Conformity assessment routes under the CRA

Why classification comes first

Before any conformity assessment activity can be planned, a manufacturer needs to determine which of three tiers a product falls into: default products with digital elements, 'important' products, and 'critical' products. The CRA lists categories of important and critical products in its annexes, based on the risk that a security failure in that product class would pose — examples of important products include operating systems, password managers, firewalls and certain network management software; critical products are a narrower, higher-risk subset. A product not listed in either annex is treated as a default product.

Classification decisions should be documented and revisited whenever a product's functionality changes, since a feature addition can shift a product between categories.

The three assessment routes

• Default products: the manufacturer may carry out an internal (self) assessment against the essential requirements and issue an EU declaration of conformity.
• Important products: assessment may be based on the manufacturer's application of harmonised standards, an EU technical specification, or a certification scheme; where such standards are not fully applied, third-party assessment by a notified body may be required.
• Critical products: third-party conformity assessment by a notified body is required, reflecting the higher risk of a failure in these product categories.

Manufacturers should treat the classification and route decision as an early architectural input, not a late-stage compliance check, because the evidence a third-party assessment expects (structured technical documentation, traceable verification records) needs to be produced as the product is developed, not reconstructed afterwards.

Preparing for self-assessment

Self-assessment still requires the full technical documentation set: a risk assessment, evidence that the essential requirements have been addressed, and an SBOM. The absence of an external body does not reduce the evidentiary bar that market surveillance authorities will apply after the fact; it simply changes who checks the evidence, and when. Organisations sometimes treat self-assessment as lower effort, which is only true if the underlying engineering work — risk assessment, secure design, vulnerability handling — was already sound.

Preparing for third-party assessment

For important products routed through harmonised standards or certification, and for all critical products, the notified body will expect a structured technical file: architecture description, risk assessment methodology and results, mapping from essential requirements to design and verification evidence, SBOM, and vulnerability handling process documentation with evidence that it operates. Common causes of delay in these assessments are documentation that describes intent rather than implementation, and verification evidence that cannot be traced back to a specific requirement or risk.

• Confirm classification and the resulting assessment route before committing to a documentation structure.
• Select or track the harmonised standards applicable to the product category as they are published.
• Build the technical documentation file incrementally, keyed to the essential requirements, rather than as a single end-of-project document.
• Maintain version control on risk assessments and documentation so the assessed configuration is unambiguous.
• For third-party routes, engage a notified body early enough to understand its expected evidence format and lead time.

Ongoing conformity, not a one-off event

Conformity assessment produces a declaration tied to a specific product configuration. Substantial modifications — including security-relevant software updates in some cases — can require the assessment to be revisited. Manufacturers should define, as part of their change control process, what counts as a substantial modification for their product line, so that conformity status is tracked continuously rather than assumed to persist indefinitely after the initial assessment.

Because the critical product list and applicable harmonised standards are expected to evolve, a product's classification and required route should be reviewed periodically, not fixed once at the start of a programme.

Frequently asked questions