Cyber Resilience Act conformity assessment and CE marking

Classify the product before choosing a route. The CRA separates products with digital elements into the default category, important products of class I, important products of class II, and critical products. Commission FAQ grounding explains that important or critical classification turns on the product's core functionality, not merely on the presence of an important or critical component inside a larger product.

This distinction matters for finished-product systems. Integrating a browser, secure element, operating system component, or other listed component does not automatically pull the whole finished product into that component's conformity route. The finished product still needs its own classification and cybersecurity risk assessment.

Article 32 recognises internal control under Module A, EU-type examination under Module B followed by conformity to type under Module C, full quality assurance under Module H, and qualifying European cybersecurity certification schemes where the CRA makes them available for that purpose.

Default-category products can use Module A. Important class I products can use Module A only where the relevant harmonised standards, common specifications, or European cybersecurity certification schemes are applied for the relevant requirements. Where those instruments are missing, only partly applied, or do not cover the relevant requirements, the manufacturer needs Module B plus C or Module H for those requirements.

Annex VII sets the minimum technical documentation content. It is the file that lets the manufacturer, a notified body, or a market surveillance authority assess conformity against Annex I product requirements and Annex I vulnerability-handling requirements.

The file should connect classification, risk assessment, requirements, standards coverage, tests, software versions, vulnerability processes, support-period reasoning, and the EU declaration of conformity. Where standards, common specifications, or certification schemes are not used in full, the file needs to identify what was applied and describe the alternative solutions used to meet the essential requirements.

For Module B plus C, the notified body does more than read a binder. Annex VIII expects assessment of the technical design and development of the product, supporting evidence, specimens of critical parts, and the manufacturer's vulnerability-handling processes.

For Module H, the notified body assesses the full quality system and checks whether the manufacturer can consistently identify applicable CRA requirements, perform the necessary examinations, and keep products compliant through design and production. That makes change control, release governance, and vulnerability-management evidence central to the assessment.

After a positive conformity assessment, the manufacturer draws up the EU declaration of conformity under Article 28 and affixes CE marking under Articles 29 and 30. The declaration is the manufacturer's responsibility statement that the product with digital elements complies with the CRA.

The CRA allows either the full declaration following Annex V or a simplified declaration following Annex VI that gives the internet address for the full declaration. Where several EU harmonisation acts require an EU declaration for the same product, Article 28 requires a single declaration covering the applicable acts.

CRA CE marking must be visible, legible, and indelible. For software products, Article 30 allows CE marking either on the EU declaration of conformity or on the website accompanying the software product, provided the relevant section is easily and directly accessible to consumers.

If a notified body is involved in the conformity assessment route, Article 30 requires its identification number to appear after the CE marking. Market surveillance authorities can treat missing, wrongly affixed, or unsupported CE marking as formal non-compliance and require corrective action.