CRA Conformity Assessment Procedures

CRA conformity assessment is the procedure manufacturers use to show that a product with digital elements meets the cybersecurity requirements of the Cyber Resilience Act. It takes place before the product is placed on the market. The CRA offers four routes: module A as pure self-assessment, module B+C and module H with a notified body, and a European cybersecurity certificate. Which route you may use depends on the product class and on the status of harmonized standards.

The choice of procedure determines how much effort, time, and money lies between your product and the CE marking. Module A is fast and has no external costs. Module B+C and module H involve a notified body, with type examination, audits, and ongoing surveillance. Every route ends with the EU declaration of conformity, but the processes, depth of evidence, and costs differ considerably.

You cannot choose freely. Whether a module is allowed for your product depends on its class and on whether you apply harmonized standards in full. The Cyber Resilience Act (Regulation (EU) 2024/2847), or CRA, sets this framework. This page explains the four modules, shows which procedure applies to which product class, and describes the role of harmonized standards and the EN 40000 series.

Contents

1. What CRA conformity assessment is
2. The four conformity assessment modules
   1. Module A: internal control
   2. Module B+C: EU-type examination plus internal production control
   3. Module H: full quality assurance
   4. European cybersecurity certificate (EUCC)
3. Choosing the procedure by product class
4. Harmonized standards and the presumption of conformity
5. Standards for implementing the CRA
6. When you must involve a notified body
7. Combined products

What CRA conformity assessment is

Conformity assessment is an obligation of the manufacturer before placing a product on the market. It demonstrates that a product with digital elements meets the essential cybersecurity requirements in Annex I. This covers two levels: the product requirements in Part I and the requirements for the vulnerability handling processes the manufacturer has put in place in Part II. A successful assessment leads to the EU declaration of conformity, the CE marking, and free access to the EU market.

Conformity assessment does not stand alone. It is part of the wider obligations of manufacturers under the CRA. These include in particular the cybersecurity risk assessment across the lifecycle, the technical documentation under Annex VII, the defined support period, and vulnerability handling.

The four conformity assessment modules

Article 32 of the CRA lists the four permitted procedures and refers to Annex VIII for the details. The following sections summarize their main features.

Module A: internal control

Module A is pure self-assessment. You draw up the technical documentation and demonstrate on your own responsibility that the product conforms with Annex I, Part I (product) and Part II (processes). You then affix the CE marking and issue the EU declaration of conformity. No notified body is involved.

In practice, module A is the fastest and least expensive procedure. It does require that you can justify and document conformity properly in-house. You keep the EU declaration of conformity and the technical documentation at the disposal of the national authorities.

Module B+C: EU-type examination plus internal production control

Module B+C is a two-stage procedure. In module B, a notified body examines the technical design and development of the product and the vulnerability handling processes. It examines the technical documentation and specimens of one or more critical parts of the product. If the type meets the essential cybersecurity requirements, the notified body issues an EU-type examination certificate.

In module C, you confirm on your own responsibility that production matches the examined type, and you carry out internal production control. Module B+C suits manufacturers that want a clearly defined product assessed by a third party without having their entire quality assurance system audited.

Module H: full quality assurance

Module H bases the proof of conformity on an approved quality system that systematically covers design, development, final product inspection and testing, and vulnerability handling. A notified body assesses the system, approves it, and keeps it under surveillance. The assessment covers quality objectives, technical specifications, control and verification techniques, and quality records.

Module H pays off for manufacturers with established development and quality processes or a broad product family. Instead of having individual types examined, one approved system covers several product lines. The effort to set up and maintain the system is, however, much higher than for a one-time type examination.

European cybersecurity certificate (EUCC)

The fourth route is a European cybersecurity certificate under a scheme adopted pursuant to the Cybersecurity Act (Regulation (EU) 2019/881). The best-known example is the EUCC scheme, which builds on the Common Criteria (ISO/IEC 15408).

For the critical products listed in Annex IV, a European cybersecurity certificate becomes the primary route once two conditions are met. The Commission must specify by delegated act that a certificate at assurance level at least “substantial” is required, and a suitable scheme must be available. A certificate at this level can also replace the obligation of a third-party conformity assessment for important products.

Choosing the procedure by product class

Which of the four modules you may use depends on the CRA product class of your product. Commission Implementing Regulation (EU) 2025/2392 sets out the technical description of these classes.

For default products, all modules are open, including module A. The EUCC route, however, requires that a suitable scheme is available and applicable to the product category.

Important products of class I can use module A if you apply in full a harmonized standard, common specifications, or a European cybersecurity certification scheme at level “substantial” or higher. If you do not apply them in full, or if they do not exist yet, you must switch to module B+C or module H.

Important products of class II have no self-assessment route. Module B+C, module H, or a European cybersecurity certificate is mandatory.

For critical products under Annex IV, the relevant EU scheme is the primary route. As long as it is not available, the same procedures apply as for important products of class II.

Product class	Permitted modules	Module A allowed?	Notified body?
Default products	A, B+C, H, EUCC	Yes	Only for B+C or H
Important products, class I	A (if a harmonized standard is applied in full), otherwise B+C or H	Conditionally	If no harmonized standard is applied in full
Important products, class II	B+C, H, or EUCC (at least “substantial”)	No	Yes, in every case (except EUCC)
Critical products	EU scheme (e.g., EUCC), otherwise B+C or H	No	For B+C or H

Harmonized standards and the presumption of conformity

Some harmonized standards have their references published in the Official Journal of the European Union. If a product conforms with such standards, or parts of them, it is presumed to meet the essential cybersecurity requirements in Annex I that those standards cover. The presumption only applies as far as the standard covers the requirement. The scope of the standard must match the scope of the Annex I requirement in question.

For important products of class I, the presumption has a second consequence that concerns the procedure. If you apply a relevant harmonized standard in full, you may demonstrate conformity under module A. Otherwise, module B+C or module H with a notified body applies. As of October 2026, no harmonized standard under the CRA has been published in the Official Journal. As long as this remains the case, the presumption has no effect in practice, and most important products of class I in fact also need a notified body.

Standards for implementing the CRA

The harmonized standards for the CRA are being developed in several steps. Under the Commission's standardization request (M/606), horizontal standards and vertical product standards are planned that together should cover the essential cybersecurity requirements in Annex I. CEN and CENELEC report on the request and the committees working on it, including CEN-CLC/JTC 13, in their news item on the accepted CRA standardization request. ETSI publishes its draft CRA standards in an open area.

The horizontal basis is the EN 40000 series. It has four parts:

• vocabulary (EN 40000-1-1)
• principles for cyber resilience (EN 40000-1-2)
• vulnerability handling (EN 40000-1-3)
• generic security requirements (EN 40000-1-4)

Two vertical series are in progress:

• For IT and consumer products, the ETSI EN 304 6xx series is being developed as a family of product-specific standards.
• For operational technology (OT), the EN 50770-x series is in progress.

Both series are to specify the horizontal requirements for their scope.

For consumer IoT, ETSI EN 303 645 already exists as a complementary standard but is not harmonized under the CRA. Its content can help meet Annex I obligations, but without a listing under the CRA it does not give a formal presumption of conformity.

From the industrial side, the IEC 62443 series comes into play. In practice, manufacturers often use it as the basis for meeting the Annex I requirements. The reason is its coverage: the development process (IEC 62443-4-1), components (IEC 62443-4-2), and systems (IEC 62443-3-3). It is not yet settled whether the series will be listed as a harmonized standard under the CRA and so give a formal presumption of conformity.

For more background, see our article on IEC 62443 as a basis for CRA compliance and our overview of ETSI draft standards for the CRA.

When you must involve a notified body

You must involve a notified body wherever module A is not allowed or where you deliberately choose module B+C or module H. Mandatory cases are:

• Important products of class II in all cases, unless you use a European cybersecurity certificate at assurance level at least “substantial”.
• Important products of class I, if you do not apply in full a harmonized standard, common specification, or suitable cybersecurity certificate.
• Critical products under Annex IV, if no European scheme is available.

The tasks of the notified body depend on the module. In module B, it examines the technical design, the vulnerability handling processes, and specimens of critical parts of the product. If the result is positive, it issues the EU-type examination certificate. In module H, it assesses your quality system, approves it, and keeps it under surveillance, including periodic audits and access to your sites.

Combined products

Products with digital elements are rarely built in one piece. An end product usually contains components that are themselves products with digital elements. The CRA requires a separate conformity assessment for each such product. If you integrate a component into your product, you can rely on its declaration of conformity, but you must also assess the end product as a whole.

An example: a smart home router is an important product of class I, because routers are listed in Annex III, class I. The Wi-Fi chipset inside it is a physical network interface, so it is a class I product in its own right. That is Annex III, class I, point 10, as described in Implementing Regulation (EU) 2025/2392. The chipset manufacturer assesses its own product and provides the declaration of conformity for it. The router manufacturer assesses the end product, including firmware, configuration options, and vulnerability handling.