CRA Bureau
Check your scope
All guides

CE marking for software: how it works under the CRA

How to CE mark a software product under the Cyber Resilience Act — what the marking means, where to put it when there is no physical product, and what has to exist first.

6 min readUpdated 1 September 2026Cites Cyber Resilience Act

Software really does get a CE mark now

Articles 3(1), 29 and 30

This surprises people. CE marking has historically been associated with physical goods — machinery, toys, electrical equipment — and the idea of affixing it to a downloadable application feels wrong.

Under the CRA it is straightforward: a product with digital elements includes software placed on the market independently of a physical product. It carries the CE marking like any other regulated product, and the marking is the visible claim that the whole conformity process behind it has been done.

Where to put it when there is nothing to stick it on

Articles 29 and 30

The rule is that the marking must be affixed visibly, legibly and indelibly to the product. Where the nature of the product does not allow that, it goes on the packaging or in the documents accompanying the product.

For software with no packaging, that means the documentation accompanying the product, the product’s own about screen, or the page it is downloaded from — in each case alongside a means of reaching the declaration of conformity.

  • Minimum height 5 mm, with the proportions of the mark preserved when it is scaled.
  • Affixed before the product is placed on the market, not afterwards.
  • Where a notified body is involved in the production control phase, its four-digit identification number follows the marking.
  • No other marking that could mislead a third party about the meaning of the CE marking.

What has to exist before you affix it

The marking is the last step, not the first. Before it goes on, all of the following must be true.

  • The product meets the essential requirements in Annex I Part I, and you have the vulnerability handling processes in Annex I Part II.
  • A cybersecurity risk assessment is documented (Article 13(2)).
  • The Annex VII technical documentation is drawn up.
  • The appropriate conformity assessment procedure under Article 32 has been carried out — with a notified body where your product class requires one.
  • The EU declaration of conformity is drawn up and signed.
  • The Annex II information and instructions accompany the product.

Affixing it without the evidence

This is the expensive mistake
A CE marking is a claim. Affixing one without the underlying conformity work is a breach in its own right, quite apart from whatever the product does. Article 64 provides for administrative fines of up to €15 million or 2.5% of worldwide annual turnover for infringements of the essential requirements and the manufacturer obligations.

Check your own product

Eight questions and a straight answer on whether the CRA applies to your product — including your role, your Annex III class, and whether you can self-assess.

Check if you’re in scopeScan a repository

Free, no account needed.

Related guides

The EU declaration of conformity: what Annex V actually requires

The eight elements Annex V prescribes for a CRA declaration of conformity, what each means in practice, and why a template alone will not save you.

The Annex VII technical file, section by section

What each of the eight sections of the CRA technical documentation must contain, what assessors look for, and the mistakes that get files sent back.

Am I in scope of the Cyber Resilience Act?

Who the CRA applies to, the exclusions that actually work, and the common cases where vendors wrongly believe they are outside it.

This guide summarises Regulation (EU) 2024/2847 of the European Parliament and of the Council for practical use. It is not legal advice, and where this guide and the Regulation disagree, the Regulation governs. Full text: https://eur-lex.europa.eu/eli/reg/2024/2847/oj