Notified Bodies and Accreditation

Notified bodies play a central role in the conformity assessment of products under EU regulation. A Member State designates them and notifies them to the European Commission, usually on the basis of an accreditation. This page explains how notification works, how to find a notified body in the NANDO database, and what role notified bodies play under the CRA.

Contents
  1. Accreditation: the basis for confirming competence
  2. Notified bodies: a role specific to the EU
  3. Regular monitoring and the NANDO database
  4. Notified bodies under the CRA
  5. Why this matters for the single market

Accreditation: the basis for confirming competence

Accreditation formally confirms that a conformity assessment body, such as a testing laboratory or an inspection or certification body, is competent for its tasks. It is based on the ISO/IEC 17000 series of standards. For notified bodies, accreditation is the usual way to demonstrate competence to the notifying authority. Our page on accreditation explains the procedure and the standards in detail.

Notified bodies: a role specific to the EU

A notified body is an organization that an EU Member State has officially designated and notified to the European Commission. Its main task is to assess whether certain products conform with the applicable EU directives and regulations. Where such an assessment is required, it is an indispensable step before the product is placed on the market in the EU single market.

Notified bodies check whether products comply with the relevant EU legislation, including specific safety, health, and environmental requirements. They work in many sectors, including medical devices, machinery, construction products, and personal protective equipment. Their independence and impartiality are essential to the integrity of the conformity assessment process.

A body becomes a notified body through notification. The conformity assessment body applies to the notifying authority of its Member State. The authority checks that the body meets the requirements and notifies it to the Commission and the other Member States through NANDO. If they raise no objections, the body may act as a notified body (under the CRA, see Articles 42 and 43).

Regular monitoring and the NANDO database

The notifying authority of their Member State monitors notified bodies. Where the notification is based on an accreditation, the accreditation body also checks their competence at regular intervals. Accreditation is the usual way to demonstrate competence, but not the only one: a body that cannot provide an accreditation certificate must give the notifying authority other documentary evidence of its competence (see, for example, Article 42(3) of the CRA). These audits ensure that notified bodies continue to meet the required standards and keep their expertise up to date. They cover both technical competence and compliance with the requirements for independence and impartiality.

The European Commission's NANDO information system (New Approach Notified and Designated Organisations) plays a central role here. It is a publicly accessible online database with a current list of all notified bodies in the EU. For each body, NANDO shows the scope of its notification and the legislation it covers. If you are looking for a qualified notified body for the conformity assessment of your products, this is where to start.

Notified bodies under the CRA

The Cyber Resilience Act also relies on notified bodies. Its rules on the notification of conformity assessment bodies (Chapter IV, Articles 35 to 51 of the CRA) have applied since June 11, 2026. Notified bodies are needed mainly for important products of class II, for important products of class I if the manufacturer does not apply harmonized standards in full, and for critical products as long as no European cybersecurity certificate is required. NANDO lists the bodies notified under the CRA. Which procedure applies to your product is explained on our page on CRA conformity assessment.

Why this matters for the single market

Notified bodies and accreditation are a cornerstone of the EU single market. Products placed on the market in one Member State can circulate freely in all other Member States. This supports the free movement of goods and also strengthens consumer trust in the safety and quality of products.

The system also supports the international competitiveness of European companies. Many countries outside the EU recognize the certificates of conformity issued by notified bodies, which makes it easier to export European products.

Choosing a CRA consultant? Here is how to find the right one.

Get the guide

Book a call

Send us your request. Together we will look at where your company stands, which questions are still open, and what the sensible next steps are.

For information on how we process your data, see our privacy policy.

Guide: How to choose the right CRA consultant

CRA consulting offers are hard to compare. One provider delivers only a gap analysis, another also supports the technical implementation, and both call themselves “CRA consultants.” If you ask the wrong questions, you end up paying for services you don't need, or you find out halfway through the project that key expertise is missing.

Our guide shows manufacturers what really matters when choosing a provider, from the expertise you need to the right pricing model and the 20 questions you should ask every provider.

What the guide covers:

  • the seven areas of expertise a complete CRA implementation requires
  • four support models depending on your in-house capacity and expertise
  • 20 specific questions for your next provider meeting
  • a red flag card for spotting warning signs quickly
  • a scoring sheet with rating guidance for a structured comparison of providers

Download it for free

Newsletter

For information on how we process your data, see our privacy policy.

Free templates: CRA reporting process

Prepare your company for the reporting obligations under the Cyber Resilience Act. You get process descriptions and templates tested in practice for:

  • reporting actively exploited vulnerabilities
  • reporting severe incidents
  • the required early warning notifications, notifications, and final reports
  • clear responsibilities, escalation paths, and deadlines

Enter your contact details and we will email you the files.

Newsletter

For information on how we process your data, see our privacy policy.

Free template: Risk assessment according to EN 50742

We use this template in our consulting projects for systematic threat assessment. You get an Excel template with:

  • a structured threat assessment for your machinery
  • a systematic way to determine safety-related security levels (SRSL)
  • documentation of vulnerabilities and protective measures

Enter your contact details and you will receive the template within minutes.

Newsletter

For information on how we process your data, see our privacy policy.

Free template: SBOM

We use this template in our consulting projects to meet the CRA requirements for the software bill of materials.

Enter your contact details and you will receive the template within minutes.

Newsletter

For information on how we process your data, see our privacy policy.

Free template: Vulnerability disclosure policy

We use this template in our consulting projects to meet the CRA requirements for vulnerability handling. You get a Word template with:

  • a structure based on EN 40000-1-3
  • predefined sections for reporting channels, response times, and responsibilities
  • safe harbor clauses for security researchers

Enter your contact details and you will receive the template within minutes.

Newsletter

For information on how we process your data, see our privacy policy.