CRA conformity assessment and notified bodies: when you need one

Does your Cyber Resilience Act conformity assessment need a notified body?

Most products follow self-assessment under module A, but a notified body is required for class II and critical products and for class I important products where harmonized standards are not applied in full. If you are a product manager, CISO or compliance lead with a deadline of 11 December 2027, start by placing each product in its class under Annex III or Annex IV, then check which route Article 32 attaches to that class. The answer depends on three things: the product's class, whether you apply the harmonized standards, common specifications or certification schemes in full, and whether you rely on a European cybersecurity certificate. Default-category products and class I products that apply the standards in full can usually stay with module A, while free and open-source products in Annex III may also use module A if they publish their technical documentation. The route you choose changes who does the checking, not who is responsible. You remain the manufacturer who owns the EU declaration of conformity and the CE marking. Under module B, a notified body examines your design and vulnerability handling processes, performs or arranges tests and issues an EU-type examination certificate for the period it sets, then audits your vulnerability handling periodically. Under module H, it assesses your full quality system for design and production, and the CE marking then carries its number. A notified body issues certificates only from its own assessment, so a certificate from another body or an ISO 9000 accreditation does not stand in for it. Before you commit, confirm with your candidate body which modules it is notified for, since the Chapter IV notification rules have applied since 11 June 2026. Where you can use a European cybersecurity certificate at assurance level at least substantial, under a scheme specified by delegated act, Article 27(9) removes third-party assessment for the requirements the certificate covers. A delegated act for the EUCC scheme was planned for the fourth quarter of 2026, so confirm its current status with the Commission before you build a plan around it. Ask any body or consultant for a written quote that names the module, the products in scope, the number of product variants and who pays for testing, and check whether the fee reduction under Article 32(6) applies if you are a microenterprise or SME.

Which route fits each product class

The conformity assessment route follows from the product's category and from whether harmonized standards are applied in full. Each card below covers one decision point in that sequence, from default products through critical products and EU certification.

Default products use module A

Products in the default category, which are not listed in Annex III or Annex IV, follow self-assessment under module A. The manufacturer checks conformity itself, prepares technical documentation, issues the EU declaration of conformity and affixes the CE marking, with no notified body involved. Check first that the product does not fall into an Annex III or Annex IV category, because the route changes once it does.

Class I with standards applied in full

Class I important products may also use module A when harmonized standards, common specifications or certification schemes are applied in full. Free and open-source products in Annex III can use module A only if they publish their technical documentation. Confirm each requirement the standards cover and keep a record of how each one was applied.

Class I without full application

If harmonized standards, common specifications or certification schemes were not applied in full, a class I important product must go through a notified body under module B with module C, or under module H. Under module B the notified body examines the design and vulnerability handling processes and issues an EU-type examination certificate. Under module H it assesses the full quality system. Ask each candidate body which of these modules it can perform for your product class.

Class II products need a notified body

Class II important products must use module B with module C, or module H, or a European cybersecurity certification scheme at assurance level at least substantial. Module A is not an option for this class. Plan notified body capacity early, because the route determines the body's scope of review, the periodic audits of vulnerability handling and the validity period of the certificate.

Critical products follow the Article 8 route

Critical products listed in Annex IV must use a European cybersecurity certification scheme required by a delegated act under Article 8(1). Where no such act exists, the class II procedures in Article 32 apply. Check whether a delegated act has been adopted for your category before you commit to a route, since the scheme requirement may change the procedure you follow.

EU certificate can remove third-party assessment

A European cybersecurity certificate at assurance level at least substantial, issued under a scheme specified by delegated act, removes the third-party assessment obligation for the requirements it covers under Article 27(9). Confirm which requirements the certificate covers and whether any gaps remain for your product. The delegated act for the EUCC scheme was planned for the fourth quarter of 2026, so verify its status before relying on it.

What modules B, C and H involve

Module B is the design examination route. A notified body examines the design of the product and the manufacturer's vulnerability handling processes, and performs tests itself or arranges for a laboratory to perform them. If the product passes, the notified body issues an EU-type examination certificate, valid for a period the notified body defines. The module is normally paired with module C, which covers the manufacturer's conformity to the type described in that certificate.

Design examination: The notified body reviews the technical documentation and the product design against the essential requirements in Annex I.
Vulnerability handling review: The notified body assesses whether the Annex I Part II processes are in place and can be run for the support period.
Testing: Tests are performed by the notified body or by a laboratory it engages, and the results go into the examination file.
Certificate validity: The EU-type examination certificate runs for a period the notified body sets, so ask how renewal and re-examination after changes are handled.
Periodic audits: The notified body audits vulnerability handling over time, so budget for recurring surveillance, not only the first examination.

Confirm with the notified body which tests it will perform itself and which it will outsource, and what triggers a new examination after a change to the product.

How the conformity assessment runs from scoping to CE marking

The sequence turns a product classification into a documented, tested and declared conformity position, with a notified body involved only where the route requires one. Each step ends with an output that the next step depends on.

Classify the product against Annexes III and IV
Start by confirming whether the product is default, important class I, important class II or critical. Compare its core functionality with the technical descriptions of each Annex III and Annex IV category, using Commission Implementing Regulation (EU) 2025/2392 as the reference for those descriptions. The manufacturer owns this decision, and it should be written down with the reasoning, because it sets the conformity assessment route for everything that follows. The output is a classification record that names the category and the basis for it.
Confirm which harmonized standards apply in full
For class I important products, check whether the harmonized standards, common specifications or certification schemes that cover the product have been applied in full. Partial application is the point where the route changes to a notified body. Standards references only carry the presumption of conformity once they are published in the Official Journal, so confirm publication status for each standard against the Commission's materials rather than assuming it. The output is a mapping of each Annex I requirement to the standard or method used, with any gaps flagged.
Select the conformity assessment module
Use the classification and the standards mapping to pick the route. Default products and fully standardized class I products generally use module A self-assessment. Class II products and critical products, and class I products without full application, move to module B with module C, module H, or a European cybersecurity certificate where one applies. Confirm the route with the Article 32 text and the Commission FAQs before committing budget. The output is a documented module selection that the manufacturer can defend to a market surveillance authority.
Prepare the technical documentation and risk assessment
Assemble the technical documentation that covers the product description, the cybersecurity risk assessment, the design and development process, the vulnerability handling processes under Annex I Part II, support period decisions and the Annex I requirement evidence. The manufacturer produces this, and the notified body or a market surveillance authority will examine it. Where a microenterprise or small enterprise qualifies, check whether the simplified technical documentation form applies. The output is a complete, versioned file that can be handed to an assessor without reconstruction.
Engage a notified body where the route requires it
Where module B, C or H applies, select a notified body designated for the relevant product category. Check that the body is listed in the Commission's NANDO system, confirm its scope covers the product, and request a written quote based on the documentation and tests you will supply. Ask how fees are calculated, whether reduced fees apply for a microenterprise or SME, and how periodic audits are billed. The output is a signed engagement letter with a defined scope. Only the notified body issues the certificate, so no implementation partner can substitute for this step.
Undergo examination, tests and vulnerability handling audit
Under module B, the notified body examines the design and the vulnerability handling processes, and performs tests itself or through a laboratory it engages. Under module H, it assesses the full quality system for design and production. The manufacturer answers queries, supplies samples or access, and records every finding and corrective action. Expect the examination to produce a list of nonconformities to close before certification. The output is a documented examination record and a set of closed findings.
Receive the certificate and draw up the EU declaration
When the examination is complete, the notified body issues the EU-type examination certificate for the period it defines, or the module H certificate. The manufacturer then draws up the EU declaration of conformity, which the manufacturer signs and keeps with the technical documentation. The declaration must reflect the module used and the notified body's number where one was involved. The output is a valid certificate and a signed declaration that match the product as placed on the market.
Affix CE marking and maintain conformity over time
Affix the CE marking, which for module B and H routes carries the notified body's identification number, and keep the declaration, certificate and technical documentation for the period set out in Annex VIII. Notified bodies carry out periodic audits of vulnerability handling under module B, so schedule those with the body and track any changes that could amount to substantial modification. The output is a CE-marked product, a maintained file and a record of each periodic audit and its outcome.

How to find and check a notified body under the CRA

Start by confirming that the body you are considering is designated for the CRA at all, and then that it is designated for your product category. Chapter IV of the regulation on notified bodies has applied since 11 June 2026. Member States notify conformity assessment bodies to the Commission after their notifying authority has assessed them, and the Commission lists the notified bodies in its NANDO system. Search NANDO, then open the body's entry and read its scope closely. A body may hold authority for some product types and not others, so the designated scope in NANDO, not the body's marketing, decides whether it can issue your certificate. Record the NANDO identification number, the notifying Member State and the date you checked, because the scope can change.

Once a body appears in NANDO with the right CRA scope, ask it for evidence of its competence and impartiality. Request written confirmation that it covers your specific category under Annex III or Annex IV, the modules it offers (module B with module C, or module H), and the cybersecurity testing it performs in-house versus through a subcontracted laboratory. Ask who on its team will examine your design and vulnerability handling processes, how it handles conflicts of interest if it has advised you on the same product, and how it sets fees for microenterprises and SMEs under Article 32(6). Compare these answers against your written scope before signing anything.

Plan around capacity. The Commission's implementation timeline set 11 December 2026 as the milestone for notification of sufficient conformity assessment bodies across Member States, but that is a target, not a guarantee that a body has free capacity for your product in the month you need it. Ask each body for its current intake position, the typical sequence from application to certificate, and what it needs from you before work starts. Keep a written record of these answers so that your procurement and engineering timelines reflect the body's own estimates rather than assumptions.

What third-party assessment costs compared with self-assessment

This table compares the cost components of a notified body route (module B or H) with module A self-assessment, showing who is paid, whether each cost is one-time or recurring, and what drives it up or down. The Commission's 2022 impact assessment estimated an average of EUR 25,000 per product for third-party assessment against EUR 18,400 for self-assessment, so the gap is narrower than the notified body fee alone suggests, and the cost of internal work and preparation applies to both routes.

Cost component	Who is paid	One-time or recurring	What drives it
Notified body certification fees (module B or H, periodic audits)	Notified body	Both: initial assessment is one-time, periodic audits recur	Product class, number of product variants, quality system maturity, size of the vulnerability handling audit
Internal staff time for technical documentation	Your own staff (no external payment)	One-time, then updated with each substantial change	Number of products, documentation completeness, reuse of existing security and design records
Laboratory testing, if outsourced	Accredited or notified laboratory	Usually one-time per tested version, repeated after changes	Which tests the notified body accepts, product complexity, whether harmonized standards are applied in full
Implementation partner preparation work	Implementation partner (fixed-scope engagement)	One-time, with later support as a retainer if needed	Gap between current practice and Annex I, existing evidence, number of product families in scope
Tooling (SBOM, vulnerability management, build and signing)	Tool vendors or open-source maintenance effort	Mostly recurring (licenses, hosting, upkeep)	Choice of open-source or commercial tools, integration with build pipelines, number of components tracked
Fee reductions for microenterprises and SMEs	Notified body reduces fees under Article 32(6)	Applies to the notified body fee	Company size category; notified bodies must also accept the simplified technical documentation form under Article 33(5)

What makes the notified body route cost more or take longer

A notified body route is priced and scheduled around how much the assessor must examine. The drivers below set that workload, and most of them are under the manufacturer's control before the first assessment starts. Ask each prospective notified body how it counts them in its quote.

Product class and product families

The class decides whether a notified body is needed at all, and the number of product families decides how much it must examine. Class II and critical products always require a notified body route, while class I products depend on whether harmonized standards are applied in full. Grouping closely related products into one family, where the design and vulnerability handling are genuinely shared, can reduce the number of separate examinations. Confirm with the assessor how each family is counted before you group anything.

Harmonized standards applied in full

When harmonized standards, common specifications or certification schemes are applied in full, a class I product may stay on module A with no notified body. When they are not, the notified body must examine the gaps, which adds time and fees. Record which standard clauses you applied, which you did not, and why. Ask the assessor which deliverables of standardization request M/606 they accept as current evidence, because the deliverables arrive on different dates.

Technical documentation maturity

Under module B the notified body examines the design of the product, and under module H it assesses the full quality system for design and production. Assessors spend most of their time reconstructing what is missing from documentation that is scattered, inconsistent or undated. Keep one technical file per product family with the risk assessment, architecture, test records and version history linked together. Ask whether the simplified technical documentation form is accepted, since microenterprises and small enterprises are entitled to it.

Vulnerability handling process maturity

Module B includes periodic audits of vulnerability handling, so an immature process generates findings at every audit. Assessors look for a documented intake channel, triage criteria, patch timelines, and records that show each step was followed for real vulnerabilities. A process that exists only on paper will be tested with live examples during the review. Run a tabletop exercise on a past vulnerability before the assessment, and keep the resulting records as evidence.

Number of product variants

Each variant that differs in hardware, firmware, configuration or security-relevant functions may need its own examination or at least a documented justification for being covered by another. Variants multiply test runs, documentation and certificate scope. Map variants to their common security components early, and define which differences are cosmetic. Ask the notified body in writing how it will handle variants and whether a certificate covers a family or each model.

SME status and fee reductions

Article 32(6) requires notified body fees to be reduced proportionately for microenterprises and SMEs, and Article 33(5) requires acceptance of the simplified technical documentation form for microenterprises and small enterprises. Confirm your status against the definitions in the regulation before requesting a quote, and state it in the request. Ask the notified body how the reduction is applied and whether it is reflected in the written quote.

Who owns the assessment, who prepares it, and who certifies

The manufacturer remains legally responsible for conformity under the Cyber Resilience Act, whatever help it buys. Its internal team decides the risk assessment, accepts residual risk, approves the technical documentation, issues the EU declaration of conformity and affixes the CE marking. Those decisions cannot be delegated to a consultant or a notified body.

Controls and risk decisions: the manufacturer defines which Annex I requirements apply, justifies any that do not, and owns the security controls in its products and processes.
Declaration and CE marking: only the manufacturer signs the EU declaration of conformity and affixes the CE marking.
Technical documentation: the manufacturer maintains it and keeps records for the period set in Annex VIII.
Operational ownership: product security staff run vulnerability handling, updates and the support period after release.
Sign-off authority: an accountable executive should approve the scope, the assessment route and any notified body selection.

Check that your internal owners can explain each decision in the documentation without relying on an outside party.

What to check before choosing a notified body or consultant

A notified body issues the EU-type examination certificate for the routes that need one, and a consultant only prepares your file. Checking the body's designation, its coverage and its independence from your preparation work before you sign protects the certificate you depend on.

Confirm the NANDO listing

A notified body must be designated by a Member State and listed in the Commission's NANDO system. Check that the body appears there with CRA scope, not only a general conformity assessment scope, and that the listed activities match the module you need, such as module B with module C or module H. Ask for the NANDO entry reference in writing and record the date you checked it, because designations can change. A certificate from a body without the right listing will not satisfy Article 32.

Match product category coverage

Confirm that the body is designated for the specific product category your product falls into, whether an Annex III class I or class II category or an Annex IV critical category. Ask which Commission Implementing Regulation (EU) 2025/2392 category descriptions the body has assessed against. A body competent for one category may not be competent for another, so a general statement of CRA capability is not enough.

Separate the assessor from the preparer

The notified body must assess your design and vulnerability handling processes independently. If the same firm writes your technical documentation, runs your gap assessment and then sits as the assessor, the independence of the conformity assessment is in doubt. Ask who will prepare your file, who will perform the examination, and how the body documents any conflict-of-interest review before accepting the engagement.

Verify embedded and software experience

Ask for evidence that assessors have examined software and embedded products, including how they test firmware updates, vulnerability handling processes and the support period. Request anonymized examples of similar assessments, the mix of assessor backgrounds and whether testing is done in-house or through a laboratory. Experience with purely hardware or purely financial product certification does not show that the body can judge cybersecurity risk assessments and vulnerability handling.

Compare fee structure and SME reductions

Ask for a fee quote that separates the initial examination, lab testing, periodic audits, certificate reissue and any change assessments. Confirm whether the body applies the proportional fee reduction for microenterprises and SMEs under Article 32(6), and whether it accepts the simplified technical documentation form under Article 33(5). A quote that cannot be broken down into one-time and recurring items makes it hard to compare bodies or budget for the support period.

Ask about certificate validity and audits

Before signing, ask how long the EU-type examination certificate remains valid and what triggers renewal, and how often the body will carry out periodic audits of your vulnerability handling. Ask what happens when you change a product or a component, and whether the body must be informed. Confirm that you will hold the certificate and declarations with the technical documentation for the period Annex VIII requires, which runs to the longer of 10 years or the support period.

Questions buyers ask about CRA conformity assessment

Does every product under the Cyber Resilience Act need a notified body?

No. Most products follow self-assessment under module A, with no notified body involved. A notified body is needed for class II important products and critical products, and for class I important products where the harmonized standards, common specifications or certification schemes are not applied in full. Check the product's category against Annex III and Annex IV first, then confirm with your conformity assessment planning whether your chosen route relies on the full application of harmonized standards. The Commission's FAQ and Article 32 set out the routes, and you should confirm the final classification with a qualified adviser before you commit budget.

How much does a notified body route cost, and what drives the price?

The Commission's 2022 impact assessment (SWD(2022) 282) estimated third-party assessment at an average of EUR 25,000 per product, against EUR 18,400 for self-assessment. That is an early estimate made before the final text and standards existed, so treat it as a planning reference only. The notified body charges for its own review of design, vulnerability handling, testing and periodic audits, and the fee varies with product complexity, the number of variants and the evidence you bring. Ask each body for a written quote that separates the initial examination, testing through any laboratory, certificate maintenance and periodic audits. Microenterprises and SMEs are entitled to proportionately reduced fees under Article 32(6).

How long does it take to confirm a notified body is available?

Chapter IV on notified bodies has applied since 11 June 2026, and the Commission's implementation timeline set 11 December 2026 as the milestone for sufficient bodies to be notified across Member States. Notified bodies are listed in the Commission's NANDO system, so check there whether a body is notified for the CRA and for the specific product category you need. Ask each body for its expected lead time and current workload in writing, because no duration is fixed by the regulation. Plan the route early, since the body must review your technical documentation before you can place the product on the market.

Can a consultant act as the notified body for our CRA assessment?

No. A consultant can help you prepare the technical documentation, the risk assessment, the vulnerability handling processes and the evidence a notified body will examine, but only a body notified under the CRA and listed in NANDO can perform the conformity assessment and issue an EU-type examination certificate under module B or a certificate under module H. Accreditation against an ISO 9000 quality standard does not by itself replace the notified body's involvement for module H. DeployOpen prepares systems, controls and evidence for assessments; it does not issue certificates or reports. Confirm the body's notification status directly in NANDO before signing any engagement.

What does the manufacturer need to supply to a notified body?

The manufacturer owns the conformity assessment and must supply the material the body reviews. Expect to provide the technical documentation, the cybersecurity risk assessment, evidence of how the product meets the Annex I essential requirements, and documented vulnerability handling processes covering the whole support period. Under module B, the body examines design and vulnerability handling and may test the product itself or through a laboratory. Under module H, it assesses the full quality system for design and production. Annex VIII requires you to keep the certificates and declarations with the technical documentation for 10 years after placing on the market or for the support period, whichever is longer. Ask the body for its document checklist before you start.

Can an open-source product self-assess without a notified body?

Yes, in specific cases. Free and open-source products in Annex III that publish their technical documentation may use module A self-assessment with no notified body, as may class I products where harmonized standards are applied in full. Products that do not meet those conditions, including class II and critical products, need a notified body route. Whether a project is in scope at all depends on whether it is placed on the market in a commercial activity, so confirm your role and status against the Commission's guidance before relying on self-assessment. Keep the technical documentation current, since the public documentation must match the product you place on the market.

How harmonized standards and EU certification change the route

Harmonized standards change the route only when they are the right ones and when they are in force. Under Article 27(1), the presumption of conformity applies to harmonized standards whose references have been published in the Official Journal of the European Union. A standard that has been drafted but not cited there gives no presumption, so a manufacturer relying on it must assess conformity against the essential requirements in another way. The Commission's standardization request M/606 asks the European standardization organizations for 41 harmonized standards, with horizontal deliverables due 30 August 2026 or 30 October 2027 and product-specific standards due 30 October 2026, according to the Commission's FAQ. Because the route for class I products depends on whether standards are applied in full, the practical question is which standards cover each Annex I requirement for your product and whether each one has been published. Check the status of each reference against the Official Journal and the Commission's implementation pages before you document your route, and record the version you applied.

EU certification can remove third-party assessment for the requirements it covers. Under Article 27(9), a European cybersecurity certificate at assurance level at least substantial, issued under a scheme specified by delegated act, removes the obligation of third-party assessment for those requirements. Your task is to map which Annex I requirements a certificate would cover and which would still need a notified body or your own module A evidence. The Commission planned a delegated act for the EUCC scheme in the fourth quarter of 2026, but schedules slip, so confirm whether that act has been adopted, which assurance level it specifies and which product categories it reaches before you plan around it. The Commission's implementation page is the natural place to track progress. A certificate that covers only part of your product still leaves the remaining requirements to assess, so ask any certification body or notified body to state in writing which requirements the certificate covers.

How DeployOpen prepares your systems and evidence for assessment

DeployOpen is a Chainscore Labs company that plans, implements and hardens self-hosted open-source platforms inside your own infrastructure. For Cyber Resilience Act conformity assessment, we prepare the systems, controls and evidence that your manufacturer team and the independent assessor or notified body will review, while your organization keeps ownership of its declarations and CE marking decisions.

How we scope

Agree in writing which products, product versions and conformity assessment module the engagement covers before work starts.
Map each Annex I requirement and Part II process to a named system, owner and evidence source in your environment.
Confirm with your notified body or harmonized standards team which technical documentation they expect before we begin.

How we build

Configure build pipelines, SBOM generation, vulnerability tracking and update delivery for the products in scope.
Run security testing of applications, APIs and infrastructure, and record findings against the risk assessment.
Assemble technical documentation, test records and vulnerability handling records in a structure the assessor can trace.

How we hand over

Deliver the documentation set, runbooks and evidence index so your team can keep it current after handover.
Document how each control was implemented, tested and configured, with versions and dates recorded in the evidence.
Provide a walkthrough so your compliance and engineering staff can answer assessor questions on their own systems.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer after the fixed-scope work closes.
Re-check evidence when a product changes, so your team can judge whether a change affects the conformity assessment.
Confirm with your notified body or auditor which findings and reports they need from us, and what they will issue themselves.