Annex VI sets out the conformity assessment procedures that manufacturers must follow to demonstrate CRA compliance. It describes Module A (internal control / self-declaration) for default-class products and the third-party assessment modules applicable to Annex III Class I and Class II products. Choosing the correct procedure and executing it rigorously is the foundation of valid CE marking under the CRA.
Module A: Internal Control for Default-Class Products
Module A is the self-certification procedure available to manufacturers of default-class products — those not listed in Annex III. Under Module A, the manufacturer:
- Conducts a cybersecurity risk assessment for the product, documenting the threat landscape, identified risks, and controls implemented
- Designs and manufactures (or develops, for software) the product to meet the essential requirements in Annex I
- Prepares technical documentation in accordance with Annex VII, comprising the full evidence base for compliance
- Draws up and signs the EU Declaration of Conformity under Annex V, taking sole responsibility for compliance
- Affixes the CE marking to the product, packaging, or accompanying documentation
No external assessment, notified body certificate, or third-party audit is required for Module A. The manufacturer's technical documentation must, however, be sufficient to allow a competent authority to verify compliance on request. Documentation gaps are a common cause of Module A declarations being challenged.
Third-Party Modules for Annex III Class I Products
Class I products require notified body involvement. Annex VI provides three options:
- Module D (production quality management system) — the manufacturer implements an ISO 9001-based quality system covering production, and the notified body audits it
- Module F (product verification) — the notified body tests every product or a statistical sample at manufacture
Option 2 — Technical documentation assessment: For Class I products manufactured using harmonised standards that provide full coverage of essential requirements, a notified body may accept a technical documentation review instead of type examination. This is a lighter-touch option suitable where strong standards exist and the manufacturer's documentation is comprehensive.
Option 3 — Full quality assurance (Module H): The manufacturer establishes a quality management system covering design, development, production, and post-market activities. The notified body audits and certifies the QMS. Module H is a holistic option suited to manufacturers with mature quality management systems.
Third-Party Assessment for Annex III Class II Products
Class II products — the most critical category under Annex III — require the most rigorous assessment. Annex VI mandates EU-type examination (Module B) in all cases. The notified body must physically examine and test a representative product specimen and issue a type examination certificate.
- Module D (production quality management system assessed by notified body)
- Module F (product verification by notified body)
The full quality assurance Module H is also available for Class II products as an alternative to Module B + Module D/F. Under Module H, the notified body's QMS audit covers both the design and production phases, providing an integrated assessment.
For Class II products, the notified body's scope of assessment is comprehensive. Test reports, design documentation, security architecture reviews, penetration testing results, and vulnerability management processes all form part of the assessment evidence base. Manufacturers should expect the assessment process to be extensive and plan accordingly.
Selecting the Right Module for Your Product
Selecting the appropriate conformity assessment module requires understanding both the product's classification and the manufacturer's operational model:
Default class: Module A only — no choice required.
Class I with harmonised standards: Technical documentation review (Option 2) may be the most efficient pathway if applicable harmonised standards cover all essential requirements.
Class I without harmonised standards or with novel products: Module B + Module D or F provides the most comprehensive notified body validation for products where standards coverage is incomplete.
Class II: Module B is mandatory. The choice between Module D/F for production depends on the manufacturer's quality management maturity and production volumes. High-volume manufacturers with mature QMS may prefer Module D for its systemic approach; lower-volume or bespoke product manufacturers may find Module F's per-unit or statistical verification more practical.
Ongoing compliance: Module H is appropriate for manufacturers with large, continuously updated product portfolios who want an integrated quality assurance framework rather than product-by-product assessments.
What Technical Documentation Must Support the Assessment
Regardless of the module used, the conformity assessment must be supported by comprehensive technical documentation as specified in Annex VII. For Module A, the manufacturer self-prepares and holds this documentation. For Module B and other third-party modules, this documentation is submitted to the notified body for review and forms the basis of the assessment.
Key documentation elements that all modules require:
- Product description and intended use
- Design documentation including architecture, interfaces, and security controls
- Cybersecurity risk assessment with identified threats and mitigations
- SBOM (Software Bill of Materials)
- Test reports for security testing including penetration test results
- CVD policy reference
- Security update mechanism description
- EU Declaration of Conformity
The quality and completeness of technical documentation directly determines the speed and cost of third-party assessments. Notified bodies report that documentation quality is the single biggest variable in assessment timelines.
CVD Portal helps you comply with Annex VI automatically.
Public submission portal, 48-hour acknowledgment tracking, Article 14 deadline alerts, and CSAF advisory generation. Free forever.
Start your free portalFrequently asked
Can I switch from Module A to Module B after initial market placement?+
Yes. A manufacturer who initially self-certified under Module A can voluntarily upgrade to a third-party assessed module at any time. A Module B certificate from a notified body provides stronger compliance evidence and may be required by some business customers. The CE marking remains the same regardless of which conformity assessment route was used.
Does a Module H quality management certificate mean I don't need product-level testing?+
Module H covers the quality management system as a whole, including design and production processes, but the notified body will typically review product-specific documentation and test data as part of the QMS audit. The QMS audit does not replace product-specific technical documentation — it assesses whether the manufacturer's processes are capable of consistently producing compliant products.
How long is a Module B type examination certificate valid?+
Module B certificates are typically valid for a defined period — often three to five years — and must be renewed. Certificates become invalid if significant changes are made to the product that affect the basis of the assessment, if the referenced harmonised standards are superseded, or if the notified body's notification is withdrawn. Manufacturers must monitor certificate validity and plan renewals in advance.
Are Module A technical documentation requirements as demanding as Module B requirements?+
The technical documentation content requirements are the same under Annex VII regardless of which conformity assessment module is used. The difference is that under Module A, the manufacturer self-prepares and holds the documentation without external review, while under Module B the documentation is submitted to and assessed by a notified body. The self-prepared Module A documentation must be of the same quality and completeness — the absence of external review does not reduce the documentation standard.
Need a CVD policy that satisfies Annex VI?
Download a free CRA-compliant template and deploy it in minutes.