The most important selection criterion is legal scope. A well-known cybersecurity organisation cannot perform a notified-body CRA procedure unless its notification covers that activity. Manufacturers should verify official status and scope before comparing commercial factors such as availability, assessment approach and project coordination.
Start With the Conformity Route You Actually Need
Do not choose a conformity assessment body before determining the Article 32 route. A manufacturer needing Module B EU-type examination has a different procedural requirement from a manufacturer using Module H full quality assurance. Product classification, standards coverage and the Article 32 rules should therefore be resolved first. The selected body must be able to perform the conformity activity required by that route.
- Confirm product classification.
- Confirm Article 32 route.
- Identify required module.
- Then select the assessment body.
Verify Formal CRA Notified-Body Status
A conformity assessment provider should not be treated as a CRA notified body merely because it performs cybersecurity testing, ISO audits or other certification work. Article 35 establishes the CRA notification framework, while Article 43 governs notification. Verify that the organisation has completed the formal CRA notification process before relying on it for a notified-body conformity procedure.
- Confirm formal CRA notification.
- Do not rely on marketing language alone.
- Distinguish security testing from notified conformity assessment.
- Check current status before application.
Check the Commission Identification Number
Article 44 requires the Commission to assign an identification number to each notified body. The Commission also publishes the list of bodies notified under the CRA together with their identification numbers and the activities for which they are notified. The identification number is therefore an important verification point, but the number alone does not prove that every CRA module or product type is within scope.
- Confirm identification number.
- Check the official public listing.
- Confirm the listing is current.
- Continue to scope verification.
Verify the Notification Scope
Article 43 notifications identify conformity assessment activities, the module or modules and products concerned. A manufacturer should therefore verify that the body's notification scope covers the exact procedure and product category needed. Being notified for one module or product field does not automatically authorise the body for every CRA assessment.
- Check conformity assessment activity.
- Check module.
- Check product scope.
- Check relevant technical field.
Check Product and Technology Competence
Article 39 requires notified bodies to have the personnel, technical knowledge and experience needed for the conformity assessment tasks for which they are notified. In practice, manufacturers should confirm that the proposed assessment team understands the relevant product architecture, software or hardware technology, cybersecurity risk profile and vulnerability handling model. Formal notification establishes legal competence within scope, while product-specific experience helps the assessment operate efficiently.
- Relevant product field.
- Software or hardware expertise.
- Cybersecurity expertise.
- Vulnerability handling knowledge.
- Experience with the required module.
Verify Independence
Article 39 requires a notified body to be a third-party body independent of the organisation or product it assesses and contains conflict-of-interest safeguards. Manufacturers should therefore understand the distinction between independent conformity assessment and consultancy used to design the compliance solution. A provider should not be selected on the assumption that it can both own the manufacturer's compliance decisions and independently certify those same decisions without regard to the CRA independence requirements.
- Third-party independence.
- Conflict-of-interest safeguards.
- Separate manufacturer decisions from independent assessment.
- Clarify advisory and assessment roles.
For Module B, the Application Goes to a Single Notified Body
Annex VIII Part II requires the manufacturer to lodge the EU-type examination application with a single notified body of its choice. The application also contains a written declaration that the same application has not been lodged with another notified body. Manufacturers should therefore complete scope and commercial due diligence before formally lodging the application rather than running parallel Module B applications for the same examination.
- Choose one Module B notified body.
- Verify scope before lodging.
- Do not lodge the same application with multiple bodies.
- Understand application withdrawal and change procedures.
Module H Also Restricts Duplicate Applications
The Module H application includes a written declaration that the same application has not been lodged with any other notified body. Because Module H involves approval and surveillance of the manufacturer's quality system, selection should consider the long-term working relationship as well as the initial assessment. Manufacturers should understand audit scheduling, change notification and surveillance arrangements before committing to the route.
- One Module H application at a time.
- Understand initial assessment.
- Understand periodic surveillance.
- Understand quality-system change procedures.
Confirm Language Requirements Early
Article 31 states that technical documentation and correspondence relating to a conformity assessment procedure must be drawn up in an official language of the Member State in which the notified body is established or in a language acceptable to that body. Manufacturers should confirm the acceptable working language before preparing large evidence packages or translations.
- Confirm accepted language.
- Confirm technical-document language.
- Confirm correspondence language.
- Plan controlled translations where required.
Understand the Body's Evidence Expectations
The CRA defines what the applicable conformity procedure requires, but manufacturers should still understand how the body wants the evidence organised and submitted. Ask how technical documentation, risk assessments, architecture, test reports, vulnerability handling evidence and product specimens or access should be provided. Administrative preferences do not replace Annex VIII, but aligning evidence presentation can reduce avoidable assessment delays.
- Technical-documentation format.
- Evidence submission process.
- Testing evidence.
- Product access.
- Vulnerability-process evidence.
Ask How Subcontracting Is Used
Article 41 allows notified bodies to subcontract specific conformity assessment tasks only under defined conditions. The notified body remains fully responsible for the tasks performed by subcontractors or subsidiaries, and subcontracting can occur only with the manufacturer's agreement. Manufacturers should therefore ask which testing or specialist activities will be subcontracted and which legal entity remains responsible for the conformity decision.
- Identify subcontracted activities.
- Identify subcontracted laboratories.
- Confirm manufacturer agreement.
- Confirm notified body retains full responsibility.
Understand How Non-Conformities Are Managed
Article 47 requires notified bodies to require corrective measures where applicable CRA requirements are not met. The body does not issue a conformity certificate while the relevant non-conformity remains unresolved. Before starting the assessment, manufacturers should understand how findings are classified, communicated, closed and retested, while remembering that the underlying legal requirement comes from the CRA rather than the body's commercial process.
- Finding communication.
- Corrective action.
- Evidence resubmission.
- Retesting.
- Certificate decision.
Understand Post-Certificate Change Procedures
The conformity relationship can continue after the initial assessment. Module B requires relevant changes to an approved type or vulnerability handling process to be controlled, while Module H requires intended quality-system changes to be communicated to the body that approved the system. Ask how changes are submitted, evaluated and approved before selecting the body.
- Product-change notification.
- Vulnerability-process changes.
- Quality-system changes.
- Additional assessment where required.
Check the Appeal Procedure
Article 48 requires Member States to ensure that an appeal procedure against notified-body decisions is available. A manufacturer should know how the relevant appeal mechanism works before a dispute arises. Appeal rights do not remove the need to correct genuine non-conformity, but they provide a formal route for challenging a notified-body decision where appropriate.
- Ask for appeal information.
- Identify applicable national procedure.
- Keep assessment correspondence.
- Preserve evidence supporting disputed decisions.
Compare Commercial Factors Only After Legal Eligibility
Availability, project coordination, assessment workflow, communication quality and commercial terms can matter when choosing between legally eligible bodies. These considerations should come after notification scope and competence. The lowest-price provider is not useful if it is not notified for the required CRA module or product category.
- Legal eligibility first.
- Then availability.
- Then assessment workflow.
- Then communication and commercial terms.
A Practical CRA Body Selection Checklist
A practical selection record should identify the required Article 32 route, candidate body's official name, Commission identification number, notification status, module scope, product scope, technical competence, accepted language, subcontracting arrangements, application process, assessment approach, change-notification procedure and appeal route. Retaining that record can demonstrate why the manufacturer considered the body suitable for the required conformity procedure.
- Required module.
- Official body identity.
- Identification number.
- Notification scope.
- Product scope.
- Accepted language.
- Subcontracting.
- Change procedure.
- Appeal procedure.
Official sources
Read the full legal text and Commission material for precise wording, qualifications and updates.