CE marking
The marking placed on a product by the manufacturer to indicate that the product has been assessed and meets all applicable Union harmonisation legislation, including the CRA's essential cybersecurity requirements. CE marking is required before a product with digital elements is placed on the EU market and must be affixed visibly, legibly, and indelibly.
Source citations
Regulation text
Article 30 of Regulation (EU) 2024/2847 governs CE marking for products with digital elements:
"Products with digital elements in respect of which conformity with the applicable requirements of this Regulation has been demonstrated shall bear the CE marking."
The CE marking rules follow the general principles of Regulation (EC) No 765/2008 and are governed by Art. 30 and Decision No 768/2008/EC.
Requirements for CE marking
Before affixing CE marking, the manufacturer must have:
- Completed the appropriate conformity assessment procedure (Art. 32) — Module A (self-assessment), Module B+C, Module H, or EUCC certification
- Drawn up the EU Declaration of Conformity (Art. 28 + Annex V)
- Compiled the technical documentation (Art. 31 + Annex VII)
- Applied appropriate cybersecurity by design to the product
Formal requirements for the mark
- Must be at least 5 mm tall (unless the product's nature makes this impossible)
- Must be visible, legible, and indelible
- Must appear on the product or its packaging; if the product is intangible software, it may appear on the packaging, accompanying documents, or the software interface/download page
- No other marking that could mislead third parties about the CE marking may be affixed
Digital placement rule
Where a product is software-only, CE marking may be placed on the manufacturer's website, in the packaging, in the accompanying documentation, or on the user interface of the software (Art. 30(3)).
CE marking ≠ endorsement
CE marking does not signify approval or endorsement by any public authority; it is the manufacturer's self-declaration that the product is compliant (except for important Class II and critical products, which require third-party involvement).