eu.bac co-signs joint statement on the timely citation of upcoming cybersecurity standards

On 4 November 2026, eu.bac joined 22 other European associations in a joint statement on the Cyber Resilience Act (CRA). The industry calls on the European Commission to cite the upcoming EN IEC 62443 harmonised standards in the Official Journal of the EU as soon as CENELEC submits them.

Why it matters

At the launch event of the joint industry guidance on the CRA, in September, standards stood out as a key missing piece. Citation in the Official Journal gives manufacturers a presumption of conformity, meaning a clear and recognised route to show that they meet the CRA’s essential requirements. With full application in December 2027, manufacturers and conformity assessment bodies need time to prepare.

For over 15 years, European manufacturers, system integrators, and operators have built secure development processes and product security requirements on IEC 62443-4-1 and -4-2 and its European equivalents. It is embedded in certification schemes, procurement and supply chain contracts, and regulatory regimes worldwide, supported by a large community of trained and certified professionals. Manufacturers, authorities and conformity assessment bodies rely on it today, and will continue to do so in the future.

These standards are now being adapted in Europe in order to also address the requirements of the CRA. This directly responds to the CRA Standardisation Request (M/606) to leverage existing international work by aligning with CRA essential requirements and preserving the link to the IEC international series.

To read the joint statement in full, please download the document below.