Cyber Resilience Act notified body: cost and how to choose

Do you need a notified body for the Cyber Resilience Act, and how do you choose one?

Most products follow module A self-assessment with no notified body, but a notified body is required for class II important products, for critical products, and for some class I important products where harmonized standards, common specifications or certification schemes are not applied in full (Article 32; Commission CRA FAQ 6.1 and 6.2). The answer for your product depends on three things: its category under Annex III or Annex IV, whether you apply the harmonized standards in full once they are cited, and whether the product is a free and open-source product in Annex III that publishes its technical documentation, which can also use self-assessment. Confirm each of these against the product's technical description in Commission Implementing Regulation (EU) 2025/2392 before you accept a customer's demand for third-party evidence. The conformity route is a decision you own. An implementation partner can prepare the technical documentation, test evidence, vulnerability handling records and the EU declaration workflow, but only the notified body issues the EU-type examination certificate under module B or the certificate under module H. If a customer asks for a "CRA certificate" from a vendor or consultant, ask which module applies and who issues the document. Under module B, the notified body also audits your vulnerability handling. Under module H, it assesses your full quality system for design and production, and the CE marking carries its number. Ask each candidate which module they would assess and how they would handle substantial modifications, since a change to a module B product requires a new assessment (Commission CRA FAQ 6.2).

When you select a body, check three things before comparing fees. First, confirm that the body is listed in the Commission's NANDO system and that its notifying authority in a Member State has assessed its competence, because notified bodies are notified by Member States and must be independent of manufacturers and market surveillance authorities (Commission CRA FAQ 6.9). Second, check the timing: Chapter IV on notified bodies has applied since 11 June 2026, the Commission set 11 December 2026 as the milestone for sufficient notified bodies across Member States, and the regulation applies from 11 December 2027 (Article 71(2)). Ask each candidate for its notification status and its capacity for your product type. Third, ask for a written quote tied to a defined scope, and ask how SME fee reductions apply under Article 32(6) if your organization qualifies. Read the Commission CRA implementation page for the current status before you sign.

Module B with C or module H: which fits your product portfolio?

This table compares module B with module C against module H across what the notified body examines, what the certificate covers, how changes are handled and which manufacturers each route suits. Read it by matching your product range and release pattern to a row, then confirm the choice with candidate bodies before committing to a quote.

Comparison point	Module B with module C	Module H
What the notified body examines	The product design and the vulnerability handling processes, with tests performed by the body or through a laboratory it uses (Annex VIII)	The manufacturer's full quality system covering design and production (Article 30(4))
What the certificate or approval covers	An EU-type examination certificate for the examined design, valid for a period the body defines	Approval of the quality system, which then covers the products within its scope
Ongoing oversight	Periodic audits of vulnerability handling by the notified body	Ongoing assessment of the approved quality system by the same notified body
Handling a new version	A substantial modification needs a new assessment by the same or a different notified body (Commission CRA FAQ 6.2)	Extending the approved quality system to new or substantially modified products is assessed by the same notified body (Commission CRA FAQ 6.3)
Fit for a single product or a small range	Usually a closer fit for one product or a few designs with stable architecture, since each design is examined on its own	Less suited to a single product, because the fixed cost of a quality system assessment is spread over few designs
Fit for many product types or frequent updates	Each new design or substantial change may trigger a separate examination, which can repeat effort	Commission CRA FAQ 6.3 says this route may suit manufacturers with many product types or frequent updates
ISO 9000 accreditation	Does not replace the CRA notified body's involvement under module B or C	Does not by itself replace the CRA notified body's involvement under module H (Article 30(4))

What makes the notified body fee go up or down

A notified body prices the assessment by the work it must do, so the fee follows the scope you bring it. The drivers below are the ones that change how many hours an assessor spends, how many tests run and how often the body returns. Ask each candidate body to show how it prices every driver before you compare quotes.

Number of products and variants

Each product, and each variant the body must examine, adds design review, testing and documentation work. A notified body prices by what it assesses, so a broad scope with many variants costs more than one tightly defined product family. Control this by grouping variants that share a design and vulnerability handling process into one scope, and by asking the body whether variants are covered by one certificate or several. Confirm the quote lists the products and variants by name.

Which conformity module applies

Module B with module C involves examination of the design and vulnerability handling processes, plus periodic audits. Module H assesses the full quality system for design and production, which carries a wider review. The module is set by the product's class and by whether harmonized standards are applied in full, so confirm the route before you request quotes. Ask each body to state which module it is quoting and what the scope excludes.

Frequency of substantial modification

A substantial modification to a product assessed under module B with module C requires a new assessment by the same or a different notified body. Each release that counts as substantial therefore reopens part of the assessment and adds fees. Map your planned major releases for the support period and ask whether the quote covers reassessments, at what rate, and whether a module H approval can extend to new products without a separate examination.

Depth of design and vulnerability review

Module B covers the design and the vulnerability handling processes, so the assessor's hours depend on how complete and traceable your evidence is. Thin technical documentation, missing risk assessments or undocumented handling procedures lead to more questions, more samples and more review rounds. Prepare the technical documentation, risk assessment and vulnerability handling evidence before the first assessment, and ask the body how many review rounds the quote includes.

Laboratory testing and sub-contracted tests

A notified body can perform tests itself or through a laboratory. Test scope, sample count and whether a third-party laboratory runs the tests all change the cost, and laboratory fees are often billed separately from the body's assessment fee. Ask whether the quote separates assessment time from laboratory charges, which tests are in scope, and whether you can supply test reports from an existing security testing exercise where the body accepts them.

Microenterprise and SME status

Article 32(6) requires conformity assessment fees to take account of the specific interests and needs of microenterprises and SMEs, including start-ups, and to reduce them proportionately. Your size category therefore affects the fee you should be quoted, not only whether you qualify for relief. Ask each body for its written SME fee policy, the documents it needs to confirm your status, and whether the reduction applies to every module and reassessment.

What a notified body assessment costs and who gets paid

This table separates the cost of a notified body route into the parties paid for each piece of work, whether each cost is one-time or recurring, and what drives it up. The only supplied figures are 2022 Commission estimates, which are averages for planning and not quotes, so use the table to structure your request for a written scope.

Cost component	Who is paid	One-time or recurring	What drives the cost
Notified body conformity assessment fee	The notified body, for examining the design and vulnerability handling processes under module B, or the full quality system under module H	Initial assessment is one-time. Certificate maintenance and surveillance recur	Number of products and variants, module chosen, size of the manufacturer, and frequency of substantial modifications
Laboratory testing commissioned by the notified body	The notified body or the laboratory it uses to perform tests itself or through a laboratory	Mostly one-time per product version, repeated after substantial modification	Product complexity, number of test cases, and whether existing test reports can be reused
Periodic audits of vulnerability handling	The notified body, under module B	Recurring for the life of the certificate	Audit frequency set in the agreed scope, size of the vulnerability handling process, and number of products covered
Internal engineering and compliance time	Your own staff, who prepare design documentation, vulnerability handling evidence and the technical file	One-time for the first assessment, then recurring for updates and reassessment	Maturity of existing secure development and vulnerability processes, and how well evidence is already collected
Tooling for SBOMs and vulnerability scanning	Tool vendors or open-source tool maintainers, plus your team to run and maintain them	Licences and hosting recur. Initial setup is one-time	Number of components, build pipeline complexity, and whether tools run inside your own infrastructure
Implementation partner readiness work	The partner, under a written fixed scope covering gap review, evidence preparation and documentation	Usually one-time for readiness, with optional recurring support	Scope agreed in writing, number of products, and how much evidence already exists
Reassessment after substantial modification	The same or a different notified body, under module B with module C	Recurring whenever a substantial modification occurs	Size of the change, whether the notified body already holds the design evidence, and release frequency
Fee reductions for microenterprises and SMEs	Reduces the fees the notified body charges, under Article 32(6)	Applies to the assessment fees each time they are charged	Company size and status, including start-ups, as taken into account by the notified body

How the path from choosing a body to the EU-type certificate runs

The sequence moves a manufacturer from confirming its conformity route to a notified body's EU-type examination certificate, followed by periodic audits that keep the approval current. Each phase produces a written output that the next phase depends on.

Confirm the conformity assessment route
Before contacting any body, the manufacturer confirms with its own product classification whether it needs a notified body at all. Under the Commission's FAQ, class II and critical products need one, and class I important products need one unless harmonized standards, common specifications or certification schemes are applied in full. The output is a short written route decision, naming the product category, the Annex III or Annex IV entry it falls under and the module the manufacturer expects to use, such as module B with C or module H. Engineering and compliance leads should sign it off so the shortlist is built on a fixed basis.
Shortlist bodies listed for the product category
The manufacturer searches the Commission's NANDO system for notified bodies whose listed scope covers the relevant product category and conformity assessment module. Member State notifying authorities assess each body's competence, and bodies must be independent of the manufacturer and of market surveillance authorities. Ask each candidate to confirm in writing that it has no conflict of interest with your organization or your product supply chain. The output is a shortlist with NANDO entry references, each checked against the category and module in the route decision.
Request a written scope, fee and timeline
The manufacturer sends the same product description and route decision to each shortlisted body and asks for a written proposal. The proposal should state what is examined, which tests the body performs itself and which it subcontracts to a laboratory, the fee structure, and the body's own timeline for each stage. No duration can be taken from this guide, so ask every body for its timeline in writing and compare them on the same assumptions. Where the manufacturer is a microenterprise or SME, ask how Article 32(6) fee reductions are applied. The output is a signed quote and scope letter for one chosen body.
Assemble and submit the technical evidence
The manufacturer submits its technical documentation, design evidence and vulnerability handling records to the chosen body. For module B, this covers the design and the processes the manufacturer uses to handle vulnerabilities across the support period. For module H, it covers the full quality system for design and production. Preparation can be supported by an implementation partner, but the manufacturer owns the content and the body decides what it accepts. The output is a complete submission package with a receipt or acknowledgement from the body that it has been logged for review.
Allow testing by the body or its laboratory
The notified body examines the submission and performs the tests needed to check the product, either itself or through a laboratory it engages. The manufacturer answers queries, supplies test samples and fixes non-conformities the body identifies. Expect a round of findings and remediation before the body can conclude. The output is the body's written assessment report, listing the findings, the manufacturer's corrective actions and the body's final conclusion on conformity.
Receive the EU-type examination certificate
Under module B, when the assessment is positive, the notified body issues an EU-type examination certificate for a validity period it defines. Under module H, the body issues its certificate for the approved quality system, and the CE marking carries the body's identification number. The manufacturer then prepares its EU declaration of conformity and the conformity assessment record. The output is the certificate itself, which the manufacturer keeps with its technical documentation and makes available to market surveillance authorities on request.
Operate periodic audits and reassessment
The notified body carries out periodic audits of the manufacturer's vulnerability handling, and under module H it monitors the quality system over time. A substantial modification of a product assessed under module B with module C requires a new assessment by the same or a different body, so the manufacturer should check modifications against the body's scope before releasing them. Keep the audit schedule and findings log in the same evidence repository as the technical documentation. The output is a continuing record of audit reports, corrective actions and any reassessment decisions.

What triggers a new notified body assessment after a substantial modification

A substantial modification sends a product back to the notified body, so the choice of body shapes how every later change is handled. If the product is assessed under module B combined with module C (type conformity plus internal production control), the Commission's FAQ 6.2 states that a substantial modification requires a new assessment, which may be carried out by the same notified body or a different one. The manufacturer therefore has two live questions from day one: who will reassess the change, and how quickly. Ask each candidate body how it defines a substantial modification in practice, whether it will review changes in advance or only after release, how long it keeps the technical file and assessment records, and what it charges for a reassessment. Reassessment fees are usually quoted separately from the initial assessment, so request both in writing. The answers to these questions belong in your contract, not in an email thread after the first release.

Module H works differently because the notified body approves the manufacturer's quality system for design and production rather than one product. According to FAQ 6.3, that approved system can be extended to new or substantially modified products by the same body, which is why the FAQ says module H may suit manufacturers with many product types or frequent updates. Confirm with the body whether the extension is a documented review of your process changes, a product-specific file review, or both, and whether it adds a new certificate or only an update to the existing approval. This is a practical advantage for portfolios that ship often, but it also ties the quality system to one body's approval scope.

The timing rule in Article 69 connects this to the support period. Products placed on the market before 11 December 2027 fall under the regulation only if they are substantially modified from that date, so a legacy product that is changed after that point enters the full assessment cycle, and its notified body must be ready to assess it. Plan a change log that records each modification against the date and the assessment outcome, and agree with the body which changes it will treat as substantial. Finally, confirm that the body's capacity and its notification status cover the support period you have committed to, because a reassessment needed in a later year depends on the body still being notified under the regulation.

Who does what in a notified body assessment

The manufacturer remains legally responsible for the product under the Cyber Resilience Act. It owns the cybersecurity controls, decides how each Annex I essential requirement is met, and runs the vulnerability handling process for the whole support period. Before any notified body engages, the manufacturer must choose its conformity assessment route, which determines whether a notified body is needed at all. Under the route that involves a notified body, the manufacturer also keeps the technical documentation and signs the EU declaration of conformity.

Control ownership: The manufacturer decides, implements and operates the controls, including the risk assessment that the Annex I requirements are applied against.
Technical documentation: The manufacturer compiles, maintains and keeps available the technical documentation that the notified body reviews.
EU declaration of conformity: The manufacturer draws up and signs the declaration once conformity is demonstrated, and affixes the CE marking.
Vulnerability handling records: The manufacturer keeps the processes and records that show how vulnerabilities are received, assessed and fixed.
Written independence confirmation: The manufacturer should request written confirmation from the notified body that it is independent of the manufacturer and of the party that prepared the evidence.

Before engaging a notified body, confirm that the body is listed for the relevant product category and that its independence is documented in writing.

How to check a notified body before you sign

A notified body issues the EU-type examination certificate your product may depend on, so the checks below should be completed before any fee is paid or scope is agreed. Each card names the document or source you should verify and the question to put to the body in writing.

Confirm the NANDO listing

Before anything else, check that the body appears in the Commission's NANDO system with a notification that covers the Cyber Resilience Act. Notified bodies are assessed by Member State notifying authorities, so a body that is not listed cannot issue the certificate your conformity route needs. Note the notification date and the listed conformity assessment modules, then ask the body to confirm that its listing matches what it is quoting.

Match the category and module

Ask the body to show in its notification that it covers your product category and the conformity module you need. Module B with module C suits a single product design examined in depth, while module H suits a manufacturer with many product types or frequent updates. A body approved for one module may not be approved for the other, so the scope on its certificate or notification should name the route you will follow.

Verify independence

Under Commission CRA FAQ 6.9, notified bodies must be independent of manufacturers and of market surveillance authorities. Ask for a written statement covering ownership, shared directors, and any consultancy work the body or its affiliates have done for your organization or your competitors. A body that also designs or remediates the product it certifies creates a conflict that an assessor or market surveillance authority may challenge later.

Ask about product experience

Request a description of past assessments on products similar to yours, such as embedded firmware, networked devices, or enterprise software with a backend. Ask which staff would perform the technical testing and whether any testing is subcontracted to a laboratory. Confirm that the body can explain how it will assess vulnerability handling processes under module B, since that review is separate from product testing.

Request scope, fees and SME terms

Ask for a written scope that lists deliverables, test activities, the certificate validity period and the audit schedule. Ask how fees are calculated and what is included, such as testing, certificate issuance and periodic audits. Under Article 32(6), fees must take account of the needs of microenterprises and SMEs and be reduced proportionately, so ask in writing whether a reduction applies and what evidence of company size the body requires.

Confirm substantial modification handling

Ask how the body treats a substantial modification after certification. Commission CRA FAQ 6.2 states that a substantial change to a module B and C product requires a new assessment by the same or a different notified body. Ask whether the body would reassess the change, how long that normally takes, whether the change would be scoped as a new assessment or an extension, and whether a later move to another body would require re-testing.

Questions buyers ask before hiring a notified body

Do I need a notified body for my product under the Cyber Resilience Act?

Only some products need one. Most products follow self-assessment under module A, with no notified body involved. A notified body is needed for class I important products where harmonized standards, common specifications or certification schemes are not applied in full, and for class II important products and critical products under Article 32. Whether your product falls into a category depends on its core functionality and the Annex III and Annex IV lists, so confirm the category before you plan the conformity route. Free and open-source products in Annex III that publish their technical documentation may also use module A. The Commission's FAQ 6.1 and 6.2 are the place to check the routing logic against your product.

How much does a CRA notified body assessment cost?

The notified body sets its fee from the scope of the assessment, so no single price applies. The Commission's impact assessment SWD(2022) 282 of 15 September 2022 estimated an average conformity assessment cost of EUR 18,400 per product for self-assessment and EUR 25,000 for third-party assessment, both including one-off and recurrent costs and based on secondary data. Those figures predate the final text and the implementing regulations, so they do not reflect the scope of a current assessment, your product's size, or the number of product variants. Ask each body for a written quote that separates the initial assessment, laboratory testing, periodic audits of vulnerability handling and any reassessment fees.

How long does a notified body conformity assessment take?

The duration depends on the module, the product's complexity and how ready your documentation and processes are when the body starts work. Under module B, the body examines your design and vulnerability handling processes, may run tests itself or through a laboratory, and issues an EU-type examination certificate valid for a period it defines. Under module H, it assesses your full quality system for design and production. Ask the body for its planned steps, the documents it will request, and its queue time before you sign. Also confirm the notification milestone: Chapter IV applies from 11 June 2026, and the Commission's timeline sets 11 December 2026 as the target for sufficient notified bodies across Member States, so check which bodies are listed in NANDO for your product category.

Can we prepare the CRA evidence ourselves before engaging a notified body?

Yes. Your organization owns its controls and its technical documentation, and preparing the evidence in-house is the usual starting point. Before a body reviews the design or quality system, you need the risk assessment, the Annex I Part I and Part II evidence, the vulnerability handling process, test reports and the technical documentation the body will examine. An implementation partner can help prepare systems, controls and evidence, and can run security testing that produces test reports for your file. Confirm with the body which documents it expects in which format, because its requirements decide what counts as complete.

Can an implementation partner replace the notified body?

No. Only a notified body designated under the regulation can carry out the third-party assessment that module B or module H requires. An implementation partner such as DeployOpen can plan, implement, harden and document self-hosted open-source platforms inside your infrastructure, prepare systems and evidence, and support you through an assessment. It does not issue EU-type examination certificates, quality system approvals or CE marking involvement on the body's behalf, and it cannot act as the body's independence check. Keep the roles separate in your contract and your project plan so the body's independence is never in question.

What changes after a substantial modification of a product?

A substantial modification of a product assessed under module B with module C requires a new assessment, carried out by the same notified body or a different one, according to Commission FAQ 6.2. Under module H, the approved quality system can be extended to new or substantially modified products through the same body, which is one reason the Commission says module H may suit manufacturers with frequent updates. Decide early which changes count as substantial, because that decision drives how often you pay for reassessment. Ask the body how it handles reassessment scope and timing, and whether its fees for changes are fixed or quoted per change.

Can a small or medium enterprise get a reduced notified body fee?

Yes. Article 32(6) requires conformity assessment fees to take account of the specific interests and needs of microenterprises and SMEs, including start-ups, and to reduce them proportionately. The regulation does not set a fixed discount, so the reduction depends on the body and on the size of your organization. Ask each body whether it applies an SME reduction, what evidence of size it requires, and how the reduction is applied to periodic audits and reassessments. National support schemes may also be available, so check with your national authority or the Commission's implementation pages.

How DeployOpen works on this

DeployOpen helps manufacturers get ready for the notified body conformity assessment route that the Cyber Resilience Act requires for some products. We prepare the systems, technical documentation and evidence that an independent notified body reviews, but we do not select the body, issue certificates or perform the assessment ourselves.

How we scope

Engagements are fixed-scope, with the product, conformity module and deliverables agreed in writing before work starts.
The written scope confirms whether module B with C or module H fits your product range, release cadence and quality system.
Scope also states which notified body requirements we prepare for and which decisions remain with your organization and the body.

How we build

We prepare the quality management and vulnerability handling records a notified body samples under module B or module H.
We set up evidence for each release, including change records that show whether a modification may be substantial.
We arrange the technical documentation and test records so the notified body can trace each claim to a system or process.

How we hand over

You receive a documented evidence map linking each requirement in the written scope to its supporting records.
Handover includes a checklist of questions to put to candidate notified bodies, including NANDO listing and independence.
We walk your team through the pack so your staff can answer the notified body directly after handover.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after the initial scope is delivered.
A retainer can keep evidence current when a product is substantially modified and needs reassessment by a notified body.
Every quote follows from the written scope, so ask us to confirm which recurring tasks sit inside the retainer and which do not.

Choosing a notified body for the Cyber Resilience Act