Notified body
Manufacturers may not assess important and critical products on their own. That requires notified bodies, designated by a Member State and notified to the Commission. As of 7 October 2026, none exist yet for the Cyber Resilience Act.
A notified body is a conformity assessment body that a Member State has designated under the Cyber Resilience Act and notified to the Commission. It assesses products in the procedures the manufacturer may not carry out on its own.
Definition in the Regulation
The rules for notified bodies are set out in Chapter IV of Regulation (EU) 2024/2847, from Article 35 onwards. Each Member State designates a notifying authority that assesses and notifies conformity assessment bodies (Article 36(1)); under Article 35(2), Member States shall strive to ensure a sufficient number of notified bodies by 11 December 2026. Notified bodies carry out modules B and C (EU-type examination plus conformity to EU-type) and module H (full quality assurance) under Annex VIII. Important products in class II always need a notified body; important products in class I may only be assessed under the manufacturer's own responsibility if harmonised standards are applied in full. Under Article 71(2), Chapter IV has applied since 11 June 2026. Supplying incorrect or misleading information to a notified body is a separate offence subject to fines under Article 64(4).
What it means for manufacturers
As of 7 October 2026, not a single notified body for the Cyber Resilience Act is registered in the Commission's NANDO database (last documented check on 8 September 2026). Article 35(2) requires Member States to strive to ensure a sufficient number of notified bodies by 11 December 2026, in order to avoid bottlenecks and hindrances to market entry. Germany uses a two-step procedure: first the national accreditation body DAkkS accredits the assessment body (applications open since 28 July 2026), then the BSI notifies it. If you manufacture a class II product, follow the timetable up to 11 December 2027 closely, because without a notified body the conformity assessment cannot be completed. For products in the default category, which is by far the largest share of all products, internal control under module A is sufficient.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit