--- title: "CRA Notified Bodies FAQ" canonical_url: "https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/notified-bodies" source_url: "https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/notified-bodies" author: "Sorena AI" description: "Practical CRA FAQ on when notified bodies are needed, how CRA bodies are designated, what their notified scope means, and how Module B+C and Module H assessments work." published_at: "2026-03-10" updated_at: "2026-03-10" keywords: - "CRA notified bodies" - "CRA Module B+C" - "CRA Module H" - "CRA NANDO" - "CRA EU-type examination certificate" - "Cyber Resilience Act conformity assessment" - "Cyber Resilience Act" - "CRA FAQ" - "EU compliance" --- **[SORENA](https://www.sorena.io/)** - AI-Powered GRC Platform [Home](https://www.sorena.io/) | [Solutions](https://www.sorena.io/solutions) | [Artifacts](https://www.sorena.io/artifacts) | [About Us](https://www.sorena.io/about-us) | [Contact](https://www.sorena.io/contact) | [Portal](https://app.sorena.io) --- # CRA Notified Bodies FAQ Practical CRA FAQ on when notified bodies are needed, how CRA bodies are designated, what their notified scope means, and how Module B+C and Module H assessments work. *FAQ* *EU* *Cyber Resilience Act* ## EU Cyber Resilience Act FAQ Notified Bodies This CRA FAQ helps understand when a notified body is part of the conformity route, what a CRA notification covers, and what manufacturers should check before relying on a body for Module B+C or Module H. Built for product, security, compliance, and legal teams preparing CRA conformity assessments for products with digital elements. Under the Cyber Resilience Act, notified bodies are not general cybersecurity consultants or universal approval authorities. They are conformity assessment bodies notified for defined CRA modules and product scopes. This FAQ explains designation, notified scope, conformity routes, certificates, surveillance, information sharing, and how Module B+C differs from Module H. ## What is a notified body under the Cyber Resilience Act? A CRA notified body is a conformity assessment body that has been assessed, designated, and notified for CRA conformity assessment tasks. It may be public or private, but it must meet the CRA requirements for legal personality, independence, competence, impartiality, confidentiality, and operational capability. A body does not become a CRA notified body just because it performs cybersecurity audits, penetration testing, certification, or assessments under another EU law. For CRA purposes, the notification procedure must be completed and the body's public notification must cover the relevant CRA activities. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Defines notified bodies and sets the Article 39 requirements for independence, competence, impartiality, confidentiality, and capability. - [European Commission CRA FAQs](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Explains that notified bodies are assessed by Member State notifying authorities and listed through NANDO. ## Who designates and monitors CRA notified bodies? Each Member State designates a notifying authority. That authority is responsible for the procedures used to assess, designate, notify, and monitor conformity assessment bodies, including their use of subsidiaries or subcontractors. A Member State may use a national accreditation body for assessment and monitoring. If assessment, notification, or monitoring is delegated to a non-governmental body, the notifying authority remains fully responsible for the delegated tasks. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 36 assigns Member State notifying authorities responsibility for assessment, designation, notification, monitoring, and delegated-task accountability. ## How does a conformity assessment body apply to become a CRA notified body? The body applies to the notifying authority in the Member State where it is established. The application must describe the conformity assessment activities, the conformity assessment procedure or procedures, and the products with digital elements for which the body claims competence. Where available, the application includes an accreditation certificate from a national accreditation body. Without accreditation, the body must provide documentary evidence allowing the notifying authority to verify, recognise, and regularly monitor compliance with Article 39. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 42 specifies the notification application contents and the evidence needed with or without an accreditation certificate. ## When can a body start acting as a CRA notified body? A body may perform CRA notified-body activities only after the Article 43 notification procedure is complete. If the notification relies on accreditation, the no-objection period is two weeks. If it does not rely on accreditation, the no-objection period is two months. The notification must include full details of the conformity assessment activities, the module or modules, the products with digital elements concerned, and the relevant attestation of competence. That scope is central: a body can be notified for some CRA activities without being competent for every CRA module or product category. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 43 sets the notification contents, objection periods, and rule that only bodies completing that procedure count as CRA notified bodies. ## How should manufacturers use NANDO or public notified-body listings? The Commission assigns each CRA notified body an identification number and publishes an up-to-date list showing the bodies notified under the CRA, their numbers, and the activities for which they have been notified. A listing should be read as a scope record, not as a blanket approval. Manufacturers should check whether the listed CRA notification covers the product with digital elements, the applicable conformity route, and the specific module needed for the assessment. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 44 requires a public list of CRA notified bodies, their identification numbers, and their notified activities. - [Blue Guide on the implementation of EU product rules](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52022XC0629%2804%29&ref=sorena.io) - The Blue Guide describes NANDO as the Commission publication system for notified-body information under EU product rules. ## Does a manufacturer have to choose a CRA notified body in its own Member State? No. Where the CRA procedure requires a notified body, Annex VIII lets the manufacturer apply to a single notified body of its choice for the relevant Module B or Module H assessment. The practical constraint is scope, not the manufacturer's location. The selected body must be notified for the CRA module and product scope that match the product and assessment route. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Annex VIII permits applications to a single notified body of the manufacturer's choice, while Articles 43 and 44 tie that choice to notified scope. ## When does the CRA require a notified body? A notified body is part of the route when the product must use Module B+C or Module H. Module A, internal control, does not involve a notified body. Article 32 allows several conformity routes. For important class I products, third-party assessment is triggered where qualifying harmonised standards, common specifications, or cybersecurity certification routes are not applied or do not exist for the relevant requirements. Important class II products use Module B+C, Module H, or an applicable certification route. Critical products use the Article 8 certification route where it applies, otherwise the CRA third-party routes in Article 32 apply. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 32 distinguishes Module A, Module B+C, Module H, and certification routes for default, important, and critical products. - [European Commission CRA FAQs](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Section 6 explains that no notified body participates in Module A and that Module B+C or H is mandatory for specified important and critical products. ## What does the notified body assess under Module B+C? Module B is the notified-body step. The notified body examines the technical design and development of the product and the manufacturer's vulnerability-handling processes, reviews technical documentation and supporting evidence, examines specimens of critical parts, and carries out or arranges appropriate examinations and tests. Module C follows Module B and is not a second notified-body production approval. Under Module C, the manufacturer ensures and declares that production units conform to the type described in the EU-type examination certificate and satisfy the CRA requirements. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Annex VIII Part II defines the notified body's Module B examination tasks; Part III defines the manufacturer's Module C production-control responsibility. - [European Commission CRA FAQs](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Section 6.2 explains the practical split between notified-body design examination and manufacturer production responsibility. ## What certificate does a notified body issue under Module B? If the product type and vulnerability-handling processes meet the applicable essential cybersecurity requirements, the notified body issues an EU-type examination certificate. The certificate identifies the manufacturer, states the conclusions of the examination, records any validity conditions, and includes the data needed to identify the approved type and vulnerability-handling processes. If the type or vulnerability-handling processes do not meet the requirements, the notified body must refuse the certificate and give detailed reasons. Modifications that may affect conformity or certificate validity require additional approval as an addition to the original EU-type examination certificate. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Annex VIII Part II points 6 and 7 set the EU-type examination certificate contents, refusal duty, and approval route for relevant modifications. ## Does Module B+C include ongoing notified-body surveillance? Yes, but the surveillance is specific. Under Module B, the notified body must carry out periodic audits to ensure that the manufacturer's vulnerability-handling processes are implemented adequately. That does not turn Module C into notified-body production surveillance. The production-control obligation remains with the manufacturer under Module C. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Annex VIII Part II point 8 requires periodic audits of vulnerability-handling processes; Part III keeps production conformity under manufacturer control. - [European Commission CRA FAQs](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Section 6.2 confirms that the production phase is not assessed by the notified body under Module C. ## What does the notified body assess under Module H? Module H is full quality assurance. The manufacturer operates an approved quality system for design, development, production, final product inspection and testing, and vulnerability handling. The notified body assesses whether that quality system satisfies the CRA requirements. The quality-system documentation must cover responsibilities, design and development specifications, vulnerability-handling process specifications, production and quality assurance techniques, examinations and tests, quality records, and monitoring of product quality and system effectiveness. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Annex VIII Part IV points 1 to 3 define Module H and the required quality-system content. - [European Commission CRA FAQs](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Section 6.3 explains Module H as a full quality control system covering design and production with notified-body assessment. ## How does surveillance work under Module H? Module H has surveillance under the responsibility of the notified body. The purpose is to make sure the manufacturer fulfils the obligations arising from the approved quality system. For assessment, the manufacturer must allow access to design, development, production, inspection, testing, and storage sites and provide quality-system documentation and quality records. The notified body carries out periodic audits and provides an audit report. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Annex VIII Part IV point 4 sets the purpose of Module H surveillance, site-access duties, required records, and periodic audits. ## How do Module B+C and Module H differ for manufacturers? Module B+C is product-type oriented: a notified body examines the type and vulnerability-handling processes, then the manufacturer controls production conformity to the approved type. Module H is system oriented: the notified body assesses and surveils the manufacturer's quality system covering design, development, production, final inspection, testing, and vulnerability handling for the covered product categories. The Commission FAQ notes that Module H can be useful for manufacturers with numerous product types or frequent updates because it can streamline assessment of new or substantially modified products within the approved system. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Annex VIII Parts II, III, and IV show the product-type structure of Module B+C and the quality-system structure of Module H. - [European Commission CRA FAQs](https://ec.europa.eu/newsroom/dae/redirection/document/122331?ref=sorena.io) - Section 6.3 discusses Module H as more flexible for numerous product types or products subject to frequent updates. ## Does the notified body's number appear next to the CE marking? Only for the CRA Module H route. Article 30 says the CE marking is followed by the notified body's identification number where that body is involved in conformity assessment based on full quality assurance. For Module B+C, the CRA requires the manufacturer to keep the EU-type examination certificate and use Module C production control, but Article 30's notified-body-number rule is tied to Module H. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 30(4) ties the notified-body identification number after the CE marking to full quality assurance based on Module H. ## What independence rules apply to CRA notified bodies? A CRA notified body must be independent of the organisation and product it assesses. It and its relevant management and assessment personnel must not be the designer, developer, manufacturer, supplier, importer, distributor, installer, purchaser, owner, user, maintainer, or authorised representative of the products being assessed. The CRA also bars activities that conflict with independence of judgement or integrity, especially consultancy services. A body connected to an industry association can still qualify only if independence and absence of conflicts of interest are demonstrated. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 39(3) to (5) set third-party independence, conflict-of-interest, consultancy, and association-membership conditions. ## What competence and process capabilities must a CRA notified body have? For every CRA procedure and product kind or category in its notified scope, the body must have personnel, procedures, means, equipment, and facilities needed to perform the assessment tasks. Its procedures must be transparent and reproducible and must distinguish notified-body tasks from other activities. Assessment personnel must have appropriate training, knowledge of the applicable CRA requirements, harmonised standards and common specifications, and the ability to draw up certificates, records, and reports showing that assessments were carried out. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 39(6) and (7) define the personnel, procedures, equipment, facilities, training, and reporting capabilities required for notified scope. ## Can a notified body use subcontractors or subsidiaries? Yes, but the notified body remains responsible. It must ensure the subcontractor or subsidiary meets Article 39 requirements, inform the notifying authority, keep qualification and work records available to the notifying authority, and obtain the manufacturer's agreement before subcontracting activities or using a subsidiary. Subcontracting does not expand the notified body's scope. The manufacturer's check should still start with the notified body's own CRA notification and the activities it is authorised to perform. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 41 allows subcontracting and subsidiaries only with Article 39 compliance, notifying-authority information, manufacturer agreement, and retained responsibility. ## What happens if a notified body finds non-compliance? Before issuing a certificate, the notified body must require corrective measures and must not issue the certificate if non-compliance remains. After a certificate has been issued, it must require corrective measures and, if necessary, suspend or withdraw the certificate. If corrective measures are not taken or do not have the required effect, the notified body must restrict, suspend, or withdraw the certificate as appropriate. Member States must also ensure that an appeal procedure against notified-body decisions is available. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 47(4) to (6) cover corrective measures and certificate refusal, restriction, suspension, or withdrawal; Article 48 requires appeal procedures. ## What information must CRA notified bodies share? Notified bodies must inform their notifying authority about certificate refusals, restrictions, suspensions, or withdrawals; circumstances affecting the scope or conditions of notification; and certain information requests from market surveillance authorities. On request, they must also provide information about conformity assessment activities, including cross-border activities and subcontracting. They must also share relevant information with other notified bodies carrying out similar CRA conformity assessment activities for the same products: negative results must be shared, and positive results must be shared on request. Annex VIII adds specific information-sharing duties for EU-type examination certificates and Module H quality-system approvals. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 49 and Annex VIII Part II point 9 and Part IV point 7 set information-sharing duties toward authorities and other notified bodies. ## What happens if a CRA notified body no longer meets the requirements? The notifying authority must restrict, suspend, or withdraw the notification depending on the seriousness of the failure, and it must inform the Commission and the other Member States. If notification is restricted, suspended, withdrawn, or the body ceases activity, the notifying Member State must ensure the body's files are handled by another notified body or kept available for the responsible notifying and market-surveillance authorities. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 45 sets restriction, suspension, withdrawal, notification, and file-handling rules when a body no longer meets requirements. ## Can the Commission challenge a notified body's competence? Yes. The Commission must investigate where it doubts, or where doubt is brought to its attention about, a notified body's competence or continued fulfilment of CRA requirements and responsibilities. If the Commission concludes that the body does not meet or no longer meets the notification requirements, it asks the notifying Member State to take corrective measures, including de-notification if necessary. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 46 gives the Commission a competence-challenge process and allows requests for corrective measures including de-notification. ## Can AI Act notified bodies also assess CRA cybersecurity requirements? Sometimes. For high-risk AI systems that also fall within the CRA, notified bodies competent under the AI Act may control conformity with CRA Annex I requirements if their compliance with CRA Article 39 has been assessed in the AI Act notification procedure. This is not a general shortcut for all CRA products. The Article 12 rule is tied to high-risk AI systems and the CRA conditions specified there. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Article 12(2) addresses high-risk AI systems and when AI Act notified bodies may assess CRA Annex I cybersecurity requirements. ## If a body is notified under another EU law, does it automatically count under the CRA? No. The CRA expects bodies accredited and notified under other Union frameworks with similar requirements to be newly assessed and notified under the CRA, although synergies can be used where requirements overlap. For manufacturers, this means a certificate, audit relationship, or notified-body number under another EU act is not enough. The CRA listing and scope must support the CRA procedure being relied on. Sources for this answer: - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Recital 100 and Article 43 support new CRA assessment and notification, with possible synergies for overlapping requirements. - [Blue Guide on the implementation of EU product rules](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52022XC0629%2804%29&ref=sorena.io) - The Blue Guide explains that a notified-body number is an administrative identifier and does not supersede checking legal act and scope. ## Primary sources - [Cyber Resilience Act](https://data.europa.eu/eli/reg/2024/2847/oj?ref=sorena.io) - Official Cyber Resilience Act legal text supporting this FAQ and its article-level compliance conclusions. ## Topic Guides - [CRA Applicability Test for Products With Digital Elements](/artifacts/eu/cyber-resilience-act/applicability-test.md): Check whether the EU Cyber Resilience Act applies to a hardware, software, firmware, open-source, or connected product before conformity planning. - [CRA Article 14 Reporting Obligations for Vulnerabilities and Incidents](/artifacts/eu/cyber-resilience-act/reporting-obligations.md): Article 14 guide to CRA reports for actively exploited vulnerabilities and severe product-security incidents, including deadlines, CSIRT routing, users, and evidence. - [CRA Blue Guide Concepts FAQ | Placing on the Market, Making Available, Distance Sales](/artifacts/eu/cyber-resilience-act/faq/blue-guide-concepts.md): CRA FAQ explaining Blue Guide market-access concepts for products with digital elements: placing on the market, making available, imports, CE marking, operator roles, online sales, stock, and testing exceptions. - [CRA CE Marking FAQ | Conformity Assessment, EU Declaration, Evidence](/artifacts/eu/cyber-resilience-act/faq/ce-marking.md): Practical CRA CE marking answers for products with digital elements: conformity assessment, EU declaration, technical documentation, standards, software placement, and launch evidence. - [CRA Component Due Diligence FAQ | Third-Party Software, FOSS, SBOMs](/artifacts/eu/cyber-resilience-act/faq/component-due-diligence.md): Cyber Resilience Act FAQ on manufacturer due diligence for integrated components, third-party software, FOSS dependencies, SBOMs, vulnerability handling, and evidence records. - [CRA Conformity Assessment and CE Marking](/artifacts/eu/cyber-resilience-act/conformity-assessment-and-ce-marking.md): How to choose a Cyber Resilience Act conformity route, prepare technical documentation, issue the EU declaration of conformity, and affix CE marking. - [CRA Conformity Assessment Routes FAQ | Module A, Module B+C, Module H, Important and Critical Products](/artifacts/eu/cyber-resilience-act/faq/conformity-assessment-routes.md): Cyber Resilience Act FAQ on when manufacturers can use module A, when module B+C or module H is required, and how important and critical products affect the route. - [CRA Cybersecurity Risk Assessment FAQ | Article 13, Annex I, Updates](/artifacts/eu/cyber-resilience-act/faq/cybersecurity-risk-assessment.md): CRA FAQ on Article 13 cybersecurity risk assessments, Annex I applicability, intended purpose, foreseeable use, technical documentation, and update evidence. - [CRA deadlines and compliance calendar | EU Cyber Resilience Act](/artifacts/eu/cyber-resilience-act/deadlines-and-compliance-calendar.md): Track the Cyber Resilience Act entry into force, staged application dates, Article 14 reporting deadlines, transitional rules, and review dates. - [CRA Declaration of Conformity FAQ | Annex V, Simplified Declaration, CE Marking](/artifacts/eu/cyber-resilience-act/faq/declaration-of-conformity.md): FAQ on the Cyber Resilience Act EU Declaration of Conformity: Annex V contents, simplified Annex VI wording, CE marking link, technical documentation, retention, updates, and operator duties. - [CRA Economic Operators FAQ | Manufacturers, Importers, Distributors, Authorised Representatives](/artifacts/eu/cyber-resilience-act/faq/economic-operators.md): CRA FAQ on economic-operator roles: manufacturers, importers, distributors, authorised representatives, substantial modification, traceability, and evidence controls. - [CRA Essential Cybersecurity Requirements FAQ | Annex I Part I and Part II](/artifacts/eu/cyber-resilience-act/faq/essential-cybersecurity-requirements.md): CRA FAQ on Annex I product cybersecurity requirements, vulnerability handling, secure-by-default design, risk assessment, documentation, lifecycle duties, and user information. - [CRA Essential Cybersecurity Requirements in Annex I](/artifacts/eu/cyber-resilience-act/essential-cybersecurity-requirements.md): An official source guide to the Cyber Resilience Act Annex I requirements for product security, vulnerability handling, secure-by-design controls, documentation, and evidence. - [CRA Hardware and Software Boundaries FAQ | Product Scope, Components, RDPS](/artifacts/eu/cyber-resilience-act/faq/hardware-software-boundaries.md): FAQ on Cyber Resilience Act hardware and software boundaries: combined products, standalone software, source code, components, remote data processing, SaaS and market-placement changes. - [CRA Harmonised Standards FAQ | Presumption of Conformity, Common Specifications](/artifacts/eu/cyber-resilience-act/faq/harmonised-standards-and-common-specifications.md): Cyber Resilience Act FAQ on how harmonised standards, common specifications, certification schemes, and OJ publication affect CRA conformity evidence. - [CRA Important and Critical Products FAQ | Annex III, Annex IV, Conformity Assessment](/artifacts/eu/cyber-resilience-act/faq/important-and-critical-products.md): FAQ on CRA important and critical products, Annex III and Annex IV classification, core functionality, and conformity assessment consequences. - [CRA Integrated Components and Dependencies FAQ | Third-Party Software and SBOM Evidence](/artifacts/eu/cyber-resilience-act/faq/integrated-components-and-dependencies.md): Cyber Resilience Act FAQ on integrated components, third-party software, remote data processing, SBOM-style evidence, upstream fixes, FOSS dependencies, and manufacturer responsibility. - [CRA Interplay With EU Product Laws FAQ | RED, Machinery, Data Act](/artifacts/eu/cyber-resilience-act/faq/interplay-with-other-eu-laws.md): Official source CRA FAQ on overlap with the Radio Equipment Directive, Machinery Regulation, GPSR, Data Act, exclusions, declarations, documentation, and existing certificates. - [CRA Known Exploitable Vulnerabilities at Launch FAQ](/artifacts/eu/cyber-resilience-act/faq/known-exploitable-vulnerabilities-at-launch.md): FAQ for Cyber Resilience Act launch decisions: known exploitable vulnerabilities, CVEs, component flaws, secure-by-default settings, release gates, Article 14 reporting, and evidence. - [CRA Legacy Products FAQ | Pre-11 December 2027 Products](/artifacts/eu/cyber-resilience-act/faq/legacy-products.md): Cyber Resilience Act FAQ on products placed on the market before 11 December 2027, Article 14 reporting, substantial modification, distributor stock, spare parts, and records. - [CRA Manufacturer Obligations FAQ | Article 13, Annex I, CE Marking](/artifacts/eu/cyber-resilience-act/faq/manufacturer-obligations.md): FAQ for Cyber Resilience Act manufacturers covering Article 13 duties, risk assessment, Annex I, vulnerability handling, support periods, documentation, conformity assessment, reporting, CE marking, and evidence controls. - [CRA Market Surveillance and Enforcement FAQ | Authorities, Corrective Action, Safeguards](/artifacts/eu/cyber-resilience-act/faq/market-surveillance-and-enforcement.md): Cyber Resilience Act FAQ on market-surveillance authorities, investigations, corrective action, withdrawal, recall, safeguards, sweeps, documentation access, and penalties. - [CRA Module B+C FAQ | EU-Type Examination, Conformity to Type, Notified Bodies](/artifacts/eu/cyber-resilience-act/faq/module-b-c.md): CRA Module B+C FAQ explaining EU-type examination, conformity to type, notified-body evidence, production control, CE marking, declarations, and certificate changes. - [CRA Module H FAQ | Full Quality Assurance, Notified Body Surveillance, CE Marking](/artifacts/eu/cyber-resilience-act/faq/module-h.md): CRA Module H FAQ explaining the full-quality-assurance route, notified-body assessment, quality-system scope, technical documentation, CE marking, declarations, and records. - [CRA Open-Source Software FAQ | FOSS Scope, Stewards, Manufacturers](/artifacts/eu/cyber-resilience-act/faq/open-source-software.md): Cyber Resilience Act FAQ for free and open-source software: commercial activity, steward duties, manufacturer due diligence, vulnerability handling, public documentation, and user obligations. - [CRA Over-the-Air Updates FAQ](/artifacts/eu/cyber-resilience-act/faq/over-the-air-updates.md): Cyber Resilience Act FAQ on OTA updates, automatic security updates, secure update distribution, support-period evidence, and offline update paths. - [CRA penalties and fines FAQ | Article 64 fine caps](/artifacts/eu/cyber-resilience-act/faq/penalties-and-fines.md): FAQ on EU Cyber Resilience Act Article 64 penalties: maximum fine tiers, turnover caps, national enforcement, economic operators, reporting duties, and open-source steward carve-outs. - [CRA Penalties and Fines: Article 64 Caps and Enforcement Context](/artifacts/eu/cyber-resilience-act/penalties-and-fines.md): Article 64 of the EU Cyber Resilience Act sets administrative fine ceilings for Annex I, manufacturer, reporting, economic-operator, notified-body, and information-request breaches. - [CRA Product Families FAQ | Variants, Shared Assessments, Family Reuse, Conformity Scope](/artifacts/eu/cyber-resilience-act/faq/product-families.md): CRA FAQ on product families, variant grouping, shared technical documentation, conformity evidence, and when cybersecurity-relevant differences need separate assessment. - [CRA Products with Digital Elements Scope | EU Cyber Resilience Act](/artifacts/eu/cyber-resilience-act/products-with-digital-elements-scope.md): Apply the EU Cyber Resilience Act scope test for software, hardware, remote data processing, components, open-source software, exclusions, and economic-operator roles. - [CRA Products With Digital Elements Scope FAQ](/artifacts/eu/cyber-resilience-act/faq/scope-and-products-with-digital-elements.md): EU Cyber Resilience Act FAQ on products with digital elements, software, firmware, remote data processing, components, exclusions, market placement, and CRA operator boundaries. - [CRA Remote Data Processing Solutions FAQ | Product Scope, Cloud and Backend Boundaries](/artifacts/eu/cyber-resilience-act/faq/remote-data-processing-solutions.md): FAQ on how the EU Cyber Resilience Act treats remote data processing solutions, manufacturer-controlled backends, third-party cloud services, SaaS, risk assessment, documentation, and user information. - [CRA Reporting Obligations FAQ | Article 14, CSIRTs, ENISA, User Notices](/artifacts/eu/cyber-resilience-act/faq/reporting-obligations.md): Cyber Resilience Act FAQ on Article 14 reporting for actively exploited vulnerabilities and severe incidents, including timing, CSIRT routing, ENISA access, user notices, and evidence. - [CRA Requirements | Annex I, Manufacturer Duties and CE Evidence](/artifacts/eu/cyber-resilience-act/requirements.md): Map Cyber Resilience Act requirements from Annex I to manufacturer duties, vulnerability handling, user information, technical documentation, declaration of conformity, and CE marking evidence. - [CRA SBOM and Vulnerability Management Template](/artifacts/eu/cyber-resilience-act/sbom-and-vulnerability-management-template.md): Build a CRA-ready SBOM and vulnerability handling record with component inventory, triage, remediation, disclosure, reporting, update, and technical documentation fields. - [CRA Secure-by-Default FAQ | Default Configuration and Annex I Controls](/artifacts/eu/cyber-resilience-act/faq/secure-by-default.md): Cyber Resilience Act FAQ on secure-by-default configuration, automatic security updates, attack surface reduction, authentication, data minimisation, user information, and tailor-made products. - [CRA Security Updates vs Functionality Updates FAQ](/artifacts/eu/cyber-resilience-act/faq/security-updates-vs-functionality-updates.md): Cyber Resilience Act FAQ on classifying security updates, functionality updates, support-period duties, automatic updates, user notices, and substantial-modification review. - [CRA Substantial Modification FAQ | Updates, Repairs, Manufacturer Duties](/artifacts/eu/cyber-resilience-act/faq/substantial-modification.md): Cyber Resilience Act FAQ on when software updates, repairs, spare parts, and post-market changes become substantial modifications and trigger CRA manufacturer, evidence, and conformity duties. - [CRA Support Period FAQ | Expected Product Lifetime, Security Updates, User Information](/artifacts/eu/cyber-resilience-act/faq/support-period.md): Practical CRA FAQ on how manufacturers determine support periods, disclose support end dates, keep security updates available, and document support-period evidence. - [CRA Tailor-Made Products FAQ | Bespoke Products, Market Placement, Evidence](/artifacts/eu/cyber-resilience-act/faq/tailor-made-products.md): FAQ on when a bespoke product may be treated as tailor-made under the EU Cyber Resilience Act, what the carve-out changes, and what manufacturers still need to document. - [CRA Technical Documentation FAQ | Annex VII Evidence and Technical File](/artifacts/eu/cyber-resilience-act/faq/technical-documentation.md): CRA FAQ explaining Annex VII technical documentation, risk assessment evidence, conformity assessment files, vulnerability handling records, product families, RDPS, language, and authority access. - [CRA Transition Period FAQ | Entry Into Force, Application Dates, Reporting, Legacy Products](/artifacts/eu/cyber-resilience-act/faq/transition-period.md): CRA FAQ on the transition period covering entry into force, 2026 reporting, 2027 application, legacy products, stock, customs timing, and software versions. - [CRA Update Availability and Software Archives FAQ](/artifacts/eu/cyber-resilience-act/faq/update-availability-and-archives.md): FAQ on CRA security-update availability, support-period notices, optional public software archives, historical versions, and Article 13(10) software-version limits. - [CRA User Information and Transparency FAQ | Annex II Instructions](/artifacts/eu/cyber-resilience-act/faq/user-information-and-transparency.md): Practical CRA FAQ on Annex II user instructions, support-period disclosure, vulnerability contacts, update notices, importer and distributor information. - [CRA vs RED Cybersecurity Delegated Act](/artifacts/eu/cyber-resilience-act/cra-vs-red-cybersecurity-delegated-act.md): Compare the EU Cyber Resilience Act with the RED cybersecurity delegated act for connected and radio equipment, including scope, timing, evidence, and transition treatment. - [CRA vs UK PSTI Act | Cyber Resilience Act Comparison](/artifacts/eu/cyber-resilience-act/cra-vs-uk-psti-act.md): Compare cited EU Cyber Resilience Act duties with UK PSTI planning points, with UK legal details clearly marked for separate source review. - [CRA Vulnerability Handling and Disclosure | Article 14 Reporting and Security Updates](/artifacts/eu/cyber-resilience-act/vulnerability-handling-and-disclosure.md): How EU Cyber Resilience Act manufacturers should run vulnerability intake, remediation, coordinated disclosure, Article 14 reporting, secure updates, and evidence records. - [CRA Vulnerability Handling FAQ | Support Periods, Components, Reporting](/artifacts/eu/cyber-resilience-act/faq/vulnerability-handling.md): Practical CRA FAQ on vulnerability handling: SBOMs, remediation, coordinated disclosure, component issues, security updates, support periods, Article 14 reporting, and user notices. - [Cyber Resilience Act Module A FAQ | Internal Production Control](/artifacts/eu/cyber-resilience-act/faq/module-a.md): FAQ on when CRA Module A internal production control is available, when it is blocked, and what documentation, testing, standards, and evidence it still requires. - [EU CRA Compliance Program for Manufacturers and Economic Operators](/artifacts/eu/cyber-resilience-act/compliance.md): Build a Cyber Resilience Act compliance program around product scope, Annex I security requirements, conformity assessment, technical documentation, vulnerability reporting, and market surveillance. - [EU Cyber Resilience Act Checklist for Product Security and CE Marking](/artifacts/eu/cyber-resilience-act/checklist.md): A CRA checklist for products with digital elements: scope, Annex I security controls, vulnerability handling, Article 14 reporting, technical documentation, conformity assessment, CE marking, and support-period evidence. - [EU Cyber Resilience Act Core Functionality FAQ | CRA Product Classification](/artifacts/eu/cyber-resilience-act/faq/core-functionality.md): CRA FAQ on core functionality, product boundaries, remote data processing, integrated components, ancillary functions, and software changes that affect product classification. - [EU Cyber Resilience Act FAQ](/artifacts/eu/cyber-resilience-act/faq.md): Direct CRA FAQ answers on scope, economic-operator roles, essential requirements, vulnerability reporting, conformity assessment, CE marking, support periods, and market surveillance. - [EU Cyber Resilience Act Repairs and Spare Parts FAQ](/artifacts/eu/cyber-resilience-act/faq/repairs-and-spare-parts.md): CRA FAQ for repairs, spare parts, legacy products, security updates, substantial modification, and responsibility after product changes. - [EU Cyber Resilience Act Technical Documentation and Audit File](/artifacts/eu/cyber-resilience-act/technical-documentation-and-audit-file.md): Build an audit-ready CRA technical file around Article 31 and Annex VII: product scope, risk assessment, vulnerability handling, conformity evidence, testing, and retention. *Recommended next step* *Placement: after key answers* ## Use Research Copilot for CRA conformity assessment Use Research Copilot to check notified-body scope, Module B+C or Module H fit, certificate records, and surveillance evidence against cited CRA source material. - [Open Research Copilot](/solutions/research-copilot.md): Start from CRA notified-body questions and turn the cited route analysis into an assessment plan. - [Talk through implementation](/contact.md): Review route selection, notified-body scope, certificates, and evidence gaps before assessment. --- [Privacy Policy](https://www.sorena.io/privacy) | [Terms of Use](https://www.sorena.io/terms-of-use) | [DMCA](https://www.sorena.io/dmca) | [About Us](https://www.sorena.io/about-us) (c) 2026 Sorena AB (559573-7338). All rights reserved. Source: https://www.sorena.io/artifacts/eu/cyber-resilience-act/faq/notified-bodies