CE Marking and the CRA: What Changes for Software and Connected Products?
From December 2027, CE marking on connected products and software signals CRA compliance. Here is what manufacturers need to understand about affixing the mark correctly.
CE Marking Is Expanding to Cover Cybersecurity
CE marking has long been required on products covered by EU harmonisation legislation. The CRA extends CE marking requirements to products with digital elements, making cybersecurity conformity a condition of the CE mark from 11 December 2027.
Previously, a connected device could carry CE marking based on compliance with the Radio Equipment Directive or the Machinery Directive without any formal cybersecurity assessment. From December 2027, the CRA adds mandatory cybersecurity requirements to the CE marking process for all in-scope products.
What CE Marking Signals Under the CRA
When a manufacturer affixes CE marking to a product under the CRA, they are declaring that the product meets all Annex I essential cybersecurity requirements, an appropriate conformity assessment has been completed, a technical file exists and is current, an EU DoC has been signed, vulnerability management and SBOM obligations are in place, and a CVD policy and reporting channel are operational.
The Conformity Assessment Prerequisite
CE marking cannot be lawfully affixed until the conformity assessment is complete. Default products: Module A internal self-assessment. Class I Important: Enhanced self-assessment or third-party assessment. Class II Important: Mandatory assessment by an accredited notified body.
Affixing CE marking before completing the required assessment constitutes a false declaration and exposes the manufacturer to enforcement action.
How to Affix CE Marking Correctly
CE marking must be visible and legible -- directly on the product, packaging, in documentation, or for software in the UI or installation screen. It must be indelible and sized correctly (minimum height 5mm unless the product size makes this impractical).
Notified Body Identification Numbers
When a notified body has conducted the conformity assessment (Class I enhanced or Class II mandatory), the notified body identification number must be affixed alongside the CE mark. This number appears in the NANDO database.
Common Mistakes to Avoid
Affixing CE marking before completing the conformity assessment. Not updating CE marking documentation when the product changes significantly. Forgetting to include the notified body identification number for Class II products. Treating CE marking as a one-time exercise rather than maintaining its validity throughout the product market life.
Ready to assess your CRA compliance obligations?
Try the Free Applicability Checker