Euralarm joins European industry call for timely implementation of Cyber Resilience Act standards

In a joint industry statement published on 4 November 2026, the organisations underline that alignment with internationally established cybersecurity standards is essential to strengthen both Europe's digital security and industrial competitiveness.

The Cyber Resilience Act represents an important step towards improving the cybersecurity of products with digital elements across Europe. However, its successful implementation depends on manufacturers having access to clear, practical and internationally aligned standards that enable them to demonstrate compliance with the new requirements.

In their joint statement, the 23 organisations urge the European Commission to swiftly cite the upcoming harmonised EN IEC 62443 standards in the Official Journal of the European Union (OJEU), once submitted by CENELEC. This would provide manufacturers with a presumption of conformity with the relevant requirements of the CRA and facilitate the conformity assessment process.

Building on established international standards

Operational Technology (OT) plays a fundamental role in Europe's manufacturing, energy, water, transport and process industries. For more than 15 years, manufacturers, system integrators and operators have relied on the IEC 62443 series to establish secure development processes and product security requirements. These internationally recognised standards are already embedded in certification schemes, procurement procedures and supply chain agreements. Their European equivalents are now being adapted to address the requirements of the CRA.

The joint statement emphasises that building on this established framework, rather than introducing divergent European requirements, will help manufacturers meet their regulatory obligations while remaining competitive in international markets.

Legal certainty and competitiveness

With the CRA becoming fully applicable in December 2027, timely citation of harmonised standards is particularly important. It will enable manufacturers to prepare their conformity assessments and support notified bodies in developing their assessment programmes. This is especially relevant for small and medium-sized enterprises, which often have more limited resources to address complex regulatory requirements. The organisations also warn that unnecessary divergence between European and international standards could create parallel compliance regimes, increase costs and divert valuable engineering resources away from innovation and cybersecurity improvements.

Maintaining alignment between EN and IEC standards would allow manufacturers to work with one development process, one set of requirements and one evidence package for both European regulatory compliance and access to international markets.

Future-proof cybersecurity requirements

Another important consideration is the need for technology-neutral, risk-based standards. Cybersecurity threats and technologies evolve rapidly, making overly prescriptive technical requirements vulnerable to becoming outdated.  The EN IEC 62443 series provides a performance-based framework that supports the CRA's risk-based approach while allowing manufacturers to adapt their solutions to emerging threats and technological developments. By preserving this approach, Europe can strengthen cybersecurity without unnecessarily restricting innovation.

A common European approach

Through its participation in the joint statement, Euralarm supports a European standardisation framework that combines robust cybersecurity requirements with legal certainty, practical implementation and international competitiveness. The signatories call for continued adaptation of the EN IEC 62443 series through CENELEC, with strong support from the European Commission and meaningful stakeholder participation.

A harmonised approach will not only facilitate implementation of the Cyber Resilience Act but also reinforce Europe's influence on international cybersecurity standards.