Common specifications matter because they can become a legally recognised technical route where standardisation is blocked, delayed or fails to meet the Commission request. Manufacturers should monitor the implementing act, identify exactly which Annex I requirements are covered and watch for later harmonised standards, because Article 27 provides for repeal of overlapping common specifications when an appropriate harmonised standard reference is published.
Article 27 Makes Common Specifications a Fallback Route
Article 27 allows the Commission to adopt implementing acts establishing common specifications covering technical requirements that provide a means to comply with Annex I essential cybersecurity requirements. The mechanism is conditional. It is designed for situations where the harmonised-standard route has not produced an appropriate standard within the framework set by the Regulation.
- Check the Article 27 conditions.
- Identify the implementing act.
- Identify the Annex I requirements covered.
- Keep the measure linked to conformity documentation.
The Commission Cannot Use Common Specifications Without the Article 27 Conditions
Article 27 requires a prior standardisation request and specified problems with that route. These can include the request not being accepted, the requested harmonised standards not being delivered within the deadline or the standards not complying with the request. The Article also requires that no suitable harmonised-standard reference has been published in the Official Journal and none is expected within a reasonable period.
- Prior standardisation request.
- Acceptance, delivery or compliance problem.
- No applicable Official Journal reference.
- No suitable reference expected within a reasonable period.
Common Specifications Can Create Presumption of Conformity
Article 27 provides that products and manufacturer processes conforming to common specifications, or parts of them, are presumed to conform with the Annex I essential cybersecurity requirements covered by those specifications or parts. The legal effect is therefore requirement-specific, just as it is for harmonised standards. A common specification does not automatically establish compliance with the entire CRA.
- Map the specification to covered requirements.
- Record full or partial application.
- Address uncovered requirements separately.
- Keep product-specific risk assessment in place.
Stakeholder Consultation Is Built Into the Process
Before preparing the draft implementing act, Article 27 requires the Commission to take account of the views of relevant bodies and duly consult relevant stakeholders. This reflects the fact that common specifications can have significant technical consequences and are intended to substitute temporarily for the missing harmonised-standard route rather than bypass technical expertise.
- Monitor Commission consultations.
- Review draft technical scope.
- Assess likely product impact early.
- Do not wait until final adoption to identify affected products.
Later Harmonised Standards Can Replace the Common Specification
When a harmonised standard is later adopted and its reference is published in the Official Journal for the same essential cybersecurity requirements, Article 27 requires the Commission to repeal the overlapping common-specification implementing act or the relevant parts. Companies relying on a common specification therefore need change control for the transition to the later harmonised standard.
- Track later harmonised standards.
- Compare coverage.
- Assess transition impact.
- Update technical documentation and conformity decisions.
Document the Exact Basis Used for Conformity
Annex VII expects the technical documentation to identify harmonised standards, common specifications and relevant certification schemes applied, or to describe other solutions used where those routes are not applied. A manufacturer should therefore record the exact common specification, version or implementing act, covered requirements and product releases that rely on it.
- Implementing act reference.
- Covered Annex I requirements.
- Affected product versions.
- Evidence supporting application.
Official sources
Read the full legal text and Commission material for precise wording, qualifications and updates.