Module B approves the EU type and relevant vulnerability handling processes. Module C then places responsibility on the manufacturer to keep production and the associated manufacturer processes aligned with that approved type and the CRA requirements. Module C is therefore not another type examination and is not a standalone substitute for Module B in the B plus C route.
Module C Is Conformity to EU-Type Based on Internal Production Control
Annex VIII Part III defines Module C as conformity to EU-type based on internal production control. The manufacturer fulfils the Module C obligations and ensures and declares that the products concerned conform to the type described in the EU-type examination certificate, satisfy the essential cybersecurity requirements in Annex I Part I and that the manufacturer meets the requirements in Annex I Part II.
- Conformity to the approved EU type.
- Internal production control.
- Annex I Part I product requirements.
- Annex I Part II manufacturer requirements.
Module C Follows Module B
Article 32 uses Module B followed by Module C as one conformity route. Module B is the notified-body EU-type examination stage. Module C is the manufacturer's follow-on production-conformity stage. A manufacturer cannot use Module C in this route without an approved type described in an EU-type examination certificate from the preceding Module B stage.
- Module B examines the type.
- Module B produces the EU-type examination certificate where compliant.
- Module C follows the approved type.
- B plus C forms the complete route.
Module C Is Not a Second EU-Type Examination
Module C does not repeat the notified body's Module B design examination. Its role is to ensure that manufactured or developed products stay in conformity with the approved type and that the relevant Annex I requirements continue to be met. Design changes that affect the approved type should therefore be handled through the Module B change and approval process rather than silently absorbed into production control.
- Do not repeat Module B as Module C.
- Control production against the approved type.
- Escalate relevant type changes to the Module B process.
- Preserve product-version traceability.
Production and Its Monitoring Must Preserve Conformity
Annex VIII Part III requires the manufacturer to take all measures necessary so that production and its monitoring ensure conformity of manufactured products with the approved type described in the EU-type examination certificate and with Annex I Part I, while the manufacturer continues to meet Annex I Part II. For software products, production controls can include build, release, signing, configuration and deployment controls as relevant to the assessed product.
- Controlled builds and releases.
- Approved configuration baselines.
- Signing and release controls where relevant.
- Monitoring of production conformity.
- Vulnerability handling continuity.
The Product Must Match the Approved Type
The EU-type examination certificate is the reference point for Module C. The manufacturer should be able to show that the marketed release corresponds to the approved type and that material deviations have been assessed. Version identifiers, build records, architecture baselines and release approvals can help establish that the product being placed on the market is the product covered by the conformity route.
- Approved type identifier.
- Product version.
- Build identifier.
- Release approval.
- Change assessment.
Module C Still Covers Annex I Part II
Module C is not limited to production of the product itself. The legal definition also requires the manufacturer to meet the essential cybersecurity requirements in Annex I Part II. Vulnerability handling therefore remains part of the conformity case after the Module B certificate has been issued. The manufacturer should continue to operate component management, vulnerability intake, remediation, testing, disclosure and secure update processes as applicable.
- Component and SBOM management.
- Vulnerability intake.
- Security testing and review.
- Remediation.
- Coordinated disclosure.
- Secure update distribution.
Module C Relies on Manufacturer Control
Module C is based on internal production control. The manufacturer is responsible for ensuring and declaring that the products remain in conformity with the approved type. This differs from Module B, where a notified body performs the EU-type examination, and from Module H, where an approved quality system is subject to notified-body assessment and surveillance.
- Manufacturer controls production conformity.
- Module B provides the approved type.
- Module H uses an approved quality system and surveillance.
- Do not confuse the three procedural roles.
Security-Relevant Production Changes Need Review
A change in build pipeline, cryptographic signing, dependency set, product configuration or release architecture can affect whether the product still conforms to the approved type. Module C change control should therefore identify which changes are purely operational and which can affect the basis of the Module B approval or the applicable Annex I requirements.
- Review build-system changes.
- Review dependency changes.
- Review security-control changes.
- Review architecture changes.
- Escalate changes affecting the approved type.
Module C Ends With Conformity Marking and Declaration
Annex VIII Part III requires the manufacturer to affix the CE marking to each individual product that conforms to the type described in the EU-type examination certificate and satisfies the applicable CRA requirements. The manufacturer also draws up a written declaration of conformity for the product model. These steps follow the production-conformity conclusion rather than replacing it.
- Confirm conformity to the approved type.
- Affix the CE marking.
- Draw up the written declaration of conformity.
- Identify the product model.
Do Not Automatically Add the Module B Body Number to the CE Mark
Article 30(4) requires the notified body's identification number after the CE marking where that body is involved through the full quality assurance procedure based on Module H. The CRA does not state the same CE-marking identification-number rule for the Module B plus C route. Manufacturers should therefore not assume that the Module B notified body's number is appended to the CE marking merely because that body performed the earlier EU-type examination.
- Module B involves a notified body.
- Module C is internal production control.
- Article 30(4) identifies Module H for the notified-body number rule.
- Do not transfer the Module H marking rule to B plus C.
Keep the Declaration for the Required Period
Annex VIII Part III requires the written declaration of conformity to remain at the disposal of national authorities for 10 years after the product has been placed on the market or for the support period, whichever is longer. The declaration should remain linked to the product model and the approved type on which the Module C conclusion depended.
- 10 years after market placement.
- Or the support period where longer.
- Preserve product-model identification.
- Preserve the link to the approved type.
A Practical Module C Release Check
Before release under Module C, confirm that the Module B certificate remains valid for the product, the release matches the approved type, production and monitoring controls operated as intended, Part II vulnerability handling remains effective, relevant security verification is complete and the conformity declaration and CE marking are prepared for the correct product model.
- Validate Module B certificate applicability.
- Confirm release-to-type conformity.
- Confirm production controls.
- Confirm Part II processes.
- Complete release evidence.
- Issue declaration and CE marking.
Official sources
Read the full legal text and Commission material for precise wording, qualifications and updates.