A company selling a connected toy in Europe must show by the end of 2027 that the product meets the Cyber Resilience Act. The law states what manufacturers have to achieve and stops there, which leaves the toymaker to work out the technical detail alone. Seventeen draft standards, now open for comment, supply that detail.
What following a standard buys you
Manufacturers who follow a Harmonised Standard get the presumption of conformity, meaning a regulator treats the product as meeting the law unless someone shows otherwise. The 17 drafts are candidates for that status, not holders of it. They cover the higher-risk tier of products with digital elements: password managers, anti-virus software, smart home assistants, connected toys, and wearables.
“The Cyber Resilience Act lays down what manufacturers, and the market need to achieve, but it does not tell you how. The role of the Standards Developing Organisations is to detail the technical aspects of how to achieve compliance with the legislation through standards,” says Sandra Feliciano, Chair of the group responsible for the CRA (TC CYBER-EUSR).
Who comments, and until when
The drafts went out this summer to 41 member organisations, including the national standardisation bodies of the European Economic Area, which can file comments in the first phase of approval. ANEC, ECOS, ETUC, and SBS, the four societal partners known collectively as the Annex III Organisations, can comment too. That puts consumer, environmental, labor, and small-business positions on the record while the wording is still movable. The procedure runs until somewhere between mid-September and mid-November 2026, with the closing date varying by vertical.
For many small and medium firms, the CRA is a known quantity and the compliance route is not. Which standard covers the product, which tools test against it, and which funding programs pay for it are all open questions, and the answers are scattered.
The obligation reaches further than the people writing firmware. Importers, distributors, service providers, and developers of commercially available hardware and software all fall under the CRA, and all face the same end-of-2027 date.
Seventeen documents are open for comment. A manufacturer who waits until the deadline to read them will be reading a text other people settled.
Read more:
- EU tightens cybersecurity rules for tech supply chains
- EU Cybersecurity Act 2.0: When good regulation goes bad
- EU organizations buckle under rising compliance pressure