Key takeaways
- Module A — internal control (self-assessment).
- This is the point most worth hedging on.
- Your product's tier under Annex III and IV decides which of the Article 32 routes are even available to you.
- Classify the product first.
Under the Cyber Resilience Act, whether you can sign your own declaration of conformity or must pay a notified body to assess your product depends on where your product sits in the regulation's three-tier classification: a default product can usually self-assess, an Annex III "important" product can sometimes self-assess and sometimes cannot, and an Annex IV "critical" product is built around third-party involvement from the start. This guide walks through Article 32's conformity assessment routes and how they connect to that classification, as covered by consistent secondary legal analysis of the regulation.
A note on sourcing: EUR-Lex's own page for Regulation (EU) 2024/2847 returned a blank response rather than rendering article or annex text when this guide was researched — the same issue encountered researching other CRA guides on this site. The module and article detail below is cross-checked across multiple independent secondary sources (a CRA article-by-article reference site, a legal-tracker reproduction of Article 32, and the European Commission's own CRA summary page), which agree closely with each other. Treat specific annex numbering and article sub-points as a starting point to re-verify against the official Official Journal text before relying on them in a conformity assessment submission.
What a conformity assessment procedure actually is
A conformity assessment procedure is how a manufacturer demonstrates — to itself, to a market surveillance authority, or to a notified body — that a product with digital elements meets the Annex I essential cybersecurity requirements before it is placed on the market. It is separate from the requirements themselves: see CRA Annex I explained for what must actually be built. Article 32 gives manufacturers, depending on their product's classification, a choice among up to four routes, per corroborated secondary analysis:
- Module A — internal control (self-assessment). The manufacturer assesses its own product's conformity, draws up the technical documentation, and signs the EU declaration of conformity, without a notified body.
- Modules B + C together — EU-type examination plus internal production control. A notified body examines a representative sample ("type") of the product (Module B); the manufacturer then has to manufacture every unit to conform to that approved type (Module C). Per secondary analysis, Module B is always paired with Module C under the CRA, not used alone.
- Module H — full quality assurance. A notified body assesses the manufacturer's quality management system itself, rather than a product sample, and checks that the system reliably produces conforming products.
- A European cybersecurity certification scheme, where one has been adopted under the Cybersecurity Act (Regulation (EU) 2019/881) and the Commission has made it relevant for a given product category — the EUCC scheme is the first such scheme to exist, though it was not built specifically for the CRA.
Where does the module structure actually live in the regulation?
This is the point most worth hedging on. Several independent secondary sources consistently place the Module A/B/C/H conformity assessment procedures in Annex VIII of the final, adopted Regulation (EU) 2024/2847 — not Annex VI. Those sources also explain why the confusion exists: an early 2022 European Commission proposal for the CRA numbered this same material as "Annex VI," but by the time the regulation was adopted in 2024 the annexes had been renumbered, and the final Annex VI instead holds the model structure for the simplified EU declaration of conformity. Because EUR-Lex's own page for the regulation would not render article or annex text during this guide's research, this numbering should be treated as well-corroborated secondary analysis rather than a verified primary-source citation — confirm the annex number against the current Official Journal text before citing it in a technical file or a submission to a notified body.
How classification decides your route
Your product's tier under Annex III and IV decides which of the Article 32 routes are even available to you. Per secondary analysis of Article 32's paragraphs:
| Tier | Assessment routes available | Can you self-assess (Module A)? |
|---|---|---|
| Default (not listed in Annex III or IV) | Module A, or Modules B+C, or Module H, or a certification scheme — manufacturer's choice | Yes, always an option |
| Annex III important, Class I (e.g. browsers, password managers, VPN products, routers/modems/switches, smart home security devices) | Module A only if harmonised standards, common specifications, or a certification scheme at assurance level at least "substantial" have been fully applied to the relevant requirements; otherwise Modules B+C or Module H | Conditional — depends on standards coverage |
| Annex III important, Class II (e.g. hypervisors, firewalls/IDS/IPS, tamper-resistant microprocessors/microcontrollers) | Modules B+C, Module H, or a certification scheme at assurance level at least "substantial" | No — third-party involvement always required |
| Annex IV critical (e.g. hardware security modules, smart meter gateways, smartcards/secure elements) | A European cybersecurity certification scheme where the Commission has required one; otherwise the Class II third-party procedures | No |
Two qualifications worth noting from secondary analysis:
- Free and open-source software carve-out. Per secondary analysis of Article 32(5), an Annex III important product (Class I or II) that is free and open-source software can still use Module A self-assessment if its technical documentation is made publicly available when the product is placed on the market — this exception is specific to open-source and does not extend to Annex IV critical products.
- SME fee reduction. Per secondary analysis of Article 32(6), notified bodies are expected to reduce their fees proportionately for micro and small enterprises going through a third-party route, though the exact mechanism is a matter for the notified bodies and national notifying authorities rather than a fixed percentage set directly in the article.
What a device maker should do now
Classify the product firstWork out whether it falls under Annex III or Annex IV before planning the assessment route — see CRA Annex III and IV: important and critical products explained. The classification decides which routes are even on the table. If you land in default or Class I, check harmonised-standards coverage earlyFor default products, Module A is available regardless; for Class I, whether you can still self-assess depends on fully applying harmonised standards, common specifications, or a "substantial" certification scheme once those references exist — don't assume self-assessment stays available by default. If you land in Class II or Annex IV, start notified-body or certification-scheme conversations nowThird-party capacity and certification-scheme timelines are a planning constraint, not paperwork you can leave until the end. Keep the technical documentation current regardless of routeModule A, Modules B+C, and Module H all rest on the Annex VII technical documentation being accurate and complete — a notified body will review it, and a market surveillance authority can request it even under self-assessment. Re-confirm annex and article numbering against the official text before a submissionThis guide reflects corroborated secondary analysis of Article 32 and the (likely Annex VIII) module structure, not a direct reading of the Official Journal text, because EUR-Lex did not render that text during research.
SoftWSP's firmware security work helps you work out where your product sits under Annex III/IV and what evidence a self-assessment or a notified body will expect to see: see device firmware security. For the underlying essential requirements any route has to demonstrate, see CRA Annex I explained, and for the day-to-day compliance tasks, see the CRA checklist for device makers.
This guide is general information, not legal advice, and summarises secondary analysis of Regulation (EU) 2024/2847 Article 32 and its conformity assessment annex where the official EUR-Lex text could not be directly retrieved during research; confirm against the current official text before relying on it.
Sources
- Regulation (EU) 2024/2847 (Cyber Resilience Act), Article 32 and Annexes III, IV and VIII, Official Journal text, EUR-Lex
- European Commission: Cyber Resilience Act, summary of the legal text
- Springlex: Cyber Resilience Act, Article 32 — Conformity assessment procedures for products with digital elements
- Acquislaw: Cyber Resilience Act, Article 32 — full text, verified
- cvdportal: CRA Annex VIII — Conformity Assessment Procedures Explained
Frequently asked questions
What is a CRA conformity assessment procedure?
It is the process Article 32 of Regulation (EU) 2024/2847 requires a manufacturer to carry out, or have carried out, before placing a product with digital elements on the market, to demonstrate that the product meets the Annex I essential cybersecurity requirements. Per corroborated secondary legal analysis, the available procedures are internal control (Module A, self-assessment), EU-type examination combined with internal production control (Modules B+C, via a notified body), full quality assurance (Module H, via a notified body), and, where one exists, a European cybersecurity certification scheme.
Can every manufacturer just self-assess under Module A?
No. Module A self-assessment is the default route only for products that are not listed in Annex III or Annex IV. Per secondary analysis of Article 32, Annex III 'important' Class I products can usually still self-assess, but only where the manufacturer has fully applied harmonised standards, common specifications, or a cybersecurity certification scheme at assurance level at least 'substantial' for the relevant essential requirements; otherwise Class I products need third-party involvement too.
Which products definitely need a notified body?
Per secondary analysis, Annex III Class II important products (such as hypervisors, firewalls/IDS/IPS, and tamper-resistant microprocessors or microcontrollers) must always go through third-party assessment: EU-type examination plus internal production control, full quality assurance, or certification at 'substantial' level — self-assessment is not an option for this class. Annex IV critical products face the strictest route, built primarily around a European cybersecurity certification scheme where the Commission has made one mandatory, falling back to the Class II third-party procedures where no scheme is available yet.
Is the module structure in 'Annex VI' of the CRA?
Not in the final adopted text. Several independent secondary sources researched for this guide — including a CRA article-by-article reference site and a legal-tracker summary of Article 32 — consistently place the Module A/B/C/H conformity assessment procedures in Annex VIII of Regulation (EU) 2024/2847, not Annex VI. Those same sources note that an early 2022 Commission proposal did number this material as 'Annex VI,' and that in the final text Annex VI instead holds the model EU declaration of conformity. EUR-Lex's own page for the regulation returned a blank response rather than article or annex text during this guide's research, so treat the Annex VIII numbering here as secondary-source-corroborated but to be confirmed against the official Official Journal text before citing it in a compliance submission.
Does open-source software get a self-assessment exception even for important products?
Per secondary analysis of Article 32(5), free and open-source software that falls under an Annex III important-product category can still use the standard self-assessment procedure if its technical documentation is made publicly available when the product is placed on the market — an exception that does not extend to Annex IV critical products or to closed-source important products outside that carve-out.
In this cluster
