Find the exact question, open the source answer card, and copy a direct link to the anchored sub-FAQ response.
No.
The CRA still allows market-surveillance authorities to investigate, require corrective action, adopt restrictive measures, and address formal non-compliance. Where an Article 54 investigation leads to corrective action, the authority must also inform the relevant notified body.
Article 54(1), Article 57, Article 58
It covers certain documentary or marking failures even before the authority proves a deeper substantive breach of Annex I.
Article 58 lists the relevant cases: CE marking missing or wrongly affixed, the EU declaration of conformity missing or incorrect, the notified-body identification number missing where required, or technical documentation unavailable or incomplete.
Article 58(1)
The Member State concerned must take appropriate measures to restrict or prohibit the product from being made available on the market or to ensure that it is recalled or withdrawn.
Article 58(2)
They are coordinated actions that market-surveillance authorities may carry out with other relevant authorities for specific products or categories of products, especially where those products are often found to present cybersecurity risks.
The Commission or ENISA may propose joint activities based on indications of potential non-compliance across several Member States, and the agreement on joint activities must be made public.
Article 59
Sweeps are simultaneous coordinated control actions for particular products or product categories to check compliance or detect infringements.
They may include inspections of products acquired under a cover identity. Unless the participating authorities agree otherwise, sweeps are coordinated by the Commission, and ENISA may propose categories of products for which sweeps should be organised.
Article 60
Yes.
Authorities must monitor how manufacturers applied the Article 13(8) criteria when determining support periods. ADCO must publish relevant statistics, including average support periods, and may issue recommendations to focus surveillance on product categories where support periods appear inadequate.
Article 52(16)
Yes.
The CRA protects intellectual property, confidential business information, trade secrets, source code, the effectiveness of inspections and investigations, public and national security interests, and the integrity of criminal or administrative proceedings. Information exchanged confidentially between authorities and the Commission is also protected against onward disclosure without the originating authority's agreement.
Article 63
Member States must lay down the national penalty rules, but Article 64 sets Union-level caps for certain infringements.
The highest cap applies to non-compliance with Annex I and with Articles 13 and 14: up to EUR 15 000 000 or, for an undertaking, up to 2.5% of total worldwide annual turnover for the preceding financial year, whichever is higher. Article 64 also sets lower caps for other listed obligations and for supplying incorrect, incomplete, or misleading information.
Article 64(1)-(4)
Yes.
The CRA expressly allows administrative fines, depending on the circumstances, to be imposed in addition to other corrective or restrictive measures applied for the same infringement.
Article 64(9)
Yes.
Supplying incorrect, incomplete, or misleading information to notified bodies or market-surveillance authorities in reply to a request has its own fine category, with a cap of up to EUR 5 000 000 or, for an undertaking, up to 1% of total worldwide annual turnover for the preceding financial year, whichever is higher.
Article 64(4)
Yes.
They must report the outcomes of relevant market-surveillance activities to the Commission on an annual basis. They must also report without delay any information identified during market-surveillance activities that may be of potential interest for the application of Union competition law.
Article 52(13)
No.
The CRA uses different enforcement routes depending on the problem. Article 54, together with Article 55, covers products that present a significant cybersecurity risk and are found non-compliant. Article 57 covers products that comply with the CRA but still present the additional risks listed there. Article 58 covers formal non-compliance such as missing or incorrect CE-marking, declaration, or technical-documentation elements.
Articles 54, 55, 57 and 58
Yes.
Article 54(6) requires the notifying authority to include the arguments put forward by the relevant economic operator. Article 54(8) also preserves the operator's procedural rights under Regulation (EU) 2019/1020, and Article 55(1) requires the Commission to consult the relevant economic operator during the Union safeguard procedure. The Blue Guide likewise explains that safeguard decisions are binding legal measures and can be subject to appeal under the applicable framework.
Article 54(6) and (8), Article 55(1)
section 7.6.2
Yes.
Article 59(4) expressly allows a market-surveillance authority to use information obtained through joint activities as part of any investigation it undertakes. So joint activities are not limited to one-off coordination exercises with no later evidentiary value.
Article 59(4)
Yes.
Article 60 says sweeps may include inspections of products acquired under a cover identity. It also says that, when conducting sweeps, market-surveillance authorities may use the investigation powers in Articles 52 to 58 and any additional powers conferred by national law. They may also invite Commission officials and other persons authorised by the Commission to participate.
Article 60(1), (4) and (5)
Yes.
Article 13(25) allows ADCO to decide to conduct a Union-wide dependency assessment for specific categories of products with digital elements. For that purpose, market-surveillance authorities may request manufacturers of those categories to provide the relevant SBOMs. The authorities may then provide ADCO only anonymised and aggregated information about software dependencies.
Article 13(25)
Yes.
Article 52(12) requires market-surveillance authorities to facilitate, where relevant, cooperation with relevant stakeholders, including scientific, research, and consumer organisations.
Article 52(12)
Module A is the internal control conformity-assessment procedure.
Under this route, the manufacturer itself ensures and declares, on its sole responsibility, that the product satisfies the essential cybersecurity requirements in Part I of Annex I and that the manufacturer meets the vulnerability-handling requirements in Part II of Annex I.
Article 32(1)(a), Annex VIII Part I point 1
section 6.1
No.
Module A is the CRA's self-assessment route. The Commission FAQ states expressly that no notified body participates in this procedure.
Annex VIII Part I
section 6.1
Yes, for products that are not pushed by Article 32 into a stricter route.
Article 32(1) lists module A as one of the CRA's general conformity-assessment procedures. In practice, it is the route available unless the product falls into the specific cases where Article 32(2), 32(3), or 32(4) require another procedure.
Article 32(1)-(4)