Systematic conformity assessment for CRA-compliant products
CRA conformity assessment demonstrates your product meets all cybersecurity requirements.
The conformity assessment under the EU Cyber Resilience Act is a systematic process for verifying whether products with digital elements meet the essential requirements of the regulation. We support you in the complete execution of all required assessment procedures.
We offer you a complete spectrum of conformity assessment services for the CRA, from initial product classification to continuous compliance monitoring.
2 service modules
We determine the applicable conformity assessment procedure for your products under CRA Annex V.
Complete preparation and review of technical documentation in accordance with CRA requirements.
5 phases
We develop a tailored conformity assessment strategy with you that is optimally aligned with your product portfolio and business requirements.
Your contact
Sarah Richter
Head of Information Security, Cyber Security
10+ years of experience, CISA, CISM, Lead Auditor, DORA, NIS2, BCM, Cyber and Information Security
With our structured approach and well-founded expertise in CRA conformity assessment, we enable clients to meet all regulatory requirements on time and bring their products to market smoothly and promptly.
Choosing the right conformity assessment procedure is decisive for costs and time expenditure. Depending on the product category and risk level, different modules are applied.
7 QUESTIONS, BRIEFLY ANSWERED
The CRA conformity assessment is the legally required procedure under the EU Cyber Resilience Act through which manufacturers demonstrate that their product with digital elements meets the essential cybersecurity requirements. Without a completed conformity assessment, no product may bear the CE marking or be placed on the EU single market. Full application starts in December 2027.
The CRA defines four assessment procedures in Annex VIII: Module A is internal production control (self-assessment without a notified body). Module B is EU type examination where a notified body evaluates a prototype. Module C is subsequent internal production control for series production and is always combined with Module B. Module H is comprehensive quality assurance where a notified body assesses the manufacturer entire quality management system.
Default products (approximately 90 percent of all products) can use Module A (self-assessment). Important products Class I (e.g. operating systems, routers, password managers) require Module A only when applying harmonised standards, otherwise Module B+C or H with a notified body. Important products Class II (e.g. firewalls, intrusion detection systems) and critical products (e.g. smart cards, smart meter gateways) must undergo mandatory third-party assessment.
In the self-assessment under Module A, the manufacturer independently creates the technical documentation, conducts the risk assessment and declares conformity without external review. In third-party assessment (Module B+C or H), a notified body designated by an EU member state examines either the product type or the quality assurance system. Third-party assessment is mandatory for important products Class II and critical products.
A notified body is a conformity assessment body accredited by an EU member state that is authorised to perform third-party assessments under the CRA. You need a notified body when your product is classified as important (Class II) or critical, or when you do not apply harmonised standards for Class I products. Notification of these bodies starts from June 2026 via the NANDO database.
The CRA entered into force on 10 December 2024. Notification of conformity assessment bodies begins from 11 June 2026. Vulnerability reporting obligations apply from 11 September 2026. Full application of all CRA requirements including conformity assessment and CE marking obligations starts from 11 December 2027.
ADVISORI guides you through the entire conformity assessment process: We determine your product category and the appropriate assessment module, prepare the technical documentation according to Annex VII, conduct the cybersecurity risk assessment and prepare you for examination by notified bodies. For Module A we support the self-assessment, for Module B+C and H we prepare you for the third-party examination.
Our clients trust our expertise in digital transformation, compliance, and risk management
Schedule a strategic consultation with our experts now
Book Strategy Session30 Minutes • Non-binding • Immediately available
Direct hotline for decision-makers
Strategic inquiries via email
For complex inquiries or if you want to provide specific information in advance