CE marking is the conformity marking a manufacturer affixes to a product to declare that it meets all applicable EU harmonization legislation and may circulate freely in the European Economic Area. In cybersecurity law, CE marking has gained a new dimension: under the Cyber Resilience Act and the cybersecurity rules for radio equipment, the mark now also signals that a connected device or software product meets mandatory cybersecurity requirements.
CE marking is not a quality label or a certificate issued by an authority. It is a legal declaration by the manufacturer, backed by technical documentation and, for higher-risk products, by an independent assessment. Placing it on a non-compliant product exposes the manufacturer to withdrawal orders and fines.
How CE marking works
Before affixing the mark, a manufacturer must identify every EU law that applies to the product, meet their essential requirements, complete the prescribed conformity assessment procedure, compile technical documentation and sign an EU declaration of conformity. Only then may the CE mark be placed on the product, its packaging or, for software, in the accompanying documentation or website.
Essential requirements are written as outcomes, not as technical recipes. Manufacturers usually demonstrate compliance by applying a harmonised standard published in the Official Journal, which grants a presumption of conformity. They may use other methods, but then they must justify in detail why their solution is equivalent.
| Step | Content | Key output |
|---|---|---|
| Identify applicable laws | Product safety, radio, cybersecurity, EMC and others | List of legal acts and requirements |
| Risk assessment | Analysis of hazards and cybersecurity threats | Documented risk analysis |
| Apply standards | Harmonised standards or equivalent solutions | Test reports and design evidence |
| Conformity assessment | Self-assessment or notified body involvement | Assessment records or certificate |
| Declaration of conformity | Signed statement of compliance | EU declaration of conformity |
| Affix the mark | Visible, legible, indelible CE mark | Product ready for the EU market |
CE marking under the Cyber Resilience Act
The Cyber Resilience Act (CRA) extends CE marking to almost all products with digital elements, meaning hardware and software that connect to a device or network. Its essential requirements cover secure-by-design development, no known exploitable vulnerabilities at release, secure default configurations, protection of data, and vulnerability handling throughout a defined support period, which is generally expected to be at least five years.
The CRA applies in stages. Reporting duties for actively exploited vulnerabilities and severe incidents start in September 2026, and the full product requirements, including CE marking for cybersecurity, apply from December 2027. Products placed on the market after that date without conformity can be withdrawn or recalled.
| Category | Examples | Conformity assessment |
|---|---|---|
| Default products | Most apps, smart toys, consumer devices | Self-assessment by the manufacturer |
| Important, class I | Password managers, VPNs, routers, smart home assistants | Self-assessment only with full harmonised standards |
| Important, class II | Firewalls, hypervisors, tamper-resistant microprocessors | Third-party assessment by a notified body |
| Critical products | Smartcards, hardware security modules, smart meter gateways | Possible mandatory EU cybersecurity certification |
Radio equipment and other overlapping rules
Before the CRA applies, the main cybersecurity route to CE marking is the Radio Equipment Directive. A delegated act activated cybersecurity requirements for internet-connected radio equipment, such as smartphones, wearables and wireless toys, from 1 August 2025. These cover network protection, personal data and privacy, and fraud prevention, supported by a dedicated series of harmonised standards.
Once the CRA applies, it becomes the main cybersecurity framework for most connected products, and overlapping requirements are coordinated to avoid double assessment. Products in sectors with their own rules, such as medical devices, vehicles and aviation, are generally excluded from the CRA and follow their sector-specific regimes.
CE marking compared with related instruments
CE marking is often confused with certificates and labels that address different questions. The key distinction is who vouches for what.
| Instrument | Who issues or affixes it | What it shows |
|---|---|---|
| CE marking | Manufacturer | Compliance with all applicable EU product laws |
| Notified body certificate | Accredited third party | Successful assessment of a specific product type |
| EU cybersecurity certificate | Certification body under a scheme such as EUCC | Assurance level against a certification scheme |
| Voluntary security label | National or private scheme | Meets the label’s own criteria |
| Declaration of conformity | Manufacturer | Formal written statement behind the CE mark |
Obligations after the mark and common mistakes
Under cybersecurity law, CE marking is not a one-time event. The manufacturer must keep handling vulnerabilities, provide security updates during the support period, keep technical documentation for at least ten years and report actively exploited vulnerabilities to authorities. Penalties under the CRA for breaching essential requirements can reach 15 million euros or 2.5 percent of worldwide annual turnover, whichever is higher.
- Treating the mark as a sticker: affixing CE without documentation or assessment is a serious breach.
- Forgetting software updates: a product that loses security support may fall out of compliance.
- Wrong category: misclassifying an important product as default skips required third-party review.
- Ignoring components: open-source and third-party components still need due diligence.
- Importers and distributors assuming the manufacturer alone is responsible, although they must verify the mark and documentation.
The idea in brief
The CE mark is a manufacturer’s promise that a product follows European rules. For a toaster, that means it will not catch fire. For a smart camera or an app, it now also means basic digital security.
Think of it as a passport for products. Without it, a product cannot enter the European market. With it, the maker must keep the promise for as long as the product is supported.
A practical scenario
A small company makes a Wi-Fi baby monitor with a companion app. To sell it in the EU after August 2025, the team checks the radio equipment cybersecurity requirements and later the CRA. The risk assessment shows that the camera stream and parent accounts are the most sensitive assets.
Engineers remove the default shared password, enforce encrypted connections, add signed firmware updates and set up a public channel for vulnerability reports. Because the product falls into the default category, the company performs a self-assessment against the relevant harmonised standards, compiles the technical file and signs the declaration of conformity.
The outcome is a monitor that carries the CE mark with a documented security basis. When a researcher reports a flaw a year later, the company already has a tested update process and patches all devices within weeks, keeping the product compliant.