Articles 28 to 30 ยท Regulation (EU) 2024/2847

How does CE marking work under the CRA?

Verified against the Official Journal text on

Once a product passes its conformity assessment, the manufacturer draws up an EU declaration of conformity (its model content is in Annex V) and affixes the CE marking. The CE marking is your statement that the product meets the CRA essential requirements. For software you can place the marking on the EU declaration of conformity or on the website accompanying the product, rather than on a physical item; for hardware it goes on the product, or failing that on the packaging and the declaration. It must be affixed before you place the product on the market.

Basis: Art. 28, Art. 30(1), Art. 30(3), Annex V

Judgment call: For software the CRA gives an explicit alternative placement (declaration or accompanying website); for hardware the fallback to packaging and declaration applies where marking the product itself is not possible or warranted.

The declaration of conformity comes first Art. 28, Annex V, Art. 13(12), Art. 13(20), Annex VI

The CE marking is the visible endpoint of a paperwork chain. Before it, the manufacturer draws up an EU declaration of conformity stating that the applicable essential cybersecurity requirements in Annex I have been demonstrated. The declaration follows the model structure in Annex V and contains the elements from the conformity assessment procedure used. By drawing it up, the manufacturer assumes responsibility for the compliance of the product.

A simplified EU declaration of conformity (Annex VI) can accompany the product instead, provided it gives the exact internet address where the full declaration can be accessed. The declaration must be available in the languages required by the Member States where the product is made available.

What the CE marking means and its general principles Art. 29, Art. 30(5)

The CE marking on a product with digital elements signals that the product meets the applicable requirements of the CRA, and, where the product is also covered by other Union harmonisation legislation providing for CE marking, that it meets those requirements too. The general principles of the CE marking are not reinvented by the CRA: Article 29 applies the general principles set out in Article 30 of Regulation (EC) No 765/2008, the horizontal rules for the marking.

Where the marking goes, especially for software Art. 30(1), Art. 30(2), Art. 30(3)

For a physical product, the CE marking is affixed visibly, legibly, and indelibly to the product. Where that is not possible or not warranted by the nature of the product, it goes on the packaging and on the EU declaration of conformity accompanying the product. For products in the form of software, the CRA gives a direct alternative: the CE marking is affixed either to the EU declaration of conformity or on the website accompanying the software product, in which case that section of the website must be easily and directly accessible.

Timing is fixed: the CE marking must be affixed before the product is placed on the market. On account of the nature of the product, the marking may be lower than 5 mm high, provided it stays visible and legible.

When a notified body number appears Art. 30(4), Art. 32

Most manufacturers who self-assess will never add a number to the CE marking. The identification number of a notified body follows the CE marking only where that body is involved in the conformity assessment procedure based on full quality assurance (module H). So if your route is plain internal control, the CE marking stands alone; if a notified body is in the loop under module H, its number accompanies the mark.

What you must do

  • Draw up the EU declaration of conformity (model content in Annex V) stating that the essential requirements have been demonstrated, and assume responsibility for the product. (Art. 28, Annex V)
  • Affix the CE marking before placing the product on the market: for software, on the declaration or the accompanying website; for hardware, on the product, or its packaging and declaration. (Art. 30(1), Art. 30(3))
  • Add the notified body identification number only where a module H (full quality assurance) route is used. (Art. 30(4))

The dates that decide your planning

11 December 2027
The full obligations apply: essential cybersecurity requirements, technical documentation, conformity assessment, and CE marking. (Art. 71(2))

Frequently asked

Where do I put the CE marking on software?

On the EU declaration of conformity, or on the website accompanying the software product. If you use the website, the relevant section must be easily and directly accessible. Software does not need a physical mark on an object. (Art. 30(1))

Do I need a notified body number next to the CE mark?

Only where a notified body is involved in a full quality assurance (module H) conformity assessment. If you self-assess under internal control, no notified body number accompanies the CE marking. (Art. 30(4))

What is the difference between the CE mark and the declaration of conformity?

The EU declaration of conformity is the document in which you state and take responsibility that the product meets the essential requirements. The CE marking is the visible sign of that conformity affixed to the product, packaging, declaration, or website. (Art. 28, Art. 30)

When must the CE marking be affixed?

Before the product with digital elements is placed on the market. The marking must be visible and legible, and for a physical product affixed indelibly to the product where that is possible. (Art. 30(1), Art. 30(3))

CE marking only applies if you are in scope

The free Vexwatch Scope Checker tells you whether your product is in scope and whether you carry the manufacturer duties that lead to a declaration of conformity and the CE marking.

Check your scope, free See the Blueprint

This page is general information about Regulation (EU) 2024/2847, the EU Cyber Resilience Act. It is compliance tooling, not legal advice, and creates no client relationship. It may not reflect your specific circumstances or the most recent regulatory guidance. Verify conclusions against the regulation or qualified counsel before relying on them.