ETSI opened the approval process for 17 draft European Standards supporting the EU Cyber Resilience Act (CRA) on 13 August 2026. The drafts, numbered EN 304 617 to EN 304 627 and EN 304 631 to EN 304 636, set product-specific security requirements for categories such as browsers, operating systems, password managers and firewalls. ETSI says the approval procedure runs from mid-September to mid-November 2026, depending on the standard, so most of the windows for national comments and votes are open now or closing soon.
What's affected
The 17 drafts published in ETSI's open consultation folder are:
- EN 304 617: Browsers
- EN 304 618: Password managers
- EN 304 619: Antivirus software
- EN 304 620: Virtual private networks
- EN 304 621: Network management systems
- EN 304 622: Security information and event management
- EN 304 623: Boot managers
- EN 304 624: PKI and digital certificate issuance software
- EN 304 625: Network interfaces
- EN 304 626: Operating systems
- EN 304 627: Routers, modems and switches
- EN 304 631: Smart home virtual assistants
- EN 304 632: Smart home security products
- EN 304 633: Internet-connected toys
- EN 304 634: Personal wearables
- EN 304 635: Virtualisation and container execution systems
- EN 304 636: Firewalls, intrusion detection and prevention systems
The operating systems draft explains the mechanics. It was prepared under the Commission's standardisation request C(2025) 618, and it is in the "combined Public Enquiry and Vote phase" of ETSI's approval procedure. Once a standard is cited in the Official Journal, complying with its normative clauses gives a presumption of conformity with the matching CRA requirements. The draft also states: "The use of harmonised standards is voluntary." None of these drafts is cited yet.
What do the requirements look like? The OS draft's first technical requirement, TR-NKEV, "No known exploitable vulnerabilities," is a good example. It says the product shall come with documentation showing that all known exploitable vulnerabilities have been identified and either fixed or documented with residual risk and compensating controls. Before release, the product shall be verified for known exploitable vulnerabilities by manual testing, automated scanning or both, and the manufacturer shall consider CVE, NVD and upstream advisories alongside its own research.
A note in the same clause matters for triage. Public severity ratings and reports of active exploitation are "an input to, not a substitute for" the manufacturer's own assessment, and where the product-specific assessment differs, "the manufacturer's assessment governs prioritisation, with the justification documented."
Does this apply to you?
- You make a product in one of the 17 categories and sell it in the EU. These drafts are likely to become the most direct route to showing CRA conformity for your product. Read yours now.
- You make a component used inside one of those products, such as a library embedded in a browser or a VPN client. Your customer will push the requirements down to you.
- You make other products with digital elements. These verticals do not cover you, but the horizontal standards will. The vertical drafts still show the level of evidence the market is converging on.
Remember the dates. The CRA's reporting obligations have applied since 11 September 2026. The standards support the product requirements, and the Commission says the Act's main obligations apply from 11 December 2027.
What to do now
- This week: download the draft for your category from ETSI's open consultation folder and read the technical requirements and the conformity annex.
- By 31 October 2026: find your national standards organisation and confirm its internal deadline. ETSI's STAN4CRA project pages say comments on the current drafts should go through national standards organisations, and comments sent straight to ETSI's issue tracker after 16 April 2026 may only be handled in a future revision. If you cannot find your national contact, ETSI points to cybersupport@etsi.org.
- Before your national deadline (mid-September to mid-November 2026, by standard): submit concrete comments. ETSI asks for the section, a proposal to delete, add or replace text, the exact proposed text and a short rationale. Comments without a concrete proposal will be noted but not acted on.
- By 31 December 2026: run a gap assessment of one release against your category's draft. For TR-NKEV style requirements, check whether you can produce, per release, a list of known vulnerabilities with a documented fix, residual risk or compensating control.
- Through 2027: track citation in the Official Journal. Until then, the drafts can change.
Why it matters
Sandra Feliciano, Chair of ETSI TC CYBER-EUSR, summed up the problem in ETSI's announcement: "The Cyber Resilience Act lays down what manufacturers, and the market need to achieve, but it does not tell you how." These drafts are the "how" for 17 product types.
The TR-NKEV wording is worth noticing. It does not demand zero CVEs in your dependency report. It asks you to know which vulnerabilities are exploitable in your product and to document why. That makes evidence about exploitability, such as whether your code actually calls the vulnerable function, part of the conformity file.
Try it yourself
Take the last release of one product and export its known vulnerabilities. For each, write one line: exploitable in this product or not, and why. Count how many you could justify with evidence. Safeguard's reachability analysis checks whether your code calls the vulnerable function, which is one way to support that line.
Click through it at your own pace, or open it full screen.
Quick check
Are the EN 304 drafts harmonised standards today?
No. They are drafts in public enquiry and vote. They give a presumption of conformity only after they are adopted and cited in the Official Journal of the EU.
Where should comments on the current drafts be sent?
Through your national standards organisation, which sets its own deadline. ETSI says comments sent directly to its issue tracker after 16 April 2026 may only be handled in a future revision.
Under TR-NKEV, whose assessment governs prioritisation of a vulnerability?
The manufacturer's own product-specific assessment, with the justification documented. Public severity ratings are an input, not a substitute.
Sources
- ETSI press release: ETSI launches approval process for 17 European Standards supporting the Cyber Resilience Act (13 August 2026)
- ETSI CYBER-EUSR open consultation drafts
- Draft ETSI EN 304 626 V1.0.1 (2026-08), Cybersecurity requirements for operating systems (PDF)
- ETSI STAN4CRA: EN 304 621 project page and commenting guidance
- European Commission: Cyber Resilience Act
- European Commission: CRA reporting obligations
