CRA Self-Assessment vs Notified Body Audit

Conformity Assessments Explained

Before placing a product on the EU market, it must undergo a conformity assessment to verify it meets CRA requirements.

Module A: Self-Assessment (The Default)

Applies to products not listed in Annex III or IV, which covers most software products. You (the manufacturer) perform risk assessments, generate SBOMs, and maintain technical documentation internally. No external auditor is hired. You issue your own Declaration of Conformity.

Module B+C / Module H: Notified Body Audits

Applies to 'Important' Class II products (e.g., hypervisors, firewalls), to Class I products (e.g., identity management systems) unless harmonised standards, common specifications or certification schemes are applied in full, and to 'Critical' products where no European cybersecurity certification scheme is required under Article 8(1). For these, a Notified Body notified by an EU member state assesses the design or quality system before the product is placed on the market.

Cost Implications

Module A essentially costs engineering time. Notified body audits can cost between €20,000 and €100,000+ per product lifecycle.