC members "one month ahead of schedule" and a scheduled CENELEC publication on 25 November, possibly sooner.
We read these differences as vote counting and ratification steps being described differently, but that is our interpretation. What all four agree on: the vote went through in autumn 2026, publication is expected in the second half of November, and nothing in the series has been cited in the Official Journal.
What the standards cover
| Standard | What it is | Status reported |
|---|---|---|
| EN 40000-1-1 | Vocabulary used across the series. | Approved; publication planned for November 2026; no citation expected. |
| EN 40000-1-2 | Principles, risk management methodology and lifecycle activities behind the Annex I, Part I product requirements. | Approved; publication planned for November 2026; no citation expected. |
| EN 40000-1-3 | Vulnerability handling, from intake to coordinated disclosure and post-release monitoring. | Draft in approval; citation expected. |
These are horizontal standards: they apply across all products with digital elements, which includes software and mobile apps in scope. Product-specific requirements sit in vertical standards. ETSI has opened approval for 17 drafts of its EN 304 6xx series, covering categories such as browsers, password managers, operating systems and VPNs, according to CRA Evidence. The work is done in the joint CEN-CENELEC committee JTC 13.
Why "no citation" matters
Under Article 27 of the CRA, a product that conforms to a harmonised standard whose reference has been published in the Official Journal is presumed to meet the essential requirements that the standard covers. Until that happens, the presumption does not exist. CyberCert Labs adds the consequence for Important Class I products: without a cited standard, the self-assessment route through internal control is not available, so a notified body may be needed. Essential requirements apply either way; standards only give a method to demonstrate them.
The CVD Portal states that no citation is expected for EN 40000-1-1 and -1-2 and that citation is expected for -1-3. So for general-purpose apps, which mostly follow the default conformity route, the standards help as a recognised way to organise your evidence, while the legal effect will come later with the vulnerability handling part and the vertical standards.
Timing is also tight. CRA Evidence notes that the original delivery deadlines for the standards (30 August and 30 October 2026) have passed and that a July draft amendment moving some of them to 31 December 2026 had not been adopted as of 6 November. The main CRA requirements apply from 11 December 2027.
Industry is pushing on citation
On 6 November 2026, DIGITALEUROPE and 22 other organisations published a statement asking the Commission to cite the upcoming EN IEC 62443 standards quickly once CENELEC submits them. That statement is about industrial and operational technology rather than apps, but it shows the same pressure: companies want to know which standards will carry a presumption of conformity, and soon.
What we would do
- Do not wait for citation to start. The essential requirements apply regardless, and the structure in EN 40000-1-2 (risk assessment, secure implementation, verification, product monitoring, third-party component management) is a sensible outline for a technical file. Buy or read the text when it is published before you align to it.
- Write your app's risk assessment now. Our guide on the CRA cybersecurity risk assessment shows what to include.
- Treat vulnerability handling as the near-term priority, because that is the part expected to be cited. A disclosure policy and a working intake process are needed anyway.
- Keep an SBOM per release, since third-party component management is part of the lifecycle activities.
- Check the CEN-CENELEC and Official Journal records yourself before relying on any date in this article, including ours.
Third-party component management starts with knowing what is in each build. Create an SBOM and check it against known vulnerabilities in seconds.
Open the free scannerSources
- cyberresilienceact.eu: Cyber Resilience Act state of play and timeline (formal vote 1 October, publication 17 November).
- CVD Portal: EN 40000 CRA harmonised standards guide (status as of 27 October 2026).
- CRA Evidence: harmonised standards status and tracker (updated 6 November 2026).
- GlobalNorm: CRA standards, EN 40000-1-x series (7 October 2026).
- CyberCert Labs: CRA harmonised standards landscape (presumption of conformity).
- DIGITALEUROPE: timely citation of harmonised standards (6 November 2026).
This article summarises secondary reports on standards that are still moving. Dates may change. It is not legal advice. Related: Does the CRA apply to mobile apps? · CRA vulnerability reporting for app teams