Notified body

A notified body is an independent assessment organisation that a Member State has notified to the European Commission so that it may carry out conformity assessments under the Cyber Resilience Act (CRA). It is neither the notifying authority nor the market surveillance authority, but a conformity assessment body with legal personality under national law (Article 39(2)) that applies for the role and goes through the procedure set out in Chapter IV.

The CRA builds on an established concept here: Article 3(28) takes the conformity assessment body straight from Article 2(13) of Regulation (EC) No 765/2008. Such a body only becomes notified once it has been through the Article 43 procedure. Before that it may not perform the activities of a notified body at all.

When you actually need one

For most products, you do not. Article 32(1) allows the internal control procedure, meaning conformity assessment carried out in-house with no external body. What changes that is classification as an important or critical product:

• Class I of Annex III makes a notified body mandatory only where harmonised standards, common specifications or a European cybersecurity certification scheme at assurance level at least “substantial” have not been applied, or applied only in part. The same holds where no such standards, specifications or scheme exist for the product.
• Class II of Annex III rules self-assessment out. What remains is module B followed by module C, module H, or, where available and applicable, a certification scheme at assurance level at least “substantial”.
• Critical products in Annex IV go primarily through a European certification scheme under Article 8(1); as long as its conditions are not met, the class II procedures apply.

A separate rule covers free and open-source software: under Article 32(5), manufacturers of such products falling within the Annex III categories may use the Article 32(1) procedures, provided the technical documentation is made available to the public at the time the product is placed on the market.

What the body actually examines

Two modules from Annex VIII are its working territory. In EU-type examination (module B) it examines the technical design and development of a product and the manufacturer’s vulnerability handling processes, and issues an EU-type examination certificate. In full quality assurance (module H) it instead assesses and monitors the manufacturer’s quality system for design, development, final inspection and vulnerability handling.

In both cases it carries out periodic audits, under module B explicitly to check that the vulnerability handling processes in Part II of Annex I are implemented adequately, under module H to check that the manufacturer maintains and applies the approved quality system. A certificate is therefore not a one-off stamp: if the approved type changes in a way that may affect conformity, the manufacturer must inform the body, and the change requires an addition to the original certificate.

Where the Annex I requirements are not met, the body demands corrective measures and issues no certificate. Certificates already issued can be restricted, suspended or withdrawn (Article 47). Tasks may be subcontracted or passed to a subsidiary only with the manufacturer’s agreement, and responsibility stays with the notified body either way.

The identification number is where it becomes visible

The Commission assigns each notified body an identification number and publishes a list that it keeps up to date (Article 44). A body notified under several Union acts still receives a single number.

On the product itself that number appears in one case only: under Article 30(4) it follows the CE marking solely where the body was involved in the procedure based on full quality assurance (module H). Take the module B and C route and the CE marking carries no number. Where the number is missing but required, that is formal non-compliance under Article 58 and has to be put right.

How a body becomes notified

The body applies to the notifying authority of the Member State where it is established (Article 42), with an accreditation certificate where applicable and otherwise with all the documents needed to show that it meets Article 39. If it satisfies the requirements of Article 39, that authority notifies the Commission and the other Member States. An objection period then runs: two weeks where an accreditation certificate is used, otherwise two months. Only if no objections are raised may the body start operating.

Article 39 is above all about independence: an independent third party that is not, among other roles, the designer, developer, manufacturer, supplier, importer, distributor, user or maintainer of the products it assesses, that engages in no activity that could compromise its independence or integrity (consultancy services in particular), and whose top management and assessment personnel are not paid according to the number of assessments carried out or their outcomes. If a body stops meeting those requirements, its notification is restricted, suspended or withdrawn (Article 45).

Timing and availability

Chapter IV has applied since 11 June 2026, eighteen months ahead of the main body of the Regulation on 11 December 2027. The reason is practical: bodies have to exist before manufacturers can engage them. Under Article 35(2), Member States are to strive to ensure that by 11 December 2026 there is a sufficient number of notified bodies in the Union, so as to avoid bottlenecks and hindrances to market entry.

Whether that works out is an open question. The CRA says nothing about what happens if capacity falls short. If you are planning a class II or a critical product, ask about available capacity early rather than in the year you intend to launch. Relief comes from two places: under Article 33(5) microenterprises and small enterprises may submit the elements of the technical documentation in a simplified format, to be laid down by the Commission in an implementing act, which notified bodies must accept for the purposes of conformity assessment. And under Article 32(6), conformity assessment fees are to be reduced proportionately to the specific interests and needs of microenterprises and small and medium-sized enterprises, including start-ups.

Not the same thing as market surveillance

A notified body assesses before the product is placed on the market and then stands behind its own certificate. The market surveillance authority, by contrast, polices the market and can order measures; where its evaluation of a product presenting a significant cybersecurity risk finds non-compliance and it requires corrective action, it informs the relevant notified body accordingly (Article 54(1)). Member States must provide an appeal procedure against decisions of notified bodies (Article 48).

Supplying a notified body with incorrect, incomplete or misleading information in reply to a request is not a minor matter: Article 64(4) provides for administrative fines of up to EUR 5 000 000 or, for undertakings, up to 1 % of total worldwide annual turnover for the preceding financial year, whichever is higher.