Using EUCC certificates to demonstrate CRA conformity

07 Oct 2026 Using EUCC certificates to demonstrate CRA conformity

Recommendations for the Delegated Act under Article 27(9) of the Cyber Resilience Act

Core position

A valid EUCC certificate should provide a presumption of conformity only for the CRA requirements and product scope that it demonstrably covers. When additional evidence are required to comply with the CRA (e.g.: gap between the evaluated product and the product place on the market) relevant EUCC supporting evidence should be reusable within another applicable CRA conformity-assessment route. Bridging EUCC certification and CRA conformity should leverage existing Protection Profiles where they demonstrably cover the relevant requirements. Protection Profiles should update when feasible but not be expanded automatically or wholesale merely to reproduce the CRA, although proportionate updates should remain possible where technically justified. When required, reusing an EUCC certificate should remain the preferred route when it avoids duplicative evidence or a separate conformity assessment and does not create disproportionate burden for the industry. This approach shall also fit within the manufacturers’ overall conformity assessment strategy.

Where an essential requirement is not covered by the certified scope of a valid EUCC certificate or its supporting evidence, whether the certificate was issued before or after the date of application of the Delegated Act the CRA notified body responsible under the applicable procedure should assess only the uncovered elements, using the relevant harmonised standards and the procedures under Modules B+C or H. The Delegated Act should require that body to recognize relevant EUCC evidence. As a transitional measure, valid existing EUCC and SOG-IS certificates should provide a presumption of conformity within their certified scope and for their remaining validity period. Their supporting evidence should remain reusable subject to validation of its scope, a proportionate gap analysis and any necessary additional assessment or remediation; this is not an exemption from CRA conformity assessment.