Find the exact question, open the source answer card, and copy a direct link to the anchored sub-FAQ response.
Module C is the production-control step.
After obtaining the EU-type examination certificate, the manufacturer must ensure and declare that the products actually manufactured remain in conformity with the approved type and continue to satisfy the essential cybersecurity requirements.
Defines Module C as conformity to type based on internal production control after the Module B certificate.
Not in the way module H does.
Under module C, the manufacturer itself must take the necessary measures so that production and production monitoring ensure conformity with the approved type and the applicable essential cybersecurity requirements. Module C is therefore not a full-quality-assurance route supervised like Module H.
Places production conformity and monitoring under the manufacturer in Module C.
The manufacturer must:
- ensure that production conforms to the approved type
- affix the CE marking to each individual compliant product
- draw up a written declaration of conformity for the product model
Requires production conformity, CE marking on each compliant product, and a written declaration of conformity for the product model.
It is for the product model.
Annex VIII Part III point 3.2 requires a written declaration of conformity for a product model. That differs from module A wording, which refers to each product with digital elements.
States that Module C uses a declaration of conformity for a product model and identifies that model.
Yes.
Even though the declaration under module C is for the product model, the CE marking must still be affixed to each individual product with digital elements that conforms to the approved type.
Requires CE marking on each individual product that conforms to the approved type and satisfies the CRA.
The manufacturer must inform the notified body that holds the technical documentation relating to the certificate of any modifications that may affect conformity or the conditions for validity of the certificate.
Those modifications require additional approval in the form of an addition to the original EU-type examination certificate.
Requires manufacturer notification and certificate additions for modifications that may affect conformity or certificate-validity conditions.
Not only for that label.
Annex VIII Part II point 7 is framed more broadly: the trigger is any modification to the approved type or the vulnerability-handling processes that may affect conformity with Annex I or the conditions for validity of the certificate.
Uses a conformity-or-certificate-validity trigger for post-certificate modifications, not only a label such as substantial modification.
Yes, but it is limited.
The notified body must carry out periodic audits to ensure that the vulnerability-handling processes in Part II of Annex I are implemented adequately. This is not the same as the broader quality-system surveillance under module H.
Requires periodic notified-body audits of the manufacturer's vulnerability-handling processes.
The notified body must inform its notifying authorities and the other notified bodies about those certificate outcomes.
The Commission and Member States can also obtain copies of the certificates and, on request, copies of the technical documentation and examination results.
Sets the notified body's information duties for certificate issuance, withdrawal, refusal, suspension, restriction, and requests by authorities.
The manufacturer must keep:
- the EU-type examination certificate, its annexes and additions, together with the technical documentation
- the declaration of conformity for the product model
Those records must be kept at the disposal of national authorities for 10 years after the product is placed on the market or for the support period, whichever is longer.
Requires retention of the certificate package and product-model declaration for 10 years after market placement or the support period, whichever is longer.
Yes, but only where the mandate expressly covers them.
Under Annex VIII Part II point 11, the authorised representative may lodge the module B application and fulfil the obligations relating to modifications and record retention. Under Annex VIII Part III point 4, the authorised representative may fulfil the declaration obligations in module C.
Allows an authorised representative to handle specified Module B+C obligations only where the mandate covers them.
Yes.
Article 32(5) allows manufacturers of Annex III products qualifying as free and open-source software to use one of the procedures listed in Article 32(1), provided the technical documentation is made public at the time of placing on the market. That means they may use module A, but they may also choose Module B+C.
Allows Annex III free-and-open-source software manufacturers to use Article 32(1) procedures, including Module B+C, if the technical documentation is public at market placement.
No.
Article 69(1) provides a transition rule: EU-type examination certificates and approval decisions issued regarding cybersecurity requirements for products with digital elements under other Union harmonisation legislation remain valid until 11 June 2028, unless they expire earlier or that other legislation specifies otherwise.
Keeps certain pre-CRA cybersecurity EU-type certificates and approval decisions valid during the CRA transition period, subject to expiry and other-law limits.
Explains the CRA transition treatment of existing cybersecurity certificates issued under other Union product laws.
A workable file is one that lets the notified body trace the compliance claim, the supporting design choice, the evidence, and the tested specimen without gaps.
Based on Annex VIII Part II and Annex VII, that usually means the application clearly identifies the applicable requirements, includes the risk analysis and assessment, explains any reliance on or departure from harmonised standards or technical specifications, and contains the supporting evidence and test results needed for the notified body's examination.
Connects the Module B application file to the technical documentation contents, risk analysis, standards mapping, supporting evidence, and tests.
No.
Under Article 30(4), the CE marking is followed by the notified body's identification number only where that body is involved in the conformity assessment procedure based on module H. Under Module B+C, the manufacturer still affixes the CE marking to each individual compliant product under module C, but the CRA does not require a notified-body number next to that marking.
Article 30(4), Annex VIII Part III point 3.1