Notifying authority

A notifying authority is the national body that decides which assessment organisations in its Member State may carry out conformity assessments under the Cyber Resilience Act (CRA). Article 36(1) obliges every Member State to designate such an authority.

Its remit is already visible in the definition: assessment, designation, notification and monitoring of conformity assessment bodies. Article 36(1) adds one item the definition omits. Monitoring expressly extends to compliance with Article 41, meaning the question whether a body keeps a grip on its subsidiaries and subcontractors.

Who actually does the work

The CRA does not prescribe which national institution takes on the role, and it leaves two routes open for handing the work on.

• Under Article 36(2), Member States may decide that the assessment and monitoring are carried out by a national accreditation body within the meaning of Regulation (EC) No 765/2008.
• Under Article 36(3), the authority may delegate or otherwise entrust assessment, notification or monitoring to a body that is not a governmental entity. That body must be a legal entity, must comply mutatis mutandis with Article 37, and must have arrangements in place to cover liabilities arising from its activities.

Responsibility does not travel with the task. Article 36(4) leaves full responsibility for whatever such a body does with the notifying authority.

Requirements on the authority itself

Article 37 lays down six requirements that together serve a single purpose: whoever decides about assessment bodies must have no stake of their own in the outcome.

• no conflict of interest with conformity assessment bodies
• an organisation and way of working that safeguard objectivity and impartiality
• a separation of people, since each notification decision is taken by competent persons other than those who carried out the assessment
• no offering of activities that conformity assessment bodies perform, and no consultancy on a commercial or competitive basis
• confidentiality of the information obtained
• a sufficient number of competent personnel

From application to notified body

A conformity assessment body applies for notification to the notifying authority of the Member State in which it is established (Article 42(1)). The application describes the conformity assessment activities, the procedures and the products concerned, accompanied where applicable by an accreditation certificate. Without such a certificate, the body must supply all the documentary evidence needed to verify, recognise and regularly monitor its compliance with Article 39.

A Presumption of conformity operates at this level as well. Where a conformity assessment body demonstrates that it meets the criteria of relevant harmonised standards, or parts thereof, whose references have been published in the Official Journal, Article 40 presumes it to comply with Article 39 in so far as those standards cover the requirements.

Only bodies that satisfy Article 39 may be notified. The authority sends the notification to the Commission and the other Member States through the New Approach Notified and Designated Organisations information system, which recital 103 calls the NANDO information system, with full details of activities, modules, products and the attestation of competence. An objection period then runs: two weeks where an accreditation certificate is used, two months where it is not. Only if neither the Commission nor another Member State objects may the body operate, and only then does it count as a notified body for the purposes of the Regulation (Article 43).

Monitoring, restriction, withdrawal

A notification is not a permanent state. Where the notifying authority ascertains or is informed that a notified body no longer meets the requirements of Article 39 or is failing to fulfil its obligations, it restricts, suspends or withdraws the notification according to the seriousness of the failure. The Commission and the other Member States must be informed immediately (Article 45(1)).

Article 45(2) takes care of work already under way. On restriction, suspension or withdrawal of a notification, and equally where a body ceases its activity, the notifying Member State takes appropriate steps so that the body’s files are either processed by another notified body or kept available for the responsible notifying and market surveillance authorities at their request.

The Commission can set the process in motion too. Where it doubts the competence of a notified body, or such doubt is brought to its attention, it investigates, and the notifying Member State supplies on request all information relating to the basis for the notification. Where the Commission ascertains that a body does not meet or no longer meets the requirements for its notification, it informs the notifying Member State and requests that Member State to take the necessary corrective measures, including de-notification if necessary (Article 46).

What manufacturers notice

Manufacturers rarely deal with this authority directly. It makes itself felt in three places.

• Supply in the market. How many assessment organisations are available for your product category depends on how promptly the notifying authorities work. Chapter IV has applied since 11 June 2026, and by 11 December 2026 Member States are to strive to ensure a sufficient number of notified bodies in the Union, so as to avoid bottlenecks and hindrances to market entry (Article 35(2)).
• Reports about your procedure. Notified bodies must inform the notifying authority of every refusal, restriction, suspension and withdrawal of a certificate, of any circumstances affecting the scope of and conditions for notification, and of any request for information concerning conformity assessment activities that they receive from market surveillance authorities (Article 49(1)).
• Subcontracting. Where your notified body subcontracts tasks or has recourse to a subsidiary, it informs the notifying authority and keeps the qualification documents at that authority’s disposal (Article 41). You will know about it anyway, since work may be subcontracted or carried out by a subsidiary only with the manufacturer’s agreement (Article 41(3)).

Boundaries and open points

Three roles are easily confused. The notifying authority deals with assessment organisations, not with products. The Notified body carries out the conformity assessment procedures set out in Annex VIII. The market surveillance authority polices products already on the market and can take measures against economic operators.

On transparency there is a gap. Article 38 requires Member States to inform the Commission of their procedures for the assessment and notification of conformity assessment bodies and for the monitoring of notified bodies, and of any changes to them; the Commission makes that information publicly available. An express duty to name the authority itself in public is not part of the CRA. What is publicly visible instead is the outcome of its work: the list of notified bodies with their identification numbers, which the Commission maintains and keeps up to date under Article 44.