Search every question across sub-FAQs

Yes.

Article 13(25) allows ADCO to decide to conduct a Union-wide dependency assessment for specific categories of products with digital elements. For that purpose, market-surveillance authorities may request manufacturers of those categories to provide the relevant SBOMs. The authorities may then provide ADCO only anonymised and aggregated information about software dependencies.

Yes.

Article 52(12) requires market-surveillance authorities to support, where relevant, cooperation with stakeholders, including scientific, research, and consumer organisations.

Module B+C is a two-step conformity-assessment route.

Module B is EU-type examination by a notified body. Module C is conformity to the approved type based on the manufacturer's internal production control. Together, they cover both the examination of the product type and the manufacturer's obligation to keep actual production in line with that approved type.

Module B+C is one of the mandatory third-party routes for:

- important products of class I where Article 32(2) requires third-party assessment for the relevant requirements

- important products of class II, such as hypervisors and container runtime systems, firewalls, intrusion detection and prevention systems, and tamper-resistant microprocessors or microcontrollers

- critical products listed in Annex IV, unless the applicable certification route under Article 8(1) applies

Yes.

Article 32(1) allows manufacturers to use Module B+C for products generally covered by paragraph 1, even where module A would also be available.

Yes.

Module B is the notified-body part of the route. Module C then follows with the manufacturer's own internal production control against the approved type.

Only one.

The manufacturer must lodge the EU-type examination application with a single notified body of its choice and must declare that the same application has not been lodged with any other notified body.

The application must include:

- the manufacturer details and, where relevant, the authorised representative's details

- a declaration that the same application has not been lodged with another notified body

- technical documentation that allows conformity to be assessed, including an adequate analysis and assessment of the risks

- supporting evidence for the adequacy of the technical design, development solutions, and vulnerability-handling processes

Where necessary, the supporting evidence must include test results from the manufacturer's own laboratory or another testing laboratory acting on its behalf and under its responsibility.

It covers both.

EU-type examination is not limited to the product's technical design and development. The notified body also examines the vulnerability-handling processes put in place by the manufacturer against Part II of Annex I.

It assesses both.

Annex VIII Part II requires examination of the technical documentation and supporting evidence, plus examination of specimens of one or more critical parts of the product. The notified body must also carry out appropriate examinations and tests, or have them carried out.

The notified body checks:

- whether the technical documentation and supporting evidence are adequate

- whether the examined specimens match the documentation

- which elements were designed and developed using relevant harmonised standards or technical specifications and which were not

- whether the manufacturer's chosen solutions satisfy the applicable essential cybersecurity requirements

Yes.

Annex VIII Part II point 4.5 says the notified body and the manufacturer agree on the location where the examinations and tests will be carried out.

The manufacturer receives an EU-type examination certificate.

The certificate identifies the approved type and the vulnerability-handling processes, and it records the conclusions of the examination and any validity conditions.

It must refuse to issue the EU-type examination certificate and give detailed reasons for the refusal. Annex VIII frames that refusal around both the type and the vulnerability-handling processes, so a process failure can block the certificate even if the product design evidence is otherwise strong.

It covers both.

Annex VIII Part II point 6 ties the certificate to both the approved type and the examined vulnerability-handling processes. That is why later modifications to either can matter for certificate validity.