CRA vs ETSI EN 303 645

One is the law, the other is the checklist most conformity assessments will use to show the law is met. ETSI EN 303 645 predates the CRA and was written for consumer IoT; the CRA covers every product with digital elements, including industrial ones the standard never addressed.

	EU Cyber Resilience Act	ETSI EN 303 645
Applies when	Any product with digital elements placed on the EU market, consumer or industrial	Consumer IoT; referenced by market-access rules in the EU, UK, Singapore, Australia and Finland
Who demands it	Market access, mandatory (CE marking)	Product baseline behind several national regimes; not itself enforceable
What it is	Regulation	Standard
Scope	Security by design, SBOMs, 24-hour reporting of actively exploited vulnerabilities to the CSIRT and ENISA, coordinated disclosure, post-market monitoring for the support period	13 outcome-focused provisions: credentials, updates, secure storage, communication, attack surface, resilience, telemetry, personal data, and more
In force	In force 10 Dec 2024; reporting duties from 11 Sep 2026; main obligations from 11 Dec 2027	v3.1.3 current
Penalties	Up to EUR 15M or 2.5% of global turnover	None; penalties come from the law that cites it
Authoritative text	CRA text ↗ · on this site	ETSI EN 303 645 text ↗

What a product team should do

Use ETSI's 13 provisions as the engineering backlog and the CRA's Annex I as the audit map. Where the CRA goes further, on SBOMs and 24-hour reporting, ETSI is silent and you need a process, not a feature.

Check your own product

The IoT security scorecard grades a product against these frameworks in 19 questions, and the requirements generator turns the applicable ones into PRD-ready requirements. Both cite the same provisions this page does. The full map is on the regulatory landscape reference.

Sources: EU Cyber Resilience Act (official text) and ETSI EN 303 645 (official text). Educational reference, not legal advice. See Chapter 18 and Chapter 19 of Tangibles.

← All comparisons