Module H: full quality assurance

Module H is the conformity assessment procedure of the Cyber Resilience Act (CRA) in which a notified body examines no type of product but approves the manufacturer’s quality system and then keeps it under continuous surveillance. Article 32(1), point (c) names it; Annex VIII, Part IV sets it out in full.

What is declared at the end is the same as in the other procedures: that the products concerned meet the essential cybersecurity requirements in Part I of Annex I, and that the vulnerability handling processes put in place by the manufacturer meet the requirements in Part II. The manufacturer declares this on its sole responsibility. Point 1 speaks of “products with digital elements or product categories”, so the scope is not tied to one model.

What is approved is the system, not the item

Point 2 requires an approved quality system covering design, development, final product inspection and testing, and vulnerability handling. Its effectiveness must be maintained throughout the support period, and the manufacturer is subject to surveillance under point 4.

That is the real difference from the other third-party route. Under module H the notified body examines no samples. Under point 3.3 the auditing team reviews the technical documentation submitted under point 3.1(b) in order to verify the manufacturer’s ability to identify the applicable requirements and to carry out the necessary examinations. What is assessed is capability, not an individual item. Anyone who would rather have a type examined will find that route at Module B: EU-type examination and Module C: conformity to type. Which procedure is open to which product class follows from Article 32, and the comparison sits with the conformity assessment procedures.

The application

The manufacturer applies for assessment of its system to a notified body of its choice. Point 3.1 asks for four things:

• the name and address of the manufacturer, and of the authorised representative where that representative lodges the application
• the technical documentation for one model of each category of products intended to be manufactured or developed, containing, wherever applicable, at least the elements in Annex VII
• the documentation concerning the quality system
• a written declaration that the same application has not been lodged with any other notified body

What the system documentation has to say

Point 3.2 requires all elements, requirements and provisions adopted by the manufacturer to be documented in a systematic and orderly manner, as written policies, procedures and instructions. Eight items have to be described adequately, among them:

• the quality objectives and the organisational structure, responsibilities and powers of management for design, development, product quality and vulnerability handling
• the technical design and development specifications, including the standards applied
• the procedural specifications, likewise including the standards applied
• the design and development control and verification techniques used
• the examinations and tests carried out before, during and after production, and how often
• the quality records, such as inspection reports, test and calibration data and qualification reports on the personnel concerned

Two of those items carry a fallback clause, and that clause is the heart of the point. Where the relevant harmonised standards or technical specifications are not applied in full, the documentation has to name the means used instead to meet Part I of Annex I for the products and Part II of Annex I for the manufacturer.

Assessment and presumption of conformity

The notified body assesses the system against that catalogue. Point 3.3 grants a presumption along the way: for the elements of the system that comply with the corresponding specifications of the national standard implementing the relevant harmonised standard or technical specification, the body presumes conformity. The presumption therefore depends on such a standard existing and on a national standard implementing it. Where it does not, the element is assessed in full.

The same point sets a requirement for the auditing team. Beyond experience in quality management systems, at least one member must be experienced as an assessor in the relevant product field and technology and must know the applicable requirements set out in the Regulation. The audit also includes an assessment visit to the manufacturer’s premises, where such premises exist.

Intended changes to the quality system must be notified in advance under point 3.5. The body then decides whether the modified system still satisfies the requirements or whether a reassessment is needed.

Surveillance

Approval does not close the procedure. Under point 4.2 the manufacturer gives the body access, for assessment purposes, to its design, development, production, inspection, testing and storage sites, and provides all necessary information, in particular the quality system documentation together with the quality records from the design part and the manufacturing part. Point 4.3 requires periodic audits, and the manufacturer receives an audit report for each. How often “periodic” is, the CRA does not say.

Marking, declaration, retention

Point 5.1 sets module H visibly apart from every other procedure. Next to the CE marking the manufacturer affixes the identification number of the notified body, under that body’s responsibility. Article 30(4) ties that number expressly to involvement under module H. It is affixed by the body itself, or by the manufacturer or its authorised representative under the body’s instructions. On the other third-party route the CE marking carries no number.

For each product model the manufacturer draws up a written declaration of conformity under point 5.2 and keeps it at the disposal of the national authorities for ten years after placing on the market, or for the support period where that runs longer. The declaration has to identify the product model it was drawn up for.

For at least the same period, point 6 requires four sets of records to be kept available: the technical documentation referred to in point 3.1, the quality system documentation, the approved changes under point 3.5, and the decisions and reports of the notified body under points 3.5 and 4.3.

What the authorised representative may take on

Point 8 allows the obligations in points 3.1, 3.5, 5 and 6 to be fulfilled by the authorised representative, provided they are specified in the mandate. The application, the notification of changes, the marking together with the declaration, and the retention can therefore sit with that representative. Operating the system under point 2 and cooperating with surveillance under point 4 stay with the manufacturer.

What the CRA leaves open

The Regulation puts no validity period on the approval. Nor does it set a deadline for the body to decide on an application, or a route for switching to a different module later on.

One rough edge remains around the declaration of conformity. Annex V, point 7 asks, where applicable, for the name and identification number of the notified body, a description of the conformity assessment procedure performed, and the identification number of the certificate issued. Annex VIII, Part IV knows no certificate, only the approval of a quality system.