Conformity Assessment

Conformity assessment is the structured process through which a manufacturer demonstrates to itself and to regulators that its product complies with the applicable legal requirements - in the CRA's case, the Annex I essential cybersecurity requirements. The CRA defines multiple conformity assessment routes in Article 32, ranging from manufacturer self-assessment to mandatory third-party evaluation by an accredited notified body. The chosen route must be documented in technical documentation and the outcome is a signed EU Declaration of Conformity. Products that pass conformity assessment and have technical documentation in order may bear a CE mark.

The internal production control module (Module A) allows manufacturers to self-assess conformity without a third party. This route is available to:

• Default class products - all products not listed in Annex III.
• Important Class I products - only when a harmonised European standard covering the CRA requirements is applied.

1. Perform and document security testing against the essential requirements.
2. Maintain technical documentation.
3. Establish quality management procedures for ongoing conformity.
4. Sign the EU Declaration of Conformity.
5. Affix the CE mark.

Self-assessment does not mean self-certification without evidence - the manufacturer must hold substantive technical documentation and be able to produce it on request.

Important Class II products require mandatory third-party conformity assessment. Manufacturers must engage an EU-notified body - an accredited independent organisation designated by a national authority - to assess compliance. Two third-party module options are available:

• Module B+C (EU Type-Examination + Production conformity): The notified body examines the product design and a representative unit; the manufacturer self-certifies production conformity.
• Module H (Full Quality Assurance): The notified body assesses the manufacturer's entire quality management system.

For Critical products (Annex IV), assessment must be based on a European Cybersecurity Certification Scheme where one exists. Given limited notified body capacity, manufacturers should begin engagement at least 12–18 months before the December 2027 application date.

Manufacturers preparing for conformity assessment should compile:

• Product description and classification rationale - why the product is classified at its assigned level.
• Threat model and risk assessment - documented analysis of the attack surface and security risks.
• Security architecture documentation - how Part I requirements are met (cryptography, access control, update mechanism).
• SBOM - full component inventory.
• Penetration test reports - independent testing results.
• CVD policy and advisory archive - evidence of Part II process compliance.
• Patch history - record of vulnerabilities identified and remediated.
• Declaration of Conformity - signed by an authorised representative.

Notified bodies will assess the completeness and accuracy of this documentation package.