Conformity Assessment Procedures: Module A vs Third-Party Assessment

Article 25 operates within the CRA's three-tier product classification system. Products are classified as:

Default class: All products with digital elements not listed in Annex III or Annex IV. This is the largest category, covering the majority of consumer and commercial products.

Class I (Important Products): Products listed in Annex III Class I — including smart home products with security functions, password managers, network monitoring tools, VPNs, and general-purpose operating systems. These present elevated cybersecurity risks due to their network-facing functions or their use in critical infrastructure.

Class II (Critical Products): Products listed in Annex III Class II — including hypervisors, firewalls, tamper-resistant hardware, industrial control systems, and other products that are particularly critical to cybersecurity. These carry the highest assessment requirements.

The Annex IV 'highly critical' list includes products subject to European cybersecurity certification schemes, which may require European certification rather than the standard CRA conformity assessment.

For default-class products, Article 25 allows manufacturers to use Module A — the internal control conformity assessment procedure. Under Module A:

1. The manufacturer carries out the risk assessment and designs the product to meet the essential requirements
2. The manufacturer prepares and maintains the technical documentation under Annex VII
3. The manufacturer draws up the EU Declaration of Conformity
4. The manufacturer affixes the CE marking

No external or third-party involvement is required under Module A. The manufacturer takes sole responsibility for the declaration of conformity and for maintaining the supporting technical evidence.

Module A is available regardless of whether harmonised standards are used — however, using harmonised standards creates the presumption of conformity under Article 8, which strengthens the manufacturer's compliance position.

For Class I products, Article 25 requires third-party involvement in the conformity assessment. Manufacturers of Class I products have three options:

Option 1 — EU-type examination (Module B + Module D/E/F): The manufacturer submits a representative product model to a notified body for type examination. The notified body assesses the product against the essential requirements and issues a type examination certificate. The manufacturer then uses an additional module (D, E, or F) covering production quality assurance.

Option 2 — Quality management system assessment (Module H): The manufacturer establishes a quality management system covering design, manufacture, and post-market activities, and has this system assessed and certified by a notified body.

Option 3 — Technical documentation review: For Class I products where harmonised standards are applied, a notified body reviews and validates the technical documentation, providing additional assurance beyond the manufacturer's self-declaration.

The manufacturer chooses which option to use, but must complete the chosen procedure fully before affixing the CE marking.

Class II products face the most stringent assessment requirements. For these products, Article 25 requires EU-type examination (Module B) combined with a production quality assurance module (Module D or F) or a full quality assurance system assessment (Module H).

For Class II products, there is no option for a simplified technical documentation review — a full third-party type examination of the product by a notified body is mandatory. This means the notified body must physically assess a representative product unit, including technical testing against the essential requirements.

Manufacturers of Class II products face significantly longer assessment timelines and higher costs than default-class manufacturers. Products in this category include hardware security modules (HSMs), smart card readers, firewalls for critical infrastructure, industrial control system components, and hypervisors used in critical environments.

Given the assessment requirements, manufacturers of Class II products should engage notified bodies very early — 18 to 24 months before planned market launch is not excessive.

Article 25 also addresses the interaction between CRA conformity assessment and European cybersecurity certification under Regulation (EU) 2019/881 (the Cybersecurity Act). Where the European Commission designates a European cybersecurity certification scheme as equivalent to or providing a higher level of assurance than CRA conformity assessment, compliance with that scheme may be used as an alternative or complementary conformity assessment pathway.

This provision is particularly relevant for products falling under Annex IV of the CRA, which lists highly critical products that may be subject to mandatory certification. As European cybersecurity certification schemes are developed under ENISA's coordination, manufacturers of the most critical products should monitor scheme developments that may apply to their product categories.

For most manufacturers of standard products, European cybersecurity certification is an optional enhancement to compliance, not a substitute for the CRA conformity assessment procedures.