Conformity Assessment Procedures: Modules A, B, C and H

Internal control is the self-assessment route. No notified body is involved, and the manufacturer carries the entire evidentiary burden. Under Module A the manufacturer:

1. Carries out a cybersecurity risk assessment for the product and takes its outcome into account during design, development, production and vulnerability handling.
2. Designs, develops and produces the product in line with the essential requirements in Annex I Part I, and operates the vulnerability-handling requirements in Annex I Part II.
3. Compiles the technical documentation containing the Annex VII elements, including the applicability position for each Annex I Part I(2) requirement with justifications for anything marked not applicable.
4. Takes measures so that series production stays in conformity, accounting for changes in design, in components and in the standards or specifications applied.
5. Draws up the EU Declaration of Conformity under Article 28 and Annex V, under its sole responsibility.
6. Affixes the CE marking under Article 30 before the product is placed on the market. No notified body identification number follows the marking on this route.

Module A is available to default products under Article 32(1). For an Annex III Class I product it is available only where the manufacturer fully applies the relevant harmonised standards, common specifications or a European cybersecurity certification scheme at assurance level at least substantial.

EU type-examination is the design-stage half of the most common third-party route. The manufacturer submits an application to a single notified body of its choice, together with the technical documentation and a specimen or description of the type representative of the production envisaged.

The notified body examines the technical documentation and the evidence supporting the design, and carries out or arranges the examinations and tests needed to establish whether the type meets the essential requirements. Where it does, the body issues an EU type-examination certificate identifying the manufacturer, the conclusions of the examination, the conditions of validity and the data needed to identify the approved type.

Two obligations follow the certificate and are routinely underestimated. The manufacturer must inform the notified body of modifications to the approved type that may affect conformity, since such modifications require additional approval. The notified body, for its part, keeps itself informed of changes in the generally acknowledged state of the art that suggest the approved type may no longer comply.

Module C is the production-stage half that follows Module B. Having obtained the type-examination certificate, the manufacturer declares that the products concerned conform to the approved type described in it and meet the applicable essential requirements.

The manufacturer takes the measures needed so that the production process and its monitoring keep products conforming to the approved type. It then draws up the EU Declaration of Conformity for each product model and affixes the CE marking.

Module B and Module C are quoted together as a pair for this reason: type-examination alone says nothing about the units actually shipped, and conformity to type has no meaning without an approved type to conform to.

Module H approves the manufacturer's quality system rather than an individual product type. It suits portfolios with many variants or frequent releases, where repeated type-examinations would be impractical.

The manufacturer operates an approved quality system covering design, development, production and final product inspection and testing, and submits it to a notified body for assessment. The body audits the system, determines whether it satisfies the requirements, and notifies the manufacturer of its decision. The manufacturer then undertakes to fulfil the obligations arising from the approved system and to keep it adequate and efficient.

Surveillance follows: the notified body carries out periodic audits, may make unannounced visits, and must be informed of intended changes to the quality system. Because a notified body is involved in the production-control phase, the CE marking on this route is followed by that body's four-digit identification number.

Annex VIII describes the procedures; Article 32 decides which are open to a given product:

• Default products may use internal control (Module A), or voluntarily Module B plus Module C, or Module H.
• Annex III Class I important products may use Module A only where the relevant harmonised standards, common specifications or a European cybersecurity certification scheme at level at least substantial are fully applied. Otherwise Module B plus Module C, or Module H, applies.
• Annex III Class II important products always require a third party: Module B plus Module C, Module H, or a European cybersecurity certification scheme at assurance level at least substantial.
• Annex IV critical products are assessed through a European cybersecurity certification scheme where the Commission has required one by delegated act under Article 8(1). Where that condition is not met, the Class II routes apply.

The practical consequence is that classification has to be settled early, because it determines whether a notified body is needed and therefore how much lead time the launch plan must absorb.