How does CE marking work for software?
The CE marking rules were written for physical goods, so the first question every software maker asks is literal: where does the mark physically go?
The general rule is that the marking is affixed visibly, legibly and indelibly to the product, or where that is not possible, to its packaging and accompanying documents [1]. For software, the Regulation answers the question directly: the marking is affixed either to the EU declaration of conformity or on the website accompanying the software product [1]. You do not paint a CE logo into your app's about screen; you place it on the declaration or the product website.
The marking is an output, not an input
The mark is the visible end of a chain, and each link has to exist before it.
Technical documentation is drawn up before the product is placed on the market and kept, together with the declaration of conformity, for at least ten years or the support period, whichever is longer [2]. The EU declaration of conformity follows the Annex V structure, with a simplified Annex VI form also available [3]. A conformity assessment supports the declaration — internal control for a default product, or the third-party routes where the product's class requires them [4].
Affixing the marking without that chain behind it is the violation, not a formality. The mark asserts the chain exists.
Who may not use the mark
Only the manufacturer's own conformity process leads to the mark. No tool, consultancy or service can "CE mark" your software for you — the declaration is the manufacturer's own act, made in the manufacturer's name [3]. CEMarque prepares the documents; the manufacturer declares. Anyone selling you a "certificate" for a default self-assessed product is selling paper the Regulation does not recognise [4].
When you need it
The marking duty arrives with full application on 11 December 2027: from that date, an in-scope product placed on the EU market carries the marking [5]. A product already on the market before that date does not need the marking until it is substantially modified — the marking clock and the reporting clock are decoupled, and the reporting duty applies to legacy products regardless [6].
So the sequencing for a product shipping today is: keep selling, prepare the documentation stack, and be ready to declare and mark either at your first substantial modification after full application or at your next genuinely new product, whichever comes first [6].
What it looks like in practice
For a typical software product the end state is small and concrete: a technical file in your records [2], a one-page declaration of conformity naming the product, the manufacturer and the requirements [3], the marking on that declaration or your product page [1], and a support-period statement your customers can see. The work is in the file behind the page, not the page.
Check where you stand
The checker tells you whether and when your product needs the marking, which assessment route applies, and generates the document skeleton with citations.
What to do next
Run your own product through the checker — it takes under a minute and gives you a dated, citable result you can send to a customer.
Sources
- CE marking is affixed visibly, legibly and indelibly to the product, or where not possible to the packaging or the declaration of conformity/accompanying documents; for software, on the declaration of conformity or the website accompanying the product. Art. 29–30 — EUR-Lex ↩
- Technical documentation (Annex VII) is drawn up before placing on the market and kept, with the EU declaration of conformity, for at least ten years after placing on the market or the support period, whichever is longer. Art. 13(12)–(13), Art. 31 — EUR-Lex ↩
- EU declaration of conformity (Annex V) and simplified declaration (Annex VI). Art. 28, Art. 13(12), (20), Annex V, Annex VI — EUR-Lex ↩
- Conformity routes: default products may use internal control (Module A), EU-type examination plus internal production control (Modules B+C), full quality assurance (Module H) or a European cybersecurity certification scheme; important class I must use B+C or H (or a scheme at 'substantial' level) unless harmonised standards, common specifications or such a scheme are applied in full; important class II must use B+C, H or a scheme at 'substantial' level; critical products use a European scheme where available, otherwise the class II procedures. Art. 32(1)–(4), Annex VIII — EUR-Lex ↩
- The Regulation applies in full from 11 December 2027. Art. 71(2) — EUR-Lex ↩
- Products placed on the market before 11 December 2027 are subject to the Regulation only if substantially modified after that date; Article 14 applies to them regardless. Art. 69(2)–(3) — EUR-Lex ↩
Related
- What goes in a CRA declaration of conformity?
A one-document statement, in the Annex V structure, in which the manufacturer takes sole responsibility that the product meets the essential requirements. A simplified web-linked form exists, and it travels with the product's paperwork for a decade or more.
- What must I do by 11 December 2027?
Everything else. From full application a product placed on the EU market needs a completed technical file, an EU declaration of conformity you sign, CE marking, a stated support period and a software bill of materials.
- What goes in the CRA technical file?
A technical file in the Annex VII structure — product description, design and vulnerability-handling documentation, risk assessment, SBOM, test reports — drawn up before market placement and kept for ten years or the support period.
- Does the EU Cyber Resilience Act apply to my mobile app?
Yes, in almost every case. An installed app that connects to anything is a product with digital elements, and publishing it in an EU app store makes it available on the EU market.
CEMarque encodes Regulation (EU) 2024/2847 and the European Commission's published guidance as of 10 September 2026 (Facts v2026.09.4). It is not legal advice. Verify obligations for your product with qualified counsel where the stakes require it.