This guide shows which procedure fits which class, what the missing harmonized standards mean for class I products and how the declaration and the CE marking come about. The examples are invented.
First the class, then the procedure
The CRA distinguishes four groups. What counts is the product's core functionality, not every built-in component. If you embed a browser in an operator panel, for example, that alone does not make the whole product an important product (Art. 7(1) CRA).
| Class | Examples from the law | Permitted procedures |
|---|---|---|
| Default product | Everything not listed in Annex III or IV | Module A, module B and C, module H or a certification scheme under Art. 27(9) (Art. 32(1)) |
| Important, class I (Annex III) | Routers, switches, VPN products, operating systems, network management systems | Module A only if harmonized standards, common specifications or a certification scheme at assurance level "substantial" or higher are fully applied; otherwise module B and C or module H (Art. 32(2)) |
| Important, class II (Annex III) | Firewalls, intrusion detection and prevention systems, hypervisors, tamper-resistant microcontrollers | Module B and C, module H or a certification scheme at level "substantial" or higher (Art. 32(3)) |
| Critical (Annex IV) | Hardware devices with security boxes, smart meter gateways, smartcards | European certification where a delegated act under Art. 8(1) requires it, otherwise the class II procedures (Art. 32(4)) |
Commission Implementing Regulation (EU) 2025/2392 sets out the technical descriptions of the categories in Annexes III and IV. Read it before you settle on a class, and record your reasoning in writing.
The procedures at a glance
- Module A, internal control (Annex VIII Part I). You assess the product yourself, draw up the technical documentation, issue the EU declaration of conformity and affix the CE marking. No body checks in advance.
- Module B and C (Annex VIII Parts II and III). A notified body of your choice examines the technical design, the documentation, specimens of key parts and your vulnerability handling processes. It issues an EU-type examination certificate. You then make sure in production that every product matches the approved type.
- Module H, full quality assurance (Annex VIII Part IV). The body assesses your quality system for design, development, testing and vulnerability handling and keeps it under surveillance; you keep it effective during the support period. This pays off above all when you have several products.
- European certification. Schemes under Regulation (EU) 2019/881 (Cybersecurity Act) can replace third-party assessment once the Commission designates them for this purpose by a delegated act under Art. 27(9) CRA. The best-known scheme is EUCC (Implementing Regulation (EU) 2024/482).
An EUCC certificate does not satisfy the CRA on its own. It counts only once the Commission has designated the scheme for the CRA, and only for the requirements it covers. As of 10 November 2026 no scheme has been designated under Art. 27(9); the Commission plans the delegated act on EUCC for the fourth quarter of 2026.
Harmonized standards: where things stand
Harmonized standards are the most convenient route to a presumption of conformity. If you apply them, your product is presumed to meet the requirements of Annex I they cover (Art. 27(1) CRA). That only applies once their references are published in the Official Journal of the EU.
The Commission has tasked the European standardization organizations with standardization request M/606. The work is ongoing: the first horizontal standards EN 40000-1-1 and EN 40000-1-2 passed the CEN-CENELEC vote in October 2026 and are due for publication in November 2026; the vulnerability handling standard (prEN 40000-1-3) and the product-specific standards are still drafts. As of 10 November 2026 no reference to any of these standards has been published in the Official Journal, and the Commission's page on harmonized standards lists no entry for the CRA. The presumption of conformity under Art. 27 therefore does not yet exist.
In practice this means:
- Class I: As long as no standard is cited in the Official Journal, module A is generally not open to you. Plan for module B and C or module H, and check the standards status again before you decide.
- Default products: Module A works without standards. You then describe in the technical documentation how you meet each requirement (Annex VII no. 5).
- Existing standards: IEC 62443-4-1 and 4-2 are a good technical basis, but they do not create a presumption under Art. 27.
EU declaration of conformity and CE marking
By drawing up the EU declaration of conformity you take responsibility for the product's conformity (Art. 28(4) CRA). Annex V sets out its structure:
- unique identification of the product, name and address of the manufacturer,
- the statement of sole responsibility and of conformity,
- references to the harmonized standards, common specifications or certification applied,
- where relevant, the notified body with its number, the procedure and the certificate number,
- place, date, name, function and signature.
If the product falls under further EU acts that require their own declaration, such as the Machinery Regulation, you issue a single declaration for all of them (Art. 28(3)). The simplified declaration under Annex VI is one short sentence with the internet address of the full version.
You affix the CE marking before placing the product on the market (Art. 30(3)). For hardware it goes on the product, visible, legible and indelible, or, where that is not possible, on the packaging and the declaration. For software it goes on the declaration or on the website accompanying the product, easily and directly accessible (Art. 30(1)). Where a notified body is involved under module H, its identification number follows the CE marking (Art. 30(4)).
Key dates
- 11 June 2026: The rules on notified bodies apply (Chapter IV, Art. 71(2) CRA). Since then, Member States can notify bodies.
- 11 September 2026: The reporting obligations under Art. 14 apply, including to products already on the market (Art. 69(3)).
- 11 December 2027: All other obligations apply, including conformity assessment, the declaration and the CE marking. Products placed on the market before that date are only affected after a substantial modification (Art. 69(2)).
If you need a notified body, contact one early. A type examination requires documentation that is largely complete.
Example from automation
The example is invented. A maker of automation equipment places three products on the market:
| Product | Class | Chosen procedure |
|---|---|---|
| KB-800 controller with web interface | Default | Module A |
| IR-20 industrial router | Important, class I (Annex III no. 12) | Module H, since no harmonized standard is cited in the Official Journal |
| FW-5 industrial firewall | Important, class II (Annex III class II no. 2) | Module H |
- Decision: Instead of two type examinations, the manufacturer has its quality system assessed under module H. New versions then run through the same system.
- Declaration: The controller also falls under the Machinery Regulation. It gets one joint declaration for both acts.
- Timing: The router and the firewall need a notified body. The manufacturer approaches one as soon as the documentation is largely in place and schedules the assessment before the first placing on the market from 11 December 2027.
Checklist
- Each product's class is recorded with reasons, checked against Annexes III and IV and Implementing Regulation (EU) 2025/2392.
- A procedure is chosen per product and fits its class.
- The status of harmonized standards, common specifications and certification schemes is checked and dated.
- For module B and C or H, a notified body has been approached.
- The technical documentation under Annex VII is complete.
- The EU declaration of conformity follows Annex V and names every applicable act.
- Where and how the CE marking appears is decided, for software the website.
- The declaration and documentation are kept for ten years or for the support period, whichever is longer.
- New versions trigger a check whether the assessment still holds.
Conformity assessment in Complass
Classes in a spreadsheet, certificates in an inbox, the declaration as a Word file on a shared drive: that is how you lose track of which version was assessed how. In Complass everything sits in the product file:
- Class with reasons: For each product you record whether it is default, important class I or II, or critical. From class I upward a reason is required.
- Procedure per version: You choose module A, module B and C, module H or EUCC. For class II and critical products Complass does not accept module A. You can enter a notified body only with a procedure that involves one.
- Ready for the declaration: The completeness check shows what is still open. It does not assess conformity; that decision stays with you.
- Declaration as a draft: The EU declaration of conformity and the simplified declaration are drafted from the file, as one joint declaration for the CRA and the Machinery Regulation where both apply. Release freezes them with a checksum.
- Signature and CE: You sign outside Complass and upload the signed declaration. The date of the CE marking is kept with the version.
Frequently asked questions
Can we use module A for a class I product?
Only if you have fully applied harmonized standards, common specifications or a European certification scheme at level "substantial" or higher (Art. 32(2) CRA). As long as nothing of the kind is published in the Official Journal, module B and C or module H remain.
We only sell software. Where does the CE marking go?
On the EU declaration of conformity or on the website accompanying the software product. That section must be easily and directly accessible to consumers (Art. 30(1) CRA).
Does an EUCC certificate replace the conformity assessment?
Not automatically. The Commission first has to designate the scheme by a delegated act under Art. 27(9) CRA, and it covers only the requirements the scheme itself addresses. Check the current status.
Is there any relief for small companies?
Fees for conformity assessment must take into account the interests of micro, small and medium-sized enterprises (Art. 32(6)). Micro and small enterprises can use a simplified format for the technical documentation once the Commission has laid down the form by implementing act (Art. 33(5)).
Do products already on the market need a new assessment?
Only if they are substantially modified after 11 December 2027 (Art. 69(2) CRA). The reporting obligations under Art. 14, however, have applied to them since 11 September 2026.
In a demo we use the demo company to show you how a product file turns into the declaration of conformity.
Request a demo Try it for 14 days
Sources
- Regulation (EU) 2024/2847 (Cyber Resilience Act), Art. 7, 8, 27, 28, 30, 32, 33, 69, 71, Annexes III to VIII, EUR-Lex
- Commission Implementing Regulation (EU) 2025/2392 on the technical description of important and critical products
- Commission Implementing Regulation (EU) 2024/482 (EUCC)
- European Commission: standardization request M/606, page on harmonized standards and CRA implementation page
- BSI (German Federal Office for Information Security): Technical Guideline TR-03183 "Cyber Resilience Requirements for Manufacturers and Products"
Read more
- Guide "Does the CRA apply to me? Checking products with digital elements"
- Guide "Technical documentation under the CRA: content and upkeep"
- Guide "CRA and IEC 62443: where they overlap and what is missing"
- Guide "SBOM: what the CRA requires and how to build your bill of materials"
- Guide "CRA reporting duty for manufacturers: what Art. 14 requires and how to report"
- Whitepaper on the CRA for manufacturers
- CRA in Complass
Not legal advice. This guide gives a general overview and does not replace an assessment of the individual case. The wording of Regulation (EU) 2024/2847 in the Official Journal is authoritative. As of November 2026.