On 30 October 2026 the second deadline in the Cyber Resilience Act's standardisation request fell due. It covers items 16 to 41 of the request, the 26 product-specific standards. This is what the official record showed that day.
The Commission issued standardisation request C(2025)618 on 3 February 2025. It asks the European Standardisation Organisations for 41 standards in support of Regulation (EU) 2024/2847, the Cyber Resilience Act. The annex to the request sets the deadlines for adoption by those organisations: 30 August 2026 for items 1 and 15, 30 October 2026 for items 16 to 41, and 30 October 2027 for items 2 to 14. The second date came 634 days after the request was issued and 689 days after the regulation entered into force.
Still no standard cited
No harmonised standard has been cited in the Official Journal for the Cyber Resilience Act. No implementing decision citing standards under Regulation (EU) 2024/2847 has been published, and the Commission's index of harmonised standards has no entry for it. The count was zero when the regulation entered into force on 10 December 2024, zero on the first deadline on 30 August, and still zero on 30 October.
Adoption and citation are two separate steps. The deadlines in the request are for adoption by the standards organisations. A standard gives a presumption of conformity only once the Commission has assessed it and published its reference in the Official Journal, and that second step is the one a manufacturer can rely on.
The amendment is still a draft
The Commission has prepared an amendment to the request. A revised draft, dated 23 September 2026, was put to the Member States' Committee on Standards in a written procedure (Comitology register, CMTD(2026)1607). It would move items 1 and 15 to 30 November 2026 and items 16 to 41 to 31 January 2027; items 2 to 14 would stay at 30 October 2027.
The committee delivered a positive opinion on 13 October 2026, with 26 Member States in favour and one abstention; the voting sheet appeared in the register on 28 October 2026. A positive opinion is not an adoption. On 30 October 2026 no adopted decision amending C(2025)618 had been found. Standardisation requests are not published in the Official Journal, so the register and the Commission's own pages are where an adoption would show. Until an amendment is adopted, the dates in C(2025)618 are the dates that stand, and the second of them has now passed.
Where the drafts stood
None of the 30 CRA drafts on our record had been published as a European Standard by 30 October. The stages below are the standards bodies' own, read from their public work programmes.
ETSI has 18 work items for the regulation, EN 304 617 to EN 304 642. Eleven had closed their public enquiry. For ten of them ETSI's own schedules set "Final deliverable endorsed for registration" between 23 November and 22 December 2026; the eleventh, EN 304 624, closed its enquiry on 29 October 2026. Six were still in public enquiry, with comment windows closing between 2 and 5 November 2026. EN 304 642 was still in drafting.
CEN and CENELEC have 12 projects on our record. prEN 40000-1-1 and prEN 40000-1-2 have been at the formal vote since 1 October 2026; the other ten were at the public enquiry stage.
A draft still taking comments in November was not adopted in October. That is arithmetic on published dates, not a forecast.
What it means
Without a cited standard, no product under the Cyber Resilience Act can rely on a harmonised standard for a presumption of conformity. The regulation applies regardless: the reporting obligations in Article 14 have applied since 11 September 2026, and the regulation applies in full from 11 December 2027, 407 days after the second deadline.
Every draft, its stage and its next milestone are on our CRA page, rebuilt from the record every day. If the Commission adopts the amendment, cites a standard, or a draft moves stage, it shows there the same day.
Sources: standardisation request C(2025)618 of 3 February 2025, annex, deadlines for adoption by the ESOs. Regulation (EU) 2024/2847, Official Journal, 20 November 2024. Commission harmonised standards index and the Official Journal, checked 30 October 2026. Comitology register, CMTD(2026)1607, draft 118113 and voting sheet V118783/01, checked 30 October 2026. ETSI Work Programme, the schedule of each work item EN 304 617 to EN 304 642, and the CEN and CENELEC project pages in the iTeh Standards catalogue, both captured daily.
We keep the dates. When they move, the old ones stay here.