Before a product can carry the CE mark under the CRA, its manufacturer must show that it meets the essential requirements. There are four routes.
Which routes are open depends on the product class.
Module A
The manufacturer checks conformity and draws up the technical documentation, without a notified body.
Modules B and C
A notified body examines the design. The manufacturer makes sure production conforms to the approved type.
Module H
A notified body approves and monitors the quality system for design, production and vulnerability handling.
Certification
A certificate under a European scheme such as EUCC, at assurance level substantial or higher.
Step 1
Scope and product class decide which routes are open.
Step 2
Risk assessment, security by design and vulnerability handling.
Step 3
Technical documentation as described in Annex VII.
Step 4
Conformity assessment, EU declaration of conformity and CE marking.
The rules for designating notified bodies apply since 11 June 2026. Book capacity early if your product needs one.
The technical documentation and the declaration of conformity must be kept for at least ten years after the product is placed on the market, or for the support period if that is longer.
National market surveillance authorities check products on the market and can request documentation, including the SBOM.
Breaches of the essential requirements and of the manufacturer obligations can be fined up to 15 million euros or 2.5 percent of worldwide annual turnover, whichever is higher.
As of October 2026. These guides explain the regulation in plain language and are not legal advice.
We prepare the technical documentation and the conformity assessment, and support you with the notified body.
Tell us about your product and the rule you are facing. You talk to an engineer from the first call.
Cybersecurity consulting and the AITIGRITY platform for connected products and industrial systems.
