CRA Conformity Assessment: Module A, B+C, H or Certification

Before a Product with Digital Elements (PDE) can be placed on the EU market under the Cyber Resilience Act (CRA), the manufacturer has to demonstrate that it meets the essential cybersecurity requirements in Annex I. Article 32 sets out the conformity assessment procedures available for doing so, and which of them you may use depends on how your product is classified.

This guide explains the four procedures (internal control, EU-type examination, full quality assurance and European cybersecurity certification), which classes can use each one, when a notified body has to be involved, and what documentation every route requires.

Table of Contents

Free download: our CRA checklist, from scope to CE marking, in one PDF.

1. What Is a Conformity Assessment Under the CRA?

A conformity assessment is the process by which the manufacturer shows that both the product and its own processes meet Annex I: Part I covers the properties of the product, and Part II covers vulnerability handling. In practice, it rests on:

The technical documentation described in Annex VII
The cybersecurity risk assessment required by Article 13
Evidence of secure design, development and production
The vulnerability handling process, including the SBOM and the coordinated vulnerability disclosure policy
The mechanism for distributing security updates
Test reports showing that the requirements are met

Once conformity is demonstrated, the manufacturer draws up the EU declaration of conformity and affixes the CE marking. From 11 December 2027, when the CRA applies in full, a product in scope cannot be placed on the EU market without going through this process.

In Regulus, free for manufacturers: classify your product by its core function, with the exact Annex III or IV point.

2. The Four CRA Conformity Assessment Procedures

Article 32(1) and Annex VIII provide four routes:

Internal control (module A): the manufacturer assesses conformity on its own responsibility, without a third party.
EU-type examination (module B) followed by conformity to type based on internal production control (module C): a notified body examines the technical design, development and vulnerability handling processes and issues an EU-type examination certificate; the manufacturer then ensures production conforms to that type.
Full quality assurance (module H): a notified body assesses and then monitors the manufacturer’s quality system for design, development, testing and vulnerability handling.
A European cybersecurity certification scheme, where one is available and applicable under the Cybersecurity Act, Regulation (EU) 2019/881.

Which routes are open to you depends on your product classification: default, important Class I, important Class II (both in Annex III) or critical (Annex IV).

Generate the technical file and the declaration of conformity

Regulus builds the nine CRA documents in Word from what you know about your product, and marks what is still missing instead of inventing it. Free for manufacturers.

Generate your documents

3. Internal Control (Module A): Who Can Use It

Under internal control, the manufacturer:

Draws up the technical documentation described in Annex VII
Ensures that design, development, production and vulnerability handling deliver compliance with Parts I and II of Annex I
Draws up the EU declaration of conformity
Affixes the CE marking without external review

Market surveillance authorities can ask for the documentation at any time.

3.1 Default products

Products that are not listed in Annex III or Annex IV can always use module A. This covers most products in scope, such as typical connected consumer devices, industrial equipment whose core function is not a listed one, and commercial software. A default product may also choose one of the other procedures voluntarily, but it is not required to.

3.2 Class I products, under one condition

Important products in Class I (for example routers, operating systems, password managers, VPN products or smart home security products) can also use module A, but only if the manufacturer has applied in full harmonised standards, common specifications or a European cybersecurity certification scheme at assurance level at least “substantial”. If these have been applied only in part, or do not exist for the product, Article 32(2) requires modules B+C or module H, with a notified body.

There is one more exception: free and open-source software in Annex III can use module A, whatever its class, provided the technical documentation is made public when the product is placed on the market (Article 32(5)).

4. Third-Party Conformity Assessment: Class II, Critical and Some Class I

A notified body is involved in three situations:

Class I products where harmonised standards, common specifications or a certification scheme have not been applied in full.
Class II products (hypervisors and container runtime systems, firewalls and intrusion detection or prevention systems, tamper-resistant microprocessors and microcontrollers), always. They must use modules B+C, module H, or a European certification scheme at assurance level at least “substantial”. Self-assessment is not available.
Critical products in Annex IV (hardware devices with security boxes, smart meter gateways, smartcards and secure elements). Where a delegated act under Article 8(1) requires it, they must obtain a European cybersecurity certificate at assurance level at least “substantial”. Where no such act applies, they follow the Class II procedures.

4.1 What the Notified Body Examines

Under module B, the notified body examines the technical documentation and supporting evidence, together with specimens of one or more critical parts of the product, and assesses the manufacturer’s vulnerability handling processes. Under module H, it assesses the quality system covering design, development, final inspection and testing, and vulnerability handling, and then carries out surveillance to check that the system is maintained throughout the support period. In both cases it may ask for further evidence or tests.

4.2 When Notified Bodies Are Available

The CRA’s provisions on notification of conformity assessment bodies (Chapter IV) have applied since 11 June 2026, so that bodies can be designated before the Regulation applies in full on 11 December 2027. If your product needs a notified body, plan for it well ahead of that date.

5. Comparison: Conformity Routes by Product Class

Class II and critical products, and Class I products without full use of harmonised standards, need a notified body or a European certification scheme.

Class	Where listed	Available procedures	Notified body?
Default	Not in Annex III or IV	Module A (or, voluntarily, B+C, H or a certification scheme)	No
Important, Class I	Annex III	Module A if harmonised standards, common specifications or a certification scheme at “substantial” level are applied in full; otherwise B+C or H	Only without full application of those standards or schemes
Important, Class II	Annex III	B+C, H, or a European certification scheme at “substantial” level	Yes, or a certification scheme
Critical	Annex IV	European cybersecurity certificate at “substantial” level or higher where a delegated act requires it; otherwise as Class II	Yes, or a certification scheme

6. Documentation Requirements for Conformity Assessment

Whatever the route, the manufacturer draws up the technical documentation before placing the product on the market. Annex VII sets out what it must contain at a minimum:

A general description of the product, its intended purpose and the software versions relevant to compliance, plus the user information required by Annex II
The design, development and production of the product, including the system architecture
The vulnerability handling processes, including the SBOM, the coordinated vulnerability disclosure policy, the contact address for reporting vulnerabilities and the solution for distributing updates securely
The cybersecurity risk assessment under Article 13, showing how the requirements in Part I of Annex I apply
The information used to determine the support period
The harmonised standards, common specifications or certification schemes applied, or the solutions adopted where none were applied
Test reports and a copy of the EU declaration of conformity

The EU declaration of conformity follows the model structure in Annex V: identification of the product, name and address of the manufacturer, references to the standards or certifications used and, where applicable, the notified body, the procedure performed and the certificate issued. It must be available in the languages required by each Member State where the product is sold.

The technical documentation is kept up to date at least during the support period. Together with the declaration of conformity, it must be kept at the disposal of market surveillance authorities for at least 10 years after the product is placed on the market, or for the support period if that is longer.

7. Key Steps of the Conformity Assessment Process

Classify the product: default, Class I, Class II or critical, based on its core functionality
Choose the conformity route allowed for that class
Carry out the cybersecurity risk assessment
Prepare the Annex VII technical documentation
Test and validate against Annex I, Parts I and II
Involve a notified body or certification scheme where the route requires it
Draw up the EU declaration of conformity (Annex V) and affix the CE marking
Keep the documentation up to date and available for 10 years or the support period, whichever is longer

8. Common Mistakes to Avoid

Assuming every important product needs a notified body (Class I can self-assess if standards are applied in full)
Assuming Class I can always self-assess (not without full application of harmonised standards, common specifications or a scheme)
Classifying by components instead of core functionality, or treating any industrial or IoT product as Class II or critical
Incomplete SBOM or missing evidence of vulnerability handling
Not documenting tests or the reasoning behind the support period
Missing or outdated risk assessment

9. How Regulus Helps Manufacturers

Regulus is a free platform for manufacturers that helps you prepare for conformity assessment:

Classification of each product as default, Class I, Class II or critical, with the Annex III or IV reference
A walk-through of the Annex I requirements
The cybersecurity risk assessment
SBOM import and vulnerability tracking, with the Article 14 reporting deadlines
The nine CRA documents in Word, including the technical documentation and the EU declaration of conformity

An expert review is available as a paid option. Regulus does not certify products and is not a notified body. Start by evaluating your product: CRA Applicability Checker

Conclusion

The conformity route follows from the classification. Default products self-assess under module A. Class I products can do the same only by applying harmonised standards, common specifications or a certification scheme in full. Class II products always need a notified body or a certification scheme, and critical products need European certification where a delegated act requires it, or the Class II procedures otherwise. Whatever the route, the Annex VII documentation and the work behind it are the same, so starting early pays off.

For templates and guidance, visit our CRA Resources.