Conformity Assessment Procedure

A Conformity Assessment Procedure is the systematic process by which a manufacturer evaluates whether a product complies with the essential requirements of applicable EU legislation before placing it on the market. The New Legislative Framework (NLF) defines a set of standardised assessment modules (A through H) that EU regulations can select from. Each module specifies who performs the assessment (the manufacturer alone, or a Notified Body), what is examined (design, production, or both), and what evidence is produced (technical documentation, test reports, quality system certificates). The chosen module determines the rigour and cost of the compliance path. Under the CRA, the applicable procedure is determined by the product's risk class.

The CRA establishes three assessment routes linked to product classification:

Default-class products (the majority of products with digital elements): Manufacturers may use internal production control (analogous to Module A). They produce technical documentation per Annex VII, conduct their own conformity assessment against Annex I essential requirements, issue a declaration of conformity, and affix the CE mark. No third-party involvement is required.

Important Class I products (higher-risk but not the highest tier): Manufacturers may self-certify by applying harmonised standards or common technical specifications. Alternatively, they may involve a Notified Body.

Important Class II products (highest-risk categories): Third-party assessment by a Notified Body is mandatory unless the product fully complies with published harmonised standards. Available routes are EU Type-Examination (Module B + C/D/H) or full quality assurance (Module H).

Regardless of which assessment route is followed, the CRA requires manufacturers to produce and retain technical documentation that demonstrates conformity. This documentation must include: a general product description and intended use; design and development records including threat models and risk assessments; a list of applied harmonised standards or common technical specifications; a description of the secure development lifecycle processes; vulnerability handling policies and procedures; test reports; and the declaration of conformity itself. This documentation must be retained for ten years after the product is placed on the market and made available to market surveillance authorities on request. CVD Portal's compliance module generates many of the vulnerability-handling documentation components required for the technical file.

Manufacturers frequently encounter the following problems when preparing for conformity assessment:

• Misclassifying product risk: Assigning a product to default class when it meets Important Class criteria invalidates the entire conformity assessment.
• Incomplete technical documentation: Missing threat models, absent SBOM, or undocumented vulnerability handling processes are the most common gaps found during assessment.
• Stale documentation: Technical files that have not been updated after significant product changes no longer reflect the assessed product.
• Missing declaration of conformity: Products must not be placed on the market without a signed, version-specific declaration of conformity.
• No update mechanism: Failing to document how security updates will be delivered throughout the support period is a mandatory Annex I requirement often overlooked.