Use this CRA FAQ to understand the full-quality-assurance route under module H, what the approved quality system must cover, and how notified-body surveillance, scope extensions, and CE marking work.
Built for certification, engineering, legal, and compliance teams using the CRA quality-system route.
Structured answer sets in this page tree.
Cited legal and guidance references.
Module H is the CRA's full-quality-assurance route. This FAQ focuses on what the quality system must cover, what the notified body assesses and surveils, how scope changes are handled, and how CE marking, declarations, records, and language rules work under this procedure.
Module H is the conformity-assessment procedure based on full quality assurance.
Under this route, the manufacturer operates an approved quality system for design, development, final product inspection and testing, and vulnerability handling, and a notified body assesses and surveils that system.
Article 32(1)(c), Annex VIII Part IV points 1-2
section 6.3
Research Copilot can turn EU Cyber Resilience Act FAQ Module H into a reusable cited workflow for teams implementing EU Cyber Resilience Act FAQ.
Start from EU Cyber Resilience Act FAQ Module H and move to source-backed decisions and evidence workflows.
Review evidence gaps, ownership, and next steps for EU Cyber Resilience Act FAQ.
Module H is available as one of the general Article 32(1) conformity-assessment procedures.
It is also one of the mandatory third-party options for important products of class I where Article 32(2) requires third-party assessment, for important products of class II, and for critical products where the Article 8(1) certification route does not apply.
Article 32(1)-(4)
Yes.
Where Article 32(1) applies, the manufacturer may choose module H instead of module A or module B+C.
Article 32(1)
section 6.3
It can cover products with digital elements or product categories concerned by the approved quality system.
That is one reason module H can be attractive for manufacturers with many products or frequent changes, provided the notified body approves the system and its scope.
Annex VIII Part IV point 1
section 6.3
Yes.
The quality system must be assessed by a notified body, and the manufacturer remains under notified-body surveillance after approval.
Annex VIII Part IV points 3 and 4
It must ensure compliance of the covered products with Part I of Annex I and compliance of the manufacturer's vulnerability-handling processes with Part II of Annex I.
It must also cover the relevant lifecycle stages, including design, development, final product inspection and testing, and vulnerability handling, and it must remain effective throughout the support period.
Annex VIII Part IV points 1, 2, and 3.2
The application to the notified body must include:
- the manufacturer details and, where relevant, the authorised representative's details
- the technical documentation for one model of each category of products intended to be manufactured or developed
- the quality-system documentation
- a declaration that the same application has not been lodged with any other notified body
Annex VIII Part IV point 3.1
Yes.
Module H does not replace the Article 31 and Annex VII documentation duties. The application must include technical documentation for one model of each covered product category, and the Commission FAQ notes that this documentation may form part of the quality-system documentation.
Article 31, Annex VII, Annex VIII Part IV point 3.1(b)
sections 4.1.8 and 6.6
The quality-system documentation must systematically describe, among other things:
- quality objectives and management responsibilities
- the standards and specifications to be applied
- the means used where relevant harmonised standards or technical specifications are not applied in full
- design and development controls and verification techniques
- production, quality-control, and quality-assurance techniques
- examinations and tests and how often they are carried out
- quality records
- how the manufacturer monitors the effective operation of the quality system
Annex VIII Part IV point 3.2
Yes.
Annex VIII Part IV point 3.2 distinguishes between the technical design and development specifications relevant to Part I of Annex I and the procedural specifications relevant to Part II of Annex I. In practice, module H covers both product compliance and the manufacturer's vulnerability-handling processes.
Annex VIII Part IV point 3.2(b)-(d)
The notified body assesses whether the quality system satisfies the CRA requirements in Annex VIII Part IV point 3.2.
The audit team must include at least one member experienced in the relevant product field and technology, and the audit must include an assessment visit to the manufacturer's premises where such premises exist. The auditing team also reviews the submitted technical documentation to verify the manufacturer's ability to identify the applicable CRA requirements and carry out the necessary examinations.
Annex VIII Part IV point 3.3
No.
The CRA allows the notified body to presume conformity for elements of the quality system that comply with the corresponding specifications of the national standard implementing the relevant harmonised standard or technical specification. But the notified body still has to assess and approve the system under module H.
The Commission FAQ also says that accreditation against the ISO 9000 series does not by itself entitle a manufacturer to use module H without CRA notified-body involvement.
Annex VIII Part IV point 3.3
section 6.3
The manufacturer must undertake to fulfil the obligations arising from the approved quality system and maintain it so that it remains adequate and efficient.
The notified body's notification to the manufacturer must contain the conclusions of the audit and the reasoned assessment decision.
Annex VIII Part IV points 3.3-3.4
The manufacturer must keep the notified body informed of any intended change to the quality system.
The notified body then evaluates the proposed changes and decides whether the modified system still satisfies the requirements or whether reassessment is necessary.
Annex VIII Part IV point 3.5
Often yes, but only within an approved quality-system framework.
The Commission FAQ says module H may be particularly considered by manufacturers that place numerous product types on the market or products subject to frequent updates, because it provides a more versatile framework than module B+C. That does not remove the need for notified-body assessment of the system and later changes to it.
section 6.3
Annex VIII Part IV point 3.5
The notified body must carry out surveillance to make sure the manufacturer fulfils the obligations arising from the approved quality system.
For that purpose, the manufacturer must allow access to the relevant design, development, production, inspection, testing, and storage sites and provide the quality-system documentation and quality records needed for assessment.
Annex VIII Part IV points 4.1-4.2
Yes.
The notified body must carry out periodic audits to make sure the manufacturer maintains and applies the quality system, and it must provide the manufacturer with an audit report.
Annex VIII Part IV point 4.3
No.
Even under module H, the manufacturer ensures and declares on its sole responsibility that the covered products or product categories satisfy the applicable requirements. The notified body assesses and surveils the quality system, but the manufacturer's legal responsibility remains.
Annex VIII Part IV point 1
Under module H, the manufacturer affixes the CE marking to each individual compliant product and the notified body's identification number follows the CE marking.
The identification number is affixed by the notified body itself or under its instructions.
Article 30(4), Annex VIII Part IV point 5.1
section 6.3
It is tied to each product model.
Annex VIII Part IV point 5.2 requires a written declaration of conformity for each product model, and the declaration must identify the product model for which it has been drawn up.
Annex VIII Part IV point 5.2
The manufacturer must keep, at the disposal of national authorities, for at least 10 years after placing on the market or for the support period, whichever is longer:
- the technical documentation
- the quality-system documentation
- approved changes to the quality system
- the notified body's decisions and reports
- the declaration of conformity for each product model
Annex VIII Part IV points 5.2 and 6
The notified body must inform its notifying authorities about quality-system approvals issued or withdrawn, and it must also inform other notified bodies about approvals it has refused, suspended, or withdrawn and, on request, about approvals it has issued.
Annex VIII Part IV point 7
Yes, but only where the mandate expressly covers them.
Under Annex VIII Part IV point 8, the authorised representative may fulfil the manufacturer's obligations relating to the application, quality-system changes, declaration, and record-retention steps on the manufacturer's behalf and under the manufacturer's responsibility.
Annex VIII Part IV point 8
Yes.
Article 32(5) allows manufacturers of Annex III products qualifying as free and open-source software to use one of the procedures in Article 32(1), provided that the technical documentation is made public at the time of placing on the market. That means module H remains available for those products.
Article 32(1), Article 32(5)
Yes.
Article 32(6) requires the specific interests and needs of microenterprises and small and medium-sized enterprises, including start-ups, to be taken into account when setting conformity-assessment fees, and those fees must be reduced proportionately.
Article 32(6)
A workable module H system is one that lets the notified body see, in a consistent and documented way, how the manufacturer controls design, development, testing, production, vulnerability handling, and later changes across the approved scope.
Grounded in Annex VIII Part IV, that usually means the quality-system documentation is specific enough to show who is responsible, which standards and specifications are used, how non-full use of them is handled, what examinations and tests are performed, what records are kept, and how the effectiveness of the system is monitored.
Annex VIII Part IV points 3.2-4.3
No.
Unlike module B+C, module H is not built around an EU-type examination certificate for a representative specimen. Under the CRA, module H is built around approval of the manufacturer's quality system, later decisions on changes to that system, and ongoing surveillance. That is why the retained records under Part IV are the quality-system documentation, approved changes, and notified-body decisions and reports, rather than an EU-type certificate.
Annex VIII Part IV points 3.3-4.3 and 6
section 5.1.6
No.
The notified body assesses and surveils the quality system, but the manufacturer still carries out the product-level compliance work within that system. The Commission FAQ says the manufacturer, based on the quality system, implements the necessary cybersecurity mitigation measures following the risk assessment, tests the product, draws up the technical documentation, and ensures that production of the different units does not alter compliance.
Annex VIII Part IV points 1-3.2
section 6.3
No.
The Commission FAQ says the manufacturer can extend the scope of the quality system to new or substantially modified products, but the quality system must be updated to document the new scope, new standards may need to be applied, and new tests may need to be performed. That extension is subject to a new assessment by the same notified body that performed the original assessment. Annex VIII Part IV point 3.5 also requires the manufacturer to keep that notified body informed of intended changes to the quality system.
Annex VIII Part IV point 3.5
section 6.3
They must be in an official language of the Member State where the notified body is established, or in another language acceptable to that body.
That rule applies to technical documentation and correspondence for any CRA conformity assessment procedure, including module H.
Article 31(4)
It follows the CE marking wherever the CRA allows that CE marking to be placed for software.
For software products, Article 30(1) says the CE marking is affixed either to the EU declaration of conformity or on the website accompanying the software product. Article 30(4) then says that, where module H is used, the CE marking is followed by the notified body's identification number. So the CRA does not create a separate location rule for software under module H; the number follows the CE marking in the place where that marking is lawfully affixed.
Article 30(1) and (4)