Artifact GuideEU

Cyber Resilience Act conformity assessment and CE marking

A guide based on official sources for manufacturers deciding how to demonstrate CRA conformity before placing products with digital elements on the EU market.

Use it to align product classification, standards coverage, technical documentation, the EU declaration of conformity, and CE marking controls.

Back to main artifact Review sources

Author

Sorena AI

Published

Mar 4, 2026

Updated

Jul 31, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published Mar 4, 2026

Updated Jul 31, 2026

Overview

Under the Cyber Resilience Act, CE marking is the visible outcome of a completed . The route is not chosen by convenience alone: it depends on the product category, the coverage of harmonised standards or other recognised conformity bases, and whether the manufacturer can evidence both product cybersecurity requirements and vulnerability-handling processes. These manufacturer conformity and marking duties generally apply to products first placed on the EU market from 11 December 2027. A product placed on the market earlier generally enters the remaining CRA requirements only if it undergoes a substantial modification from that date, although Article 14 reporting starts separately on 11 September 2026 for in-scope products.

Section 1

Start with the product category and core functionality

Classify the product before choosing a route. The CRA separates products with digital elements into the default category, important products of class I, important products of class II, and critical products. The Commission FAQ explains that important or critical classification turns on the product's core functionality. An important or critical component inside a larger product does not determine the finished product's category by itself. Use Annexes III and IV together with Commission Implementing Regulation (EU) 2025/2392, which supplies the binding technical descriptions for those categories.

This distinction matters for finished-product systems. Integrating a browser, secure element, operating system component, or other listed component does not automatically pull the whole finished product into that component's conformity route. The finished product still needs its own classification and cybersecurity risk assessment.

Record the intended purpose, reasonably foreseeable use, deployment context, and product functions used for classification.
Map the product against Annex III important-product categories and Annex IV critical-product categories before deciding whether third-party assessment is required.
Use technical category descriptions and official guidance where available; avoid relying only on marketing names such as router, gateway, platform, agent, or app.
Keep the classification rationale in the technical documentation so the selected route can be defended to a notified body or market surveillance authority.

Section 2

Apply Article 32 route logic

Article 32 recognises internal control under Module A, EU-type examination under Module B followed by conformity to type under Module C, full quality assurance under Module H, and European cybersecurity certification schemes that the Commission has specified for CRA conformity under Article 27(9).

Default-category products can use Module A. Important class I products can use Module A only where the manufacturer applies the relevant harmonised standards or common specifications, or an applicable specified European cybersecurity certification scheme at assurance level at least substantial, for the relevant requirements. If those instruments do not exist, are only partly applied, or do not cover the relevant requirements, the manufacturer needs Module B plus C or Module H for those requirements.

Module A: manufacturer draws up technical documentation, verifies conformity, affixes CE marking, and declares compliance on its own responsibility without notified body participation.
Module B plus C: a notified body examines design, development, technical documentation, supporting evidence, specimens, and vulnerability-handling processes; the manufacturer then controls conformity to the approved type in production.
Module H: a notified body assesses and surveils a full quality system covering design, development, production, final inspection, testing, and product cybersecurity controls.
Important class II products require Module B plus C, Module H, or an available and applicable Article 27(9) certification scheme at assurance level at least substantial. As an exception, a manufacturer of a class I or class II Annex III product that qualifies as free and open-source software may use any Article 32(1) route, including Module A, if it makes the Article 31 technical documentation public when placing the product on the market.
Critical products depend first on whether a European cybersecurity certification scheme has been made mandatory under Article 8; otherwise, the Article 32 class II routes are the fallback route set.

Section 3

Check whether certification covers the CRA requirements

A European cybersecurity certificate replaces the relevant CRA conformity-assessment steps only when the Commission has specified the scheme under Article 27(9). The specification identifies which Annex I requirements the scheme can cover, and the certificate must meet the stated assurance level and coverage conditions.

Until an applicable scheme has been specified for the product and requirements in question, use Module A where Article 32 permits self-assessment or use Module B plus C or Module H where third-party assessment is required. Record the scheme, certificate scope, assurance level, covered requirements, validity, and any remaining CRA requirements rather than treating certification as a blanket exemption.

Check the current Article 27(9) delegated acts, not only whether the product already holds an EU cybersecurity certificate.
Map the certificate coverage to the exact Annex I requirements and assess every uncovered requirement through the selected CRA route.
For critical products, check whether Article 8(1) conditions have made a specified certification scheme mandatory before applying the Article 32(4) fallback.

Section 4

Build a traceable technical file

Annex VII sets the minimum technical documentation content. It is the file that lets the manufacturer, a notified body, or a market surveillance authority assess conformity against Annex I product requirements and Annex I vulnerability-handling requirements.

The record should connect classification, risk assessment, requirements, standards coverage, tests, software versions, vulnerability processes, support-period reasoning, and the . Where standards, common specifications, or certification schemes are not used in full, the file needs to identify what was applied and describe the alternative solutions used to meet the essential requirements.

Product description: intended purpose, relevant software versions, hardware or architecture information where applicable, and user instructions.
Lifecycle processes: design, development, production, maintenance, and vulnerability handling, including how third-party and open-source components are controlled.
Cybersecurity risk assessment: assumptions, threat model, intended and foreseeable use, risk treatment, tests, and justifications for any Annex I requirement treated as not applicable.
Standards and conformity basis: harmonised standards, common specifications, certification schemes, or other technical specifications applied in full or in part.
Evidence package: test reports, SBOM where applicable, support-period rationale, declaration copy, version history, and change-control records for modifications that may affect conformity.

Recommended next step

Turn CRA CE marking work into an operational assessment

Assessment Autopilot can turn Cyber Resilience Act conformity assessment and CE marking work into route decisions, evidence requests, review checkpoints, and release controls in Sorena.

Assessment workflow

Open Assessment Autopilot for CRA CE marking

Turn the selected CRA conformity route into owners, technical-file evidence, declaration checks, and CE marking release controls.

Explore next step

Talk to Sorena

Talk through CRA CE marking implementation

Review product classification, standards coverage, notified-body needs, and evidence gaps before launch.

Explore next step

Section 5

Treat notified-body review as product and process review

For Module B plus C, Annex VIII requires the notified body to assess the product's technical design and development, supporting evidence, specimens of critical parts, and the manufacturer's vulnerability-handling processes.

For Module H, the notified body assesses the full quality system and checks whether the manufacturer can consistently identify applicable CRA requirements, perform the necessary examinations, and keep products compliant through design and production. That makes change control, release governance, and vulnerability-management evidence central to the assessment.

Maintain a route decision record that shows the category, route, applicable standards or schemes, and reasons why third-party assessment is or is not required.
Trace Annex I requirements to design controls, security tests, vulnerability-handling procedures, and release gates.
Escalate product changes that may affect conformity, the approved type, or certificate validity before release.
Keep evidence that production units, software releases, and updates remain aligned with the assessed design and documented controls.

Section 6

Issue the declaration before relying on CE marking

After a positive , the manufacturer draws up the under Article 28 and affixes CE marking under Articles 29 and 30. The declaration is the manufacturer's responsibility statement that the product with digital elements complies with the CRA.

The CRA allows either the full declaration following Annex V or a simplified declaration following Annex VI that gives the internet address for the full declaration. Where several EU harmonisation acts require an EU declaration for the same product, Article 28 requires a single declaration covering the applicable acts.

Use Annex V content: product identification, manufacturer details, object of the declaration, statement of sole responsibility, applicable Union law, standards or specifications used, notified body details where applicable, and signature.
Keep the declaration and technical documentation available to national authorities for ten years after placing on the market or for the support period, whichever is longer.
Provide the declaration in the language or languages required by the Member State where the product is placed or made available on the market.
Do not sign the declaration or apply CE marking until the selected conformity route has produced a positive result.

Section 7

Control where and how CE marking appears

CRA CE marking must be visible, legible, and indelible. For software products, Article 30 allows CE marking either on the or on the website accompanying the software product, provided the relevant section is easily and directly accessible to consumers.

Article 30 requires the notified body's identification number to follow the CE marking only where that body is involved through full quality assurance under Module H. Module B plus C uses a notified body for EU-type examination, but does not require that body's number next to the CRA CE marking. Market surveillance authorities can treat a missing Module H number, wrongly affixed marking, or unsupported marking as formal non-compliance and require corrective action.

Affix CE marking to the product. Use the packaging and accompanying EU declaration only where product marking is impossible or unwarranted because of the product's nature; for software, use the declaration or an easily and directly accessible section of the accompanying website.
Check visibility, legibility, and permanence. The CRA permits a height below 5 mm when the product's nature requires it, provided the marking remains visible and legible.
Add the notified body's identification number after the CE marking for Module H; do not add it merely because Module B plus C involved a notified body in EU-type examination.
Keep screenshots, artwork approvals, declaration versions, product labels, and release records showing the CE marking used for each placed-on-market version.

Primary sources

References and citations

Blue Guide 2022 on the implementation of EU product rules

ec.europa.eu

Referenced sections

Supports cross-cutting EU product-law practice for CE marking, declarations of conformity, technical documentation, and conformity assessment concepts.

"The CE marking is a key indicator"

Commission Implementing Regulation (EU) 2025/2392

data.europa.eu

Referenced sections

Provides the binding technical descriptions used with CRA Annexes III and IV to determine whether a product has the core functionality of an important or critical product category.

European Commission - Cyber Resilience Act conformity assessment

digital-strategy.ec.europa.eu

Referenced sections

Confirms the current implementation position for product categories, notified bodies, and certification routes, including that the Commission must specify when a European cybersecurity certification scheme can replace notified-body participation.

European Commission FAQs on the CRA implementation, updated 2 July 2026

ec.europa.eu

Referenced sections

Supports practical interpretations of important and critical product classification, Module A, Module B plus C, Module H, technical documentation, declarations of conformity, CE marking, notified bodies, and transition treatment.

"The conformity assessment is a legal procedure"

Regulation (EU) 2024/2847, Cyber Resilience Act

data.europa.eu

Referenced sections

Supports the CRA route logic in Article 32, EU declaration rules in Article 28, CE marking rules in Articles 29 and 30, and technical documentation requirements in Article 31 and Annex VII.