The modules
The CRA uses the classic New Legislative Framework modules:
- Module A — internal control (self-assessment). You perform the assessment yourself, draw up the technical documentation, sign the declaration of conformity, and affix CE marking. No notified body involved.
- Module B + C — EU type-examination plus conformity to type. A notified body examines a representative sample and issues a type-examination certificate; you then declare that production units conform to the approved type.
- Module H — full quality assurance. A notified body approves and audits your quality system covering design, development and final inspection. Attractive for manufacturers with many products and an existing ISO 9001/IEC 62443-4-1 quality system.
- European cybersecurity certification under the Cybersecurity Act at assurance level "substantial" or higher can be used in place of the above for some products, where a scheme exists and the Commission has specified it.
Which route applies
| Product class | Route |
|---|---|
| Default (not in Annex III or IV) | Module A — self-assessment |
| Important, Class I | Module A only if harmonised standards / common specifications / EU cybersecurity certification are applied in full; otherwise B+C or H |
| Important, Class II | B+C or H (or an appropriate certification scheme) |
| Critical (Annex IV) | B+C or H, and possibly mandatory European cybersecurity certification once the Commission requires it |
Note the trap in Class I: self-assessment is conditional. If harmonised standards do not yet cover your requirements — which is the situation for much of the transition period — or you apply them only partially, you fall into the notified body route.
Practical planning
Book notified body capacity early. Bodies can only be designated from June 2026 and demand will spike before December 2027. If your product is Class I with an unclear standards position, or Class II, treat capacity as a long-lead item like silicon.
Module H suits portfolios. If you ship many variants from a common platform, an approved quality system amortises far better than per-product type examinations. It also matches how embedded platform teams already work.
Type examination is per type, not per unit — but a substantial modification invalidates the certificate. Design your variant strategy so cosmetic and configuration differences do not create new types.
What you sign at the end
Whatever the route, the manufacturer draws up and signs the EU declaration of conformity, keeps the technical documentation for at least ten years after placing on the market (or the support period, whichever is longer), and affixes the CE marking. Nobody else takes that liability for you — a notified body certificate does not transfer responsibility.