Article 32 Conformity assessment routes

What Article 32 asks manufacturers to prove before placing a product on the EU market

Article 32 ties a product's class to the conformity assessment route, and that route decides who checks the evidence before the product reaches the EU market. A manufacturer must pick the route before launch, because it determines whether the manufacturer checks its own work, whether a notified body examines the design, or whether a notified body audits the quality system. Under Article 32(1), the options are internal control under module A, EU-type examination under module B followed by conformity to type under module C, full quality assurance under module H, or a European cybersecurity certification scheme where one is available. Most products follow self-assessment under module A, but that route is closed to some important products unless the relevant standards or schemes were applied in full.

The hard part is rarely choosing the route. It is proving the route was applied in full. For a class I product relying on module A, the manufacturer must show that harmonized standards, common specifications or certification schemes at assurance level at least substantial were applied across all relevant requirements, and the technical file must record that. Class II products must use module B with module C, module H or a certification scheme under Article 32(3). Before committing, confirm with your product's classification under Annex III or Annex IV, check which harmonized standards are published in the Official Journal for your category, and ask whether a notified body will be needed. The Commission's FAQ on notified body needs (FAQ 6.1 and 6.2) is the natural next read for that check.

Each route creates a different evidence trail, so the choice has consequences beyond the first assessment. Under module B, the notified body examines the technical design and your vulnerability handling processes, issues an EU-type examination certificate where requirements are met, and audits those processes periodically. If you later make a substantial modification to a product assessed under module B with module C, a new assessment by the same or a different notified body is required. Ask prospective notified bodies how they price re-assessment, how they handle multiple product types and what evidence they expect from your vulnerability handling process before you sign anything.

Which product categories push a product onto a notified body route

Four classification outcomes decide whether a product can be self-assessed or must go through a notified body. Each outcome leads to a different route under Article 32, and the deciding question is different in each case. Confirm the category before choosing a route, because the classification step itself is covered on the scope and classification page.

Default products

Products that are neither important nor critical fall into the default category and usually follow module A, internal control, carried out by the manufacturer. No notified body is needed for this route under Article 32. The question to answer is whether the product's core functionality matches any Annex III or Annex IV category. If it does not, the default route applies, but the manufacturer still must meet the Annex I essential requirements and keep the technical file. Document the reasoning behind the classification so an assessor or market surveillance authority can follow it.

Annex III class I products

Important products in class I can use module A only when harmonized standards, common specifications or certification schemes at assurance level at least substantial were applied in full. If any of those were not applied in full, or none exist for the product, a notified body must be involved. Check each Annex I requirement against the standards you claim to have applied, and confirm that every relevant standard was applied completely rather than in part. The Annex III category descriptions come from Commission Implementing Regulation (EU) 2025/2392.

Annex III class II products

Products in class II must use module B, EU-type examination, followed by module C, conformity to type, or module H, full quality assurance, or a European cybersecurity certification scheme where one is available. Self-assessment is not an option for this category. A notified body examines the technical design and the manufacturer's vulnerability handling processes. Ask any prospective notified body which module they assess under and how they handle periodic audits of vulnerability handling.

Annex IV critical products

Critical products listed in Annex IV follow the most demanding route, and the decision is driven by the product's category rather than by how the manufacturer applied standards. Confirm first that the product falls within one of the three Annex IV categories, using the technical descriptions in Commission Implementing Regulation (EU) 2025/2392. Then plan for a notified body or a certification scheme, because the self-assessment path is not open. Budget time for the examination and for re-assessment whenever the product is substantially modified.

How an assessor tests the conformity route, step by step

This table walks through the checks an assessor runs on a conformity route, from confirming the product class to testing whether a substantial modification triggered a new assessment. Read each row as one question the assessor asks, the evidence the manufacturer should have ready, and the gap that most often delays review. The notified body reviews and certifies, while the manufacturer prepares the technical file and evidence.

Check	Evidence requested	Common finding
Confirm the product class	Product description mapped to the Annex III or Annex IV category, with the Commission Implementing Regulation (EU) 2025/2392 technical description the manufacturer relied on	Core functionality is classified by a marketing description rather than the category text, so the class is wrong from the start
Confirm the route matches the class	Written route selection showing default products on module A, class I products on module A only where standards or schemes were applied in full, and class II or critical products on module B with C or H, or a certification scheme	Class I product self-assessed under module A without evidence that every applicable harmonized standard or scheme was applied in full
Examine the technical design for module B	Technical design documentation, architecture and security design records, and the risk assessment that supports them, as presented to the notified body	Design documents describe intended security features but do not match the shipped build or omit third-party components
Examine vulnerability handling processes for module B	Written vulnerability handling procedures, records of how they run in practice, and evidence of the periodic audit cycle the notified body will perform	Procedures exist on paper, but no records show that they were used for real findings or updates
Check production control for module C	Internal production control procedures, release and build records showing each unit conforms to the type examined, and the manufacturer's declaration of conformity to type	Build pipeline changes after the type examination with no record of whether conformity to type still holds
Check the quality system for module H	Approved quality system scope covering design, development, production, final inspection and vulnerability handling, with records of its operation	Quality system scope does not cover vulnerability handling or the products the manufacturer now sells
Check the substantial modification trigger	Change log tying each release to a documented decision that it is or is not a substantial modification, with the resulting assessment or confirmation from the notified body	Major feature or architecture changes shipped without a documented assessment decision, so the existing certificate no longer covers the product
Confirm who prepares and who decides	Manufacturer's technical file and evidence package, and the notified body's review report and certificate or decision	Manufacturer expects the notified body or consultant to write the technical file, which the manufacturer must own and keep

How to choose and prepare a conformity assessment route

This sequence takes a product from its classification to a documented conformity assessment route, with the evidence each route needs in place before the manufacturer declares conformity or engages a notified body. It also sets up the re-assessment trigger for later changes.

Confirm the product classification
Product management and the compliance lead review the product's core functionality against the default, class I, class II and critical categories in Annex III and Annex IV, using the technical descriptions in Commission Implementing Regulation (EU) 2025/2392. The output is a classification record that names the category, the reasoning, and the people who signed off on it. Keep the record with the technical file, because every later route decision depends on it. Where a product sits near a category boundary, write down the alternatives you considered and ask counsel or the market surveillance authority guidance before you proceed.
Decide whether module A is available
For a default product, module A (internal control) is the normal route. For a class I important product, module A is only available if you applied harmonized standards, common specifications or a certification scheme at assurance level at least substantial in full. Engineering and compliance review the standards map against the product's Annex I risk assessment and confirm each gap. The output is a route decision memo that states either that module A is available with the standards relied on, or that a notified body route is needed.
Select the notified body route
Where module A is not available, or the product is class II or critical, select the route under Article 32: module B with module C, module H, or a European cybersecurity certification scheme where one applies. Compare the options against your product portfolio, release frequency and the number of product types you ship. Ask candidate notified bodies, identified through the Commission's NANDO system, to confirm in writing which modules they are designated for. The output is a signed route decision and a shortlist of notified bodies with written confirmation of scope.
Assemble the technical design and vulnerability handling evidence
Engineering and the product security team compile the design documentation that a notified body would examine under module B: architecture, security design decisions, the cybersecurity risk assessment, and the component inventory including the SBOM. They also document the vulnerability handling processes required by Annex I Part II. The output is an evidence index that maps each claim to a document, a test report or a record. A notified body does not accept a design described only in conversation, so every statement should point to something a reviewer can open.
Set up production control or a quality system
If module C applies, the manufacturer establishes internal production control so each unit conforms to the type the notified body examined. If module H applies, the manufacturer builds a full quality system covering design, development, production and vulnerability handling, and submits it for approval. Quality and engineering own the work, and the notified body assesses it. The output is an audit-ready quality manual, procedure set and records showing the procedures run in practice, not only on paper. Ask the notified body which procedures and record formats it expects before you write them.
Test the evidence against the route before submission
Before you submit to a notified body, the compliance lead runs an internal review that checks the evidence index, the quality records and the test reports against the route's requirements and the Annex I essential requirements. Gaps are logged with an owner and a closure record. The output is a pre-submission review report that is signed off by the person accountable for conformity. This step does not replace the notified body's assessment, and the organization keeps ownership of its controls, not the reviewer's conclusions.
Plan re-assessment for substantial modifications
Product and compliance leads define in advance what counts as a substantial modification for each product, using the Commission's guidance. Under the Commission's FAQ, a substantial modification of a product assessed under module B with module C requires a new assessment by the same or a different notified body. The output is a change control procedure that routes every release through a substantial modification check, with a recorded decision and, where needed, a new assessment request. Keep these records with the technical file so that the conformity status of each shipped version can be shown later.

Evidence that proves the chosen conformity route was applied

A conformity route is only as credible as the records behind it. The artifacts below show which route was chosen, why, and that the product, its modifications and its vulnerability handling stayed within what the notified body or the manufacturer's own assessment actually covered. Each record needs an owner, a version history and a sign-off so it can be shown as it stood at any point in the support period.

Classification record with rationale

This record states which category the product falls into (default, important class I, important class II or critical) and the reasoning from the product's core functionality. It is the starting point for every later decision, so an assessor will check it first. Keep the Annex III and Annex IV references, the technical description used from Implementing Regulation (EU) 2025/2392, and the name of the person who approved the classification. Review it whenever the product's functions change, and log each review as a new version with the reason noted.

Route decision record

This record names the module chosen under Article 32, whether that is internal control, module B with module C, module H or a certification scheme, and explains why the other routes were rejected. For class I products using module A, it must show that the relevant harmonized standards or certification scheme were applied in full. Store the list of standards applied with their versions and the date of the decision. Re-open the record if a harmonized standard is later cited or withdrawn, since that can change which routes are available.

Technical documentation set for the route

The technical file is the body of evidence the route depends on, and each route requires different parts of it to be complete. Include the design and architecture, the vulnerability handling processes, the risk assessment and the test reports tied to each essential requirement. Keep one controlled master copy, with changes recorded in version control that shows what changed, when, and who approved it. Confirm the retention period for the file with your legal team and the notified body before the first placement on the market.

EU-type examination certificate and scope

For module B, the notified body issues an EU-type examination certificate after it examines the technical design and the manufacturer's vulnerability handling processes. The certificate defines what it covers, so the scope statement is as important as the certificate itself. Record the certificate number, the product versions it covers and the dates of the periodic audits of vulnerability handling. Check each release against that scope, and treat any change that falls outside it as a trigger for a new assessment.

Production control or quality system records

Module C requires internal production control to ensure that each product made conforms to the type that was examined. Module H requires an approved full quality system covering design, production and vulnerability handling. Keep build and release logs, sign-off records for each release, and audit reports from the internal quality function. For module H, the notified body's approval of the quality system and any surveillance reports must be filed with them. Ask the notified body which records it samples at periodic audits.

Substantial modification register

Each change that could be a substantial modification needs an entry showing the date, the change, the decision on whether it is substantial, and the assessment that followed. Under module B with module C, the Commission's FAQ states that a substantial modification requires a new assessment by the same or a different notified body. Under module H, the approved quality system can cover new or substantially modified products. Record which route applies to each change and attach the assessment outcome before the modified product is released.

What a CRA conformity assessment costs in money and effort

This table compares the cost components of a CRA conformity assessment, who is paid for each, whether it is one-time or recurring, and what pushes it up or down. No fee figures have been published for this work, so use the drivers to structure written quotes that separate notified body fees from preparation work. Article 32(6) requires fees to be reduced for microenterprises and SMEs, so ask about that explicitly.

Cost component	Who is paid and for what	One-time or recurring, and what drives it
Notified body fees for module B or module H	The notified body, for examining the technical design and vulnerability handling processes and issuing the EU-type examination certificate (module B) or approving the quality system (module H)	One-time for the initial assessment. Rises with the number of product types, design complexity and the depth of the review. Module H may cover new products faster if the approved quality system is extended.
Module C production surveillance	The notified body or internal engineering staff, depending on the chosen route, for checking that production conforms to the approved type	Recurring for each production cycle. Rises with release frequency, number of production sites and number of variants shipped.
Periodic vulnerability handling audits under module B	The notified body, for periodic audits of the manufacturer's vulnerability handling processes	Recurring over the support period. Rises with update frequency, the number of products under one process and any findings that need follow-up audits.
Internal engineering time for the technical file	Internal staff or an outside preparation partner, for the Annex VII technical documentation, risk assessment, SBOM and test reports	One-time per product, then recurring upkeep after each change. Rises with the number of products, component count and how often the file is updated.
Quality system build-out for module H	Internal staff or an outside partner, for designing and documenting the quality management system and its evidence trail	Mostly one-time, with ongoing operation after that. Rises when no quality system exists today and when several teams or sites must be covered.
Tooling for evidence	Software vendors and any services that support the work, such as issue tracking, SBOM generation, vulnerability monitoring and documentation control	Recurring licenses or hosting, plus one-time setup. Open-source tools reduce license cost but still need internal or partner time to configure and operate.
Re-assessment after substantial modification	The notified body that assessed the product, or a different notified body, for a new assessment of the modified product	Recurring whenever a substantial modification occurs. Rises with the scope of the change and how many products share the modified component.
Reduced fees for microenterprises and SMEs	Reduction applied to notified body fees under Article 32(6), which requires fees to reflect the specific interests and needs of microenterprises and SMEs, including start-ups	Applies to the fee lines above. Ask the notified body how the reduction is calculated and whether it applies to surveillance and re-assessment as well as the initial assessment.

How self-hosted open-source tools support the route evidence

Whichever route a manufacturer takes under Article 32, the evidence has to be organized, versioned and controlled. The three tools below cover different parts of that job: tracking the route decision, keeping the technical file under version control, and deciding who may edit and approve it. None of them issues a conformity assessment, and each should be checked against what the manufacturer's own assessor expects to see.

Tracking the route decision

CISO Assistant, licensed AGPL-3.0-only, ships with more than 200 frameworks, including ISO 27001, NIST CSF, SOC 2, PCI DSS, NIS2, DORA and GDPR, and can run audits and compliance assessments against them. It can record which route applies to each product (module A, module B with module C, module H, or a certification scheme) and track the status of each supporting assessment. It does not hold a CRA framework by default in the sources supplied for this page, so confirm whether a CRA library is available or must be built. It does not replace the notified body that issues certificates under the route. Check the AGPL-3.0-only terms with your legal team before hosting it as a service for others.

Versioned technical file

XWiki, licensed LGPL-2.1-or-later, keeps every change to a page under version control, recording what changed, when and by whom. Reviewers can compare any two versions and roll back to an earlier one. This suits the technical file and quality manual that a notified body reviews under module B, module C or module H, where the manufacturer must show how a document looked at the time of each assessment. Confirm with your assessor which document versions they will sample, and whether exported PDFs or signed copies must be kept alongside the wiki history. LGPL terms apply to modifications you distribute, so review them before embedding XWiki in a product.

Approval and edit control

BookStack, licensed MIT, assigns abilities through roles, and permissions can be overridden per role at the shelf, book, chapter or page level. A manufacturer can let engineers edit the vulnerability handling procedures while limiting approval of the EU declaration of conformity to a named compliance lead. This separation supports the evidence that quality system changes are controlled, a point notified bodies examine under module H. Test the role configuration with your assessor before relying on it, because the assessor will ask who could have changed a document and who signed it off. The MIT license is permissive, but the approval workflow itself still needs to be documented outside the tool.

Who owns the route decision, the preparation and the certificate

Your organization remains the manufacturer and carries the legal responsibility for conformity. No outside party can classify your product, choose your route or accept the consequences of a wrong decision on your behalf. Internal ownership starts with the classification decision, which determines whether the product is default, important class I, important class II or critical, and therefore which route under Article 32 is open to you. The same team then selects the route and documents why it was chosen.

Classification decision: Record the product's core functionality, the Annex III or Annex IV category it falls under, and the reasoning, using the technical descriptions in the Commission's implementing regulation.
Route selection: Decide between module A, module B with module C, module H or a European cybersecurity certification scheme, and confirm that the conditions for the chosen route are met.
Technical file ownership: Keep the technical documentation current, including the product description, the risk assessment and the support period basis.
Quality system: Operate the internal processes that the chosen module relies on, including production control and vulnerability handling.
Declaration and records: Sign the EU declaration of conformity and retain the documentation for the period the regulation requires.

Confirm the route with your legal counsel and, where relevant, with the notified body before committing to a design.

Where manufacturers fall short on conformity routes and how to close each gap

Most conformity assessment problems under Article 32 start with a route chosen too early or kept too long. The cards below cover the decisions that most often go wrong, from picking module A to planning notified body time. Each one names the check to run and the action that closes the gap.

Module A used without full standards

A class I important product may use internal control under module A only where harmonized standards, common specifications or a certification scheme at the required assurance level were applied in full. Teams often claim module A after applying a few of the relevant standards. Before choosing the route, map every requirement of the applicable standards to a test result or design record, and mark any gap. If any gap remains, plan for a notified body rather than a self-declared route.

Substantial modification treated as routine

A product assessed under module B with module C needs a new assessment when it is substantially modified, and the Commission's FAQ confirms that this may be carried out by the same or a different notified body. Teams often treat a major release as a routine patch and ship it without review. Define in advance which changes count as substantial, record each decision, and route those changes back to the notified body before release.

Quality system not extended to new products

Module H suits manufacturers with many product types or frequent updates, because an approved quality system can be extended to new or substantially modified products through the same notified body. The gap appears when new product lines launch outside the approved scope, or when the quality system covers only the first product. Keep a register of products under the quality system and request scope extensions before each new product or major change enters the market.

Technical file drifting from the shipped product

The technical documentation and the test evidence must describe the product that customers actually receive, including its software version, bill of materials and configuration. Over time, hotfixes, build changes and component swaps can leave the file describing an earlier release. Tie each release to a documented build identifier, regenerate the SBOM and test reports from that build, and have engineering sign off that the file matches the artifact before conformity is declared.

Certificate treated as permanent coverage

Under module B, the notified body examines the manufacturer's vulnerability handling processes and carries out periodic audits of them. A certificate therefore does not cover those processes indefinitely. Organizations that stop running the vulnerability process between audits, or let ownership lapse, can fall out of step with what was assessed. Assign an owner to the process, keep its records current, and prepare for each periodic audit as an ongoing task rather than a one-time event.

Notified body lead time underestimated

Class II and critical products, and class I products that do not meet the full-standards condition, need a notified body before they can be placed on the market. Manufacturers often schedule the assessment as the last step before launch and discover that the notified body's queue and document review take longer than planned. Ask each candidate body for its current intake schedule in writing, and place the assessment on the critical path of the product plan from the start.

Questions buyers ask about CRA conformity routes, cost and outside help

Can most products self-assess under module A?

Yes, most products in scope follow self-assessment under module A, which is internal control carried out by the manufacturer. Article 32 narrows this for important and critical products. A class I important product may use module A only where the harmonized standards, common specifications or certification schemes at the required assurance level were applied in full. Class II and critical products need a notified body. Check your product against the Annex III and Annex IV categories before assuming the default route, because the category sets the route, not the size of the company or the complexity of the code. The Commission FAQs give the Commission's reading of these routes.

When is a notified body mandatory under the Cyber Resilience Act?

A notified body is mandatory for class II important products and for critical products, and for class I important products where the harmonized standards, common specifications or certification schemes are not applied in full. Notified bodies are bodies that Member States notify and that appear in the Commission's NANDO system. Their role is to examine your design and vulnerability handling, and to audit them periodically. Ask a prospective body for its scope of notification and its lead time before committing, because capacity for these assessments varies. Your own team owns the decision on which route applies, and the notified body issues the certificate, not your implementation partner.

How does module H differ from module B with module C?

Module B with module C splits the work into a design examination and ongoing production conformity. The notified body examines the technical design and your vulnerability handling processes, issues an EU-type examination certificate, and you then ensure each product in series conforms to that type through internal production control. Module H is full quality assurance: the notified body assesses your quality system across the design and production of the product. The Commission's FAQ notes that module H may suit manufacturers with many product types or frequent updates, because the same notified body assesses extensions of an approved system to new or substantially modified products. Choose based on how often you release and how many product lines you run.

What does a substantial modification do to an existing certificate?

A substantial modification of a product assessed under module B with module C requires a new assessment, and the Commission's FAQ says this can be carried out by the same notified body or a different one. Under module H, the same notified body can assess extensions of an approved quality system to new or substantially modified products. Your team should define internally what counts as a substantial change for each product line and record that decision in the technical file. Ask the notified body early how it handles changes to the architecture, dependencies and support period, since those are the changes most likely to trigger reassessment.

How much work does a conformity route require from our internal team?

The work falls mostly on your internal team, because the manufacturer owns the controls, the technical file and the declaration. Under module A, your engineers, product security staff and legal or compliance leads must document the risk assessment, the Annex I evidence, the vulnerability handling processes and the support period basis. Notified body routes add examination preparation, responses to findings and periodic audit cooperation. Estimate the internal effort by listing each Annex I requirement, naming an owner and a source of evidence for it, then checking how many of those owners already run the activity today. The effort is recurring, since vulnerability handling and audits continue for the whole support period.

Can an implementation partner prepare the technical file for us?

Yes, an implementation partner can help prepare systems, controls and evidence for the technical file, but it cannot issue the EU declaration, the conformity assessment or any certificate. DeployOpen is a Chainscore Labs company that plans, implements, hardens, documents and supports self-hosted open-source platforms inside your own infrastructure, and it prepares systems and evidence for compliance assessments. It does not issue audit reports, attestations or certifications. Most engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts. Your organization stays responsible for the declaration, the CE marking decision and the choice of route.

What drives the cost of a conformity assessment?

The main cost drivers are the route, the number and complexity of products, how often you release changes, and how much evidence you must produce from scratch. Notified body routes add examination fees, which are one-time for the initial assessment and recur with substantial modifications and periodic audits. Module A adds mainly internal effort and any testing you commission. Ask each notified body for a written quote that separates the initial assessment, re-assessments, periodic audits, and any travel or testing charges. Ask your implementation partner for a fixed-scope quote that lists each deliverable. No fee figure is stated here because none has been published for this regulation in the sources available to this page, so confirm amounts directly with each body.

Do small and medium enterprises get reduced conformity assessment fees?

Yes, Article 32(6) requires conformity assessment fees to take account of the specific interests and needs of microenterprises and SMEs, including start-ups, and to reduce them proportionately. The article does not set a fixed discount, so the reduction depends on each body's fee schedule. Before you engage a body, ask whether it applies a published SME reduction, what evidence it needs to confirm your status, and whether the reduction applies to re-assessments and periodic audits as well as the initial assessment. Confirm your enterprise size under the applicable EU definitions with your advisers.

How DeployOpen prepares systems and evidence for your conformity route

DeployOpen works on the conformity route your product actually needs, whether that is internal control, a notified body review or a certification scheme. We prepare the systems, controls and evidence that your organization and an independent assessor will examine, inside your own infrastructure. We do not issue declarations, reports or certificates; those remain with you and with the notified body or certification body you select.

How we scope

Scope is confirmed with you in writing before work starts, covering which products and which conformity route apply under Article 32.
We confirm the product class and whether harmonized standards or a certification scheme will be applied in full.
The written scope names the evidence each route requires, the systems involved and the deliverables you will receive.

How we build

We set up build, release and vulnerability handling processes so the evidence for your chosen module is produced routinely.
We prepare the test and documentation records a notified body reviews for module B, module C or module H.
We test the controls we deploy and document results so your internal control or notified body review has traceable inputs.

How we hand over

You receive the configured systems, runbooks and evidence repositories, with version history kept in your own tools.
We walk your compliance and engineering staff through the evidence and explain what each record demonstrates to an assessor.
Ownership of every control, declaration and decision stays with your organization, and the independent assessor makes the conformity determination.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer after handover.
A retainer can keep evidence current when a product is substantially modified and needs a new assessment.
Ask us to confirm in the quote which support activities are included and how changes to scope are priced.