CE marking

CE marking is affixed by the manufacturer, not awarded by an external authority, and it signals conformity across every applicable CE-marking directive or regulation that covers the product — not the CRA alone. For products with digital elements, the CRA adds cybersecurity essential requirements to whatever other CE-relevant obligations already apply, such as machinery, radio equipment or medical device rules.

What sits behind the mark

• A completed conformity assessment appropriate to the product's classification.
• An EU declaration of conformity listing the legislation applied.
• Technical documentation retained and available to market surveillance authorities.
• Correct classification of the product and, where relevant, involvement of a notified body.

Affixing CE marking without the underlying assessment is a compliance failure in itself, independent of whether the product actually meets the requirements. Market surveillance authorities can request the technical documentation at any point after placing on the market, which is why the file behind the mark needs to be current, not just complete at the point of the original assessment.

For manufacturers already CE-marking products under other regimes, the practical work is extending the existing conformity process to include the CRA's cybersecurity requirements rather than running a parallel scheme.