Harmonised standards and presumption of conformity

What presumption of conformity buys you

Article 31 gives products that conform to harmonised standards (or parts of them) published in the Official Journal a presumption of conformity with the essential requirements those standards cover. Two consequences:

• The burden shifts: a market surveillance authority must show you are non-conforming, rather than you proving conformity from first principles.
• For important Class I products, applying harmonised standards in full is what unlocks self-assessment instead of a notified body.

The same effect can come from common specifications adopted by the Commission where standards are missing, and from European cybersecurity certification schemes at assurance level substantial or higher.

The state of play

CEN/CENELEC JTC 13 holds the standardisation request. The work splits into:

• A horizontal set covering the Annex I Part I product requirements and Part II vulnerability handling — the principles-and-requirements standards that apply to all products.
• Vertical standards for the Annex III/IV categories.

Drafts have been circulating and citation in the Official Journal is expected in stages before December 2027. Until a standard is cited, applying its draft gives you no legal presumption — it is still good engineering, but it is not a shortcut.

What to do while you wait

1. Align with the recognised prior art now. ETSI EN 303 645 for consumer IoT, IEC 62443-4-1 for the development process, IEC 62443-4-2 for component requirements. The emerging harmonised standards draw heavily on these, so alignment today converts cheaply later.
2. Write your Annex I matrix against the requirement text, not against a standard. Then map standards clauses to matrix rows. When a standard is cited, you fill in references rather than rewriting the analysis.
3. Document your solutions where no standard applies. Annex VII explicitly allows this: describe the solutions adopted to meet the essential requirements. A well-argued design rationale is a valid route to conformity — it is just more work to defend than a citation.
4. Track the OJ citations. Assign someone to watch for publication and re-run the gap analysis when each lands. Build the gap analysis as a checklist so re-running it is a day, not a quarter.

A word of caution

Partial application of a harmonised standard gives presumption only for the parts covered. For a Class I product that is the difference between self-assessment and a notified body, so "we mostly follow it" is not a position you can rely on. Be precise about which clauses you meet in full, and record it in the standards-applied section of the technical documentation.