Self-assessment vs Notified Body conformity assessment

What is different

• Who performs the assessment: self-assessment is carried out entirely by the manufacturer under its own quality and technical documentation; Notified Body assessment involves an accredited third-party organisation examining the technical file, and in some routes, the product itself.
• Applicable products: self-assessment (internal control) is available for default-category products; products listed as 'important' (Annex III, Class I and II) face escalating requirements up to mandatory third-party involvement for Class II, and products listed as 'critical' (Annex IV) face the strictest route, generally including European cybersecurity certification once applicable schemes exist.
• Evidence burden: self-assessment still requires a full technical documentation file and risk assessment, but the manufacturer is the sole party judging sufficiency; third-party assessment introduces an external, accountable judgement on the same evidence.
• Timeline and cost: self-assessment can proceed on the manufacturer's own schedule; Notified Body assessment adds lead time for booking, review cycles and potential requests for further evidence, and carries a direct cost for the assessment itself.

What overlaps

Both routes require the same underlying substance: a risk assessment appropriate to the product, a technical documentation file meeting the CRA's Annex VII content requirements, evidence of a secure development lifecycle, and a vulnerability handling process operating for the product's expected support period. The difference is who reviews that evidence and how formally, not whether it needs to exist. A manufacturer that only builds evidence sufficient for self-assessment will need to redo work if a product's classification changes or a customer contractually demands third-party assurance regardless of the legal minimum.

In both routes, use of harmonised standards, once published, creates a presumption of conformity that simplifies the manufacturer's own argument, whether that argument is reviewed internally or by a Notified Body.

Which applies to you

• Your product does not appear in Annex III or Annex IV: self-assessment (internal control) is generally available, provided you can produce complete technical documentation and evidence.
• Your product appears in Annex III as 'important', Class I (e.g. certain identity management systems, firewalls, browsers): you can generally still self-assess if you fully apply harmonised standards, otherwise third-party assessment is required.
• Your product appears in Annex III as 'important', Class II, or in Annex IV as 'critical': third-party involvement is generally mandatory regardless of standards applied, and critical products may require certification under a European cybersecurity certification scheme once available.
• You are unsure of your product's classification: resolve this first, since it determines not only the assessment route but also the depth of evidence you need to prepare from the outset.

Frequently asked questions