EU Cyber Resilience Act, CRA Product Security and CE Marking Conformity Assessment and CE Marking

Article 32 provides the main routes. Default products can use internal control under Module A. Important class I products can stay on that path only when harmonised standards, common specifications, or an appropriate certification scheme are fully applied for the relevant requirements.

Important class II and critical products move into stronger routes. That usually means Module B plus C or Module H, with notified body involvement unless a specific certification route later applies.

Notified body review is not a paperwork exercise. Annex VIII expects a technical design and development review, supporting evidence, risk analysis, and an assessment of the vulnerability handling process against Annex I Part II.

Weak traceability between requirements, design choices, and test results is one of the fastest ways to create delay.

Once conformity is demonstrated, the manufacturer draws up the EU declaration of conformity under Article 28 and then affixes the CE marking under Article 30.

For software products, the CE marking may be placed on the declaration of conformity or on the website accompanying the software product, provided the relevant section of the site is easily and directly accessible to consumers.

Chapter IV on notification of conformity assessment bodies applies from 11 June 2026. That matters for planning notified body capacity and documentation readiness before the main CRA date.

The Commission FAQ also notes that important and critical product categories received technical descriptions through Implementing Regulation (EU) 2025/2392, so category interpretation should be based on those descriptions and not only on plain language labels.