Conformity assessment
Before placing a product on the market, the manufacturer has to show that it meets the requirements. Which procedure it may use depends on the product class and on whether harmonised standards exist.
Conformity assessment is the procedure by which the manufacturer demonstrates that a product meets the requirements of Annex I. Depending on the product class, the manufacturer carries it out itself or a notified body is involved.
Definition in the Regulation
Article 32(1) of Regulation (EU) 2024/2847 lists four procedures: internal control (module A), EU-type examination followed by conformity to EU-type (modules B and C), full quality assurance (module H) and, where available, a European cybersecurity certification scheme. The modules are set out in Annex VIII. Under Article 32(2), important products in class I may use module A only if they fully apply harmonised standards, common specifications or a certification scheme; otherwise B plus C or H applies. Under Article 32(3), class II products always need a notified body or a certificate. Critical products follow Article 32(4). Under Article 32(5), open-source products in Annex III categories may use any of the procedures, provided their technical documentation is public. Article 13(12) requires the assessment before the product is placed on the market; if it is successful, the EU declaration of conformity and the CE marking follow.
What it means for manufacturers
By far the largest share of products, such as machine controllers, sensors or application software, falls into the default category. The manufacturer carries out the assessment itself under module A, but as long as no harmonised standard has been published in the Official Journal, it has to describe and justify its solutions. For class I, module A is not available without standards, so a notified body becomes mandatory. In October 2026 no notified body is listed for the CRA; in Germany, accreditation by the national accreditation body DAkkS and notification by the BSI are under way. Manufacturers of class I and class II products should make contact early, as a bottleneck before December 2027 is likely. The class is determined by the product's core functionality, not by a component built into it.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kitRelated terms
- Notified body
- Presumption of conformity
- Harmonised standard
- EU declaration of conformity
- Default category