If the route uses a notified body, the record should contain the body name and identification number, the selected module, application or certificate references, evaluation or audit records available to the manufacturer, conditions or limitations, additions or renewals, and any open corrective-action closure evidence before release.
Software and cybersecurity checks should be explicit for machinery with safety-related software, sensor-fed operation, remote operation, autonomous behavior, digital connectivity, or safety functions that could be affected by accidental or intentional corruption. The acceptance record should show which software is safety-related, how configuration and intervention evidence is captured, and whether any cybersecurity certificate or statement is being relied on for the Annex III corruption and control-system requirements.
Close the workflow with accountable signoff, not a meeting note. Product engineering, safety/risk, quality, regulatory, software or cybersecurity, and legal or compliance reviewers should each sign only the gates they own, with unresolved assumptions converted into release blockers or post-release surveillance actions. Internal acceptance does not relieve the manufacturer of Article 10 responsibility, and a notified body acts only within its notified scope and selected conformity procedure.