Conformity assessment

Under the CRA, the applicable conformity assessment route depends on the product's classification. Default products can generally use internal control based on technical documentation review. Important products with digital elements, and critical products, require either the involvement of a notified body or the application of specified harmonised standards, depending on the exact category and whether standards are available.

The stages involved

• Establishing the correct product classification against the CRA's default, important and critical categories.
• Selecting the applicable assessment module for that classification.
• Compiling technical documentation covering risk assessment, design, and vulnerability handling processes.
• Where required, engaging a notified body and responding to its findings.
• Issuing the EU declaration of conformity and affixing CE marking.

Conformity assessment is not a one-off event. Substantial changes to the product, or changes to its intended purpose, can require reassessment, and vulnerabilities discovered after the product is on the market feed back into whether the original assessment still holds. Manufacturers who treat the assessment as a static gate tend to under-invest in the ongoing evidence needed to defend it later.

Getting the classification right early avoids the most common and expensive failure mode: discovering during assessment preparation that the intended route does not apply to the product as built.