CRA Conformity Assessment: The Path to CE Marking

The CRA conformity assessment is the legally required procedure under the EU Cyber Resilience Act through which manufacturers demonstrate that their product with digital elements meets the essential cybersecurity requirements. Without a completed conformity assessment, no product may bear the CE marking or be placed on the EU single market. Full application starts in December 2027.

The CRA defines four assessment procedures in Annex VIII: Module A is internal production control (self-assessment without a notified body). Module B is EU type examination where a notified body evaluates a prototype. Module C is subsequent internal production control for series production and is always combined with Module B. Module H is comprehensive quality assurance where a notified body assesses the manufacturer entire quality management system.

Default products (approximately 90 percent of all products) can use Module A (self-assessment). Important products Class I (e.g. operating systems, routers, password managers) require Module A only when applying harmonised standards, otherwise Module B+C or H with a notified body. Important products Class II (e.g. firewalls, intrusion detection systems) and critical products (e.g. smart cards, smart meter gateways) must undergo mandatory third-party assessment.

In the self-assessment under Module A, the manufacturer independently creates the technical documentation, conducts the risk assessment and declares conformity without external review. In third-party assessment (Module B+C or H), a notified body designated by an EU member state examines either the product type or the quality assurance system. Third-party assessment is mandatory for important products Class II and critical products.

A notified body is a conformity assessment body accredited by an EU member state that is authorised to perform third-party assessments under the CRA. You need a notified body when your product is classified as important (Class II) or critical, or when you do not apply harmonised standards for Class I products. Notification of these bodies starts from June 2026 via the NANDO database.

The CRA entered into force on 10 December 2024. Notification of conformity assessment bodies begins from 11 June 2026. Vulnerability reporting obligations apply from 11 September 2026. Full application of all CRA requirements including conformity assessment and CE marking obligations starts from 11 December 2027.

ADVISORI guides you through the entire conformity assessment process: We determine your product category and the appropriate assessment module, prepare the technical documentation according to Annex VII, conduct the cybersecurity risk assessment and prepare you for examination by notified bodies. For Module A we support the self-assessment, for Module B+C and H we prepare you for the third-party examination.