← Hiring CRA experts
How do you choose a notified body for the Cyber Resilience Act?
Choose a body listed in the European Commission's NANDO database as notified under Regulation (EU) 2024/2847 for the module you need, either Module B with Module C or Module H, and confirm its lead time early.
Key takeaways
- Most products use Module A self-assessment, and a notified body is needed for Class II important products, for critical products, and for Class I products without fully applied harmonised standards.
- The CRA rules on notified bodies applied from 11 June 2026, and Article 35(2) asks Member States to aim for enough notified bodies by 11 December 2026.
- On 17 October 2026, NANDO listed no active notified body under the Cyber Resilience Act, so check the database again before you plan a date.
- Article 39 requires a notified body to be impartial, so the body must not design, build or consult on the product it assesses.
- Demand will rise before the CRA applies in full on 11 December 2027, so contact a body early.
Last reviewed 17 October 2026
Published by Porta Regulus B.V. No paid placement. No provider is named or ranked.
Which CRA requirements does this service give evidence for?
- Third-party conformity assessment under Article 32 (Module B with Module C, or Module H)
Which credentials should the provider hold?
| Credential | Held by | What it shows |
|---|---|---|
| Notification under Regulation (EU) 2024/2847 in NANDOEuropean Commission (NANDO database) | Company | A Member State notified the body for the CRA, for the scope and modules listed. Only this makes a body a CRA notified body. |
What should you ask the provider for?
- The body's four-digit notified body number and its CRA scope in NANDO.
- The modules the body offers for your product class.
- The harmonised standards or other specifications the body expects you to apply.
- A lead time and a fixed fee that does not depend on the result.
Which red flags should stop the hire?
- A claim of CRA designation that NANDO does not show.
- An offer to consult on your product and then assess the same product.
- A fee that depends on passing the assessment.
Which checks apply to every CRA expert?
- Professional liability insurance that covers the work, with the amount in writing.
- Independence from your own developers and from any supplier whose component is in scope.
- A fixed price for a written scope with a defined end.
- Names and credentials of each person who does the work.
- A deliverable you may share with a notified body and a market surveillance authority.
- Data handling inside the EU, or a written basis for any transfer.
Find out which of these services your product needs
CVD Portal lists the open Annex I gaps for each product and names the kind of expert that closes each one.
This page is part of the EU Cyber Resilience Act guide, which explains Regulation (EU) 2024/2847 article by article.