How to find harmonised standards in the Official Journal

Every CE marking workflow eventually lands on the same question: which standard should we design to, and is its reference current in the Official Journal? The legal definition is set out in Regulation (EU) No 1025/2012, Article 2(1)(c): a harmonised standard is "a European standard adopted on the basis of a request made by the Commission for the application of Union harmonisation legislation". That definition matters because the legal effect — presumption of conformity — is triggered only once the Commission cites the standard's reference in the OJEU, not at the moment CEN, CENELEC, or ETSI publishes it.

This tutorial walks through the exact workflow: where to look, what to download, how to read an Implementing Decision, and how to verify that the reference you are designing against has not been withdrawn or restricted. The walk-through uses the Radio Equipment Directive and Commission Implementing Decision (EU) 2025/138 as the running example because it is the most recent significant cybersecurity listing and a clean illustration of how excluded clauses work in practice.

The two-step path: CEN-CENELEC publication, then OJEU listing

The most common error in the CE workflow is treating an EN standard published by CEN-CENELEC or ETSI as automatically harmonised. It is not. The full lifecycle has two distinct events:

The gap between the two can be substantial. EN 18031-1, EN 18031-2, and EN 18031-3 were published as European standards in 2024, but only obtained presumption-of-conformity status under Article 3(3)(d)–(f) of the RED when Implementing Decision (EU) 2025/138 was adopted on 28 January 2025 (covered in detail in the EN 18031 walkthrough).

The single authoritative entry point

The Commission's harmonised standards hub on the DG GROW single-market portal is the canonical entry point. It states plainly: "The references of harmonised standards must be published in the Official Journal of the European Union (OJEU)." From there, each EU harmonisation act has its own subpage — Radio Equipment, Machinery, EMC, Low Voltage, Medical Devices, and so on. Every subpage links to the base Commission Implementing Decision plus every amendment, in chronological order.

For RED, the base act is Commission Implementing Decision (EU) 2022/2191, published in OJ L 289 on 10 November 2022. The Commission has not re-consolidated it. Instead, six amending decisions have been published as of late 2025 — including (EU) 2025/138. To know what is currently in force you read the base decision plus every amendment, or use the consolidated summary files (PDF and XLS) provided on the DG GROW page.

Reading an Implementing Decision: restrictions and excluded clauses

The annex of every Implementing Decision lists each standard reference with a "restrictions" column. This is where the most consequential information sits and where most engineering teams stop reading too soon. Implementing Decision (EU) 2025/138 illustrates the pattern clearly. For all three parts of EN 18031, the decision states:

The sections named "rationale" and "guidance" do not confer presumption of conformity.

It also limits presumption of conformity for specific assessment criteria: clauses 6.2.5.1 and 6.2.5.2 of all three parts do not confer presumption of conformity in cases where "the user is allowed not to set and use any password". EN 18031-2 carries an additional restriction tied to parental or guardian access control for the categories it covers, and EN 18031-3 has a restriction on clause 6.3.2.4 regarding secure updates and financial-asset protection (see our EN 18031 parts 1, 2, and 3 comparison for the application-class breakdown).

The practical takeaway is mechanical: if your design relies on a clause that an Implementing Decision excludes, then conformance with that clause does not give you presumption of conformity. You still have to demonstrate that the essential requirement is met through another route — typically the EU type-examination module under Article 17 of the RED.

Verifying that a reference is still current

References can be replaced, restricted, or withdrawn at any time, usually following a formal objection under Article 11 of Regulation (EU) No 1025/2012. The workflow is:

1. Open the DG GROW page for the act you are working under.
2. Note the date of the most recent amending decision.
3. Cross-check the standard reference and version against the consolidated summary XLS.
4. If the reference shows a withdrawal date, identify which amending decision set that date and read its annex.

The summary XLS is the most efficient tool for batch checks because it lists every reference, the Implementing Decision that introduced it, and any subsequent restriction or withdrawal in one row.

Common mistakes

• Treating a CEN-CENELEC publication date as the harmonisation date. The OJEU citation date is what controls — see the EN 18031 example above.
• Citing a standard reference without reading the restrictions column. Excluded clauses, like "rationale" and "guidance" sections, are routinely overlooked and quietly invalidate part of the conformity argument.
• Working from a saved PDF or downloaded list more than a few months old. Standards lists move; only the most recent OJEU listing is authoritative.
• Assuming "harmonised" means "mandatory". Harmonised standards remain voluntary — they are one route to presumption of conformity, not the only path. The technical file can rely on other evidence.
• Citing the base Implementing Decision while ignoring its amendments. RED has been amended six times since 2022, and ignoring any one of those amendments will misrepresent which clauses currently confer presumption of conformity. See updating a DoC after amendment for the downstream implications.

How Cenitia helps

Cenitia watches every Implementing Decision the Commission publishes against the EU harmonisation acts you have selected for each of your products. When a new amending decision lands — say a new restriction is added to EN 18031-2 — every Declaration of Conformity citing that clause is flagged for review with a one-click diff against the previous OJEU listing.

The compliance vault stores the OJEU citation date, the Implementing Decision CELEX number, and the restrictions column for each standard you have used, so an auditor can reconstruct exactly which version of the OJEU list was in force on the date your product was placed on the market.

Frequently asked questions

Where exactly are harmonised standards listed?

References to harmonised standards are published as annexes to Commission Implementing Decisions in the L-series of the Official Journal of the EU (OJEU). The DG GROW single-market page at single-market-economy.ec.europa.eu aggregates the per-directive lists with links to the underlying Implementing Decisions on EUR-Lex.

What is presumption of conformity?

When a product is built in accordance with a harmonised standard whose reference is currently listed in the OJEU under a given EU harmonisation act, the manufacturer is presumed to comply with the essential requirements that the standard covers. The legal basis is Regulation (EU) No 1025/2012 and the corresponding clauses of each sectoral act.

Is a CEN-CENELEC published EN standard automatically harmonised?

No. Publication by CEN, CENELEC, or ETSI is the technical-standardisation step. A standard only becomes "harmonised" in the legal sense — and triggers presumption of conformity — once the Commission cites its reference in the OJEU through an Implementing Decision. The two events are separate and can be months or years apart.

What does an excluded clause in the OJEU notice mean?

An Implementing Decision can list a standard but carve out specific clauses, tables, sections, or assessment criteria that do not confer presumption of conformity. For Implementing Decision (EU) 2025/138 on EN 18031, for example, sections named "rationale" and "guidance" are excluded, and certain password and parental-control criteria do not confer presumption unless the equipment behaves in a specific way.

How often do harmonised standards change?

Each EU harmonisation act has its own cadence. The RED list was amended six times between October 2023 and December 2025. The Commission does not consolidate amendments into a new base decision — you must read the original Implementing Decision plus every amending decision, or rely on the DG GROW summary list which is updated periodically.

Can I still use a withdrawn harmonised standard?

You can technically design to it, but you lose the presumption of conformity from the date stated in the relevant Implementing Decision. After that date you must demonstrate conformity through another route — the latest harmonised version, the EU type-examination procedure, or another conformity-assessment module that does not rely on a harmonised standard.

Related from the Library

• RED delegated act and EN 18031 walkthrough — full read-through of the cybersecurity delegated act and how the EN 18031 family operationalises it.
• EN 18031 parts 1, 2, and 3 comparison — scope and application classes of each part.
• RED Annex IV radio path — what happens when a harmonised standard is restricted and you fall back to type-examination.
• Updating a DoC after amendment — downstream documentation work when an OJEU listing changes.
• CE marking 101 — high-level overview of CE and where harmonised standards fit.

Further reading

• DG GROW — harmonised standards hub — Commission entry point with consolidated summary lists.
• DG GROW — Radio Equipment subpage — RED-specific Implementing Decisions and amendments.
• Regulation (EU) No 1025/2012 on European standardisation — legal basis for harmonised standards, presumption of conformity, and formal objections.
• Commission Implementing Decision (EU) 2025/138 — amends (EU) 2022/2191 for EN 18031 cybersecurity standards under RED.
• Commission Implementing Decision (EU) 2022/2191 — base RED harmonised standards decision.
• Directive 2014/53/EU on radio equipment — the underlying directive whose essential requirements the standards address.
• EUR-Lex search portal — primary source for every Implementing Decision and amendment.

Last reviewed: 5 July 2026. Cited regulations watched continuously by Cenitia — when one amends, this article is flagged for update.