EU Type-Examination

EU Type-Examination (Module B under the New Legislative Framework) is a formal conformity assessment procedure conducted by an accredited Notified Body. The manufacturer submits a representative sample of its product — the 'type' — along with comprehensive technical documentation. The Notified Body examines the documentation and tests the product to verify it meets the essential requirements of the applicable EU legislation. If satisfied, the body issues an EU Type-Examination Certificate. This certificate does not by itself authorise placing the product on the market; it must be combined with a production conformity module (typically Module C, D, or H) that ensures all manufactured units conform to the examined type. The complete procedure is documented in Annex VIII of most EU harmonisation legislation.

Under the CRA, EU Type-Examination is one of the conformity assessment routes available for Important Class II products. Class II products include particularly sensitive categories such as hypervisors, firewalls, industrial automation controllers, and smart meters. For these products, a manufacturer may choose between: (a) EU Type-Examination (Module B) plus a production quality assurance module, or (b) full quality assurance assessment (Module H) by a Notified Body. A third route — self-declaration based on full application of a harmonised standard — is available only when relevant harmonised standards have been published in the OJEU. The majority of Class II manufacturers will require Notified Body involvement via one of these routes.

For CRA purposes, EU Type-Examination involves a cybersecurity-focused assessment rather than just physical or functional testing. The Notified Body will review: the threat model and risk assessment underpinning the product's security design; the secure development lifecycle documentation, including evidence of security testing; the vulnerability handling policy and PSIRT processes; the update mechanism and its integrity protections; default security configuration settings; and the technical documentation file required under Annex VII. The body may conduct or commission independent penetration testing of the product. The examination results in detailed findings, and the manufacturer must address any identified non-conformities before a certificate is issued.

An EU Type-Examination Certificate remains valid as long as the product continues to conform to the examined type and the underlying legislation remains unchanged. Manufacturers must inform the issuing Notified Body of any modifications to the approved type — including significant software updates, hardware revisions, or changes to security-relevant components. The Notified Body determines whether the modification is significant enough to require a new examination or supplementary assessment. Certificates typically have a defined validity period (three to five years) and must be renewed on expiry. Losing a valid certificate while the product is on the market creates a compliance gap that MSAs may act upon.