Risk assessment for CE compliance — methodology overview and standards reference
How to document product-specific safety and cybersecurity risks, choose methods within their verified scope, and connect risk controls to conformity evidence.
By Vladimír VicianUpdated
A risk assessment supports the manufacturer's conformity claim by explaining what can go wrong, how risks are reduced and what evidence shows the controls work. A completed template without product-specific engineering evidence is insufficient.
Start with scope and application dates
Identify intended use, users, foreseeable misuse, interfaces, energy sources and the product configuration being assessed. Separate the safety, radio, chemical and cybersecurity requirements that apply.
| Product or obligation | Relevant starting point | Timing and scope check |
|---|---|---|
| Radio equipment | RED Annex V, including adequate risk analysis and assessment | Check Article 3 requirements and the applicable assessment route |
| Machinery | Machinery Directive 2006/42/EC Annex I | Machinery placed on the market before 20 January 2027 must comply with the current Directive |
| Machinery under the replacement regulation | Regulation (EU) 2023/1230 Annex III | Main mandatory application is 20 January 2027; check the transition for the actual units |
| Medical devices | MDR Annex I | Risk management forms part of the lifecycle obligations; MDR devices are excluded from CRA scope |
| Products with digital elements within CRA scope | CRA Article 13(2) and Annex I | Main product obligations apply from 11 December 2027; Article 14 reporting already applies from 11 September 2026 |
| Consumer-product safety where GPSR applies | GPSR Article 9 | Check interaction with sector legislation; GPSR itself does not require CE marking |
The Commission's machinery overview explains the Directive-to-Regulation transition. Do not apply a future requirement to every current unit without checking the relevant provisions.
Choose a method within its verified scope
EN ISO 12100 is a machinery risk-assessment and risk-reduction reference. ISO 14971 addresses medical-device risk management. For EU presumption of conformity, check the applicable European edition, amendments and OJ citation rather than treating an ISO catalogue entry as proof of harmonisation.
For radio cybersecurity, check the actual EN 18031 part and its restrictions through the Commission's RED standards list. A RED citation does not automatically cover CRA Annex I. Electrical-safety references such as EN 62368-1 also require a product-scope and edition check.
These standards do not all use the same risk scales or acceptance rules. Read the licensed text before claiming to follow a specific procedure. Do not invent mandatory numerical scoring, acceptance thresholds or annex content from a high-level description. The Commission explains the general role of harmonised standards.
NIST SP 800-30, threat modelling and other security methods can support the engineering analysis. Their use alone does not establish EU presumption of conformity.
A practical evidence record
The following fields are an editorial working structure, rather than the mandated table of any standard:
- Product boundary: model, hardware and firmware versions, interfaces, associated remote processing and operating assumptions.
- Hazard or threat: the affected asset or person, initiating conditions and relevant requirement.
- Evaluation: the selected method, defined scales where used, evidence and uncertainty behind the estimate.
- Control: design protection, implementation reference and responsible owner. Information for use does not substitute for required design protection.
- Verification: report, configuration, result and evidence that the implemented control addresses the identified risk.
- Residual risk: remaining exposure, the manufacturer's reasoned decision and any required user information.
- Change trigger: the events that require the analysis and evidence to be revisited.
Keep uncertainty visible. A laboratory test, code review or field record that has not been performed belongs in the evidence plan, not in the completed-results column. An auditor's preference is not a substitute for the applicable legal requirements or justified acceptance criteria.
Connect the record to the Technical File
Link the assessment to the product description, applied standards, design controls and test reports in the Technical File. Keep versioned links to the firmware release, SBOM where relevant, instructions and declaration. The section numbering in a team's folder structure is an organisational choice; use an act-by-act coverage checklist for the actual annex requirements.
A connected machine needs a scope analysis across the applicable acts. Do not automatically add a standalone LVD claim to every machine, or both standalone LVD and EMC to radio equipment: the sector rules determine how those safety and EMC objectives are addressed.
Common gaps to resolve
- A generic hazard list without the assessed product configuration.
- Numerical scores without defined scales or supporting reasoning.
- Claimed controls without implementation or verification evidence.
- A standard name without its edition, OJ scope and restrictions.
- No documented residual-risk decision or required user information.
- A firmware change that breaks traceability to the existing assessment.
Using Cenitia
Cenitia can help prepare evidence-linked working drafts within its supported catalogue. Engineering and regulatory review must establish the actual scope, chosen method, evidence and issuance decision.
Review the supported scope and workflow
Related reading
FAQ
Frequently asked questions
Is a risk assessment required for CE marking?
Check the applicable product legislation. RED Annex V requires an adequate analysis and assessment of risks in the technical documentation; medical-device legislation has lifecycle risk-management duties. CRA Article 13(2) introduces a cybersecurity risk assessment with the main manufacturer obligations from 11 December 2027. A GPSR risk assessment does not itself create a CE-marking obligation.
Must I use a harmonised standard as my risk-assessment method?
Harmonised standards are generally voluntary. A cited edition can provide presumption of conformity only for the requirements it covers and subject to its OJ restrictions. Other solutions need adequate evidence and may affect the available conformity-assessment route. Use the licensed standard to check its actual method; do not infer a prescribed scoring system from this overview.
Can EN 18031 automatically establish CRA conformity?
No. EN 18031 concerns RED cybersecurity. Verify the precise part, edition, OJ citation, restrictions and covered requirements. It can inform a CRA evidence plan, but a RED citation does not automatically create CRA presumption of conformity.
Can software prepare the risk assessment for me?
Software can help organise a working draft and link evidence. Engineers must establish the actual architecture, hazards, exposure, controls, tests and residual risks. Cenitia output needs a product-specific review before it supports an issued conformity claim.
When should the assessment be reviewed?
Review it when design, firmware, intended use, operating conditions, applicable requirements or new field evidence may affect the analysis. Record the impact decision and connect the assessment to the exact product and firmware versions. A newly published standard prompts an applicability review; it does not automatically invalidate every product already placed on the market.
Continue reading
Related guides
reference
Technical File retention requirements per EU directive
Selected documentation-retention and availability duties under CRA, MDR, RED and machinery legislation, with product-specific evidence and source references.
3 min read
tutorial
Technical File for IoT devices — concrete template aligned with CRA and RED
An illustrative eight-part evidence folder for connected IoT products, with separate checks against applicable RED documentation and future CRA Annex VII duties.
10 min read
guide
Technical File 101 — documentation scope and evidence overview
A concise overview of technical documentation, selected CRA, RED and machinery duties, retention and the product evidence needed to support conformity.
3 min read
tutorial
Coordinated Vulnerability Disclosure Policy for Hardware Manufacturers
Build a usable hardware vulnerability disclosure policy with intake owners, safe testing boundaries and a security.txt example.
4 min read
Put this into practice
Free tools & references
- EU Directive SelectorDescribe your product and find which EU directives and regulations apply.Open tool →
- CRA Readiness CheckerScore your product against the Cyber Resilience Act essential requirements.Open tool →
New to the terminology? Browse the compliance glossary — plain-English, citation-backed definitions of every term above.