Module H assesses a manufacturer's controlled quality system rather than using the Module B type-examination plus Module C production-control structure. The quality system must cover product security and the manufacturer's Part II vulnerability handling obligations. Approval is not permanent without oversight: changes must be controlled and the notified body performs periodic surveillance audits.
Module H Is Conformity Based on Full Quality Assurance
Annex VIII Part IV defines Module H as conformity based on full quality assurance. The manufacturer fulfils the Module H obligations and ensures and declares on its sole responsibility that the products or product categories concerned satisfy Annex I Part I and that the vulnerability handling processes put in place by the manufacturer meet Annex I Part II.
- Full quality assurance.
- Product or product-category coverage.
- Annex I Part I product requirements.
- Annex I Part II vulnerability handling requirements.
Module H Uses an Approved Quality System
The manufacturer must operate an approved quality system for design, development and final product inspection and testing of the products concerned and for handling vulnerabilities. The manufacturer must maintain the effectiveness of that quality system throughout the support period and is subject to notified-body surveillance. This makes Module H an ongoing system-based route rather than a one-time document review.
- Design and development.
- Final product inspection and testing.
- Vulnerability handling.
- Effectiveness throughout the support period.
- Notified-body surveillance.
The Manufacturer Applies to a Notified Body
The manufacturer lodges an application for assessment of its quality system with the notified body of its choice for the products concerned. The application includes manufacturer information, technical documentation for one model of each category of products intended to be manufactured or developed, documentation concerning the quality system and a written declaration that the same application has not been lodged with any other notified body.
- Manufacturer details.
- Technical documentation for one model of each category.
- Quality-system documentation.
- Declaration that the same application was not lodged elsewhere.
The Quality System Must Cover Part I and Part II
Annex VIII requires the quality system to ensure compliance of products with Annex I Part I and compliance of the manufacturer's vulnerability handling processes with Part II. Module H quality management is therefore not limited to conventional product quality. Cybersecurity design, verification, production and vulnerability handling must all be represented in the controlled system.
- Product-security requirements.
- Vulnerability handling requirements.
- Design controls.
- Verification controls.
- Production controls.
- Process monitoring.
Quality-System Documentation Must Be Systematic and Orderly
The manufacturer must document the elements, requirements and provisions of the quality system in a systematic and orderly manner through written policies, procedures and instructions. The documentation should allow consistent interpretation of quality programmes, plans, manuals and records. This gives the notified body a controlled basis for evaluating how conformity is achieved across the product lifecycle.
- Policies.
- Procedures.
- Instructions.
- Quality programmes and plans.
- Manuals and records.
Management Responsibilities Must Be Defined
The quality system must describe quality objectives and the organisational structure, responsibilities and powers of management with regard to design, development, product quality and vulnerability handling. Security responsibilities should therefore be assigned clearly enough that the notified body can see how decisions, escalation and accountability operate in practice.
- Quality objectives.
- Organisational structure.
- Management responsibilities.
- Decision authority.
- Vulnerability handling ownership.
Design and Development Specifications Must Be Controlled
Module H quality-system documentation includes the technical design and development specifications and standards that will be applied. Where relevant harmonised standards or technical specifications are not applied in full, the manufacturer must document the means used to ensure that the applicable Annex I Part I requirements are met. The system must also describe design and development control and verification techniques, processes and systematic actions.
- Technical design specifications.
- Development specifications.
- Standards used.
- Alternative compliance solutions.
- Design verification techniques.
Part II Procedures Must Also Be Specified
The quality system must describe the procedural specifications used to ensure that Annex I Part II requirements applying to the manufacturer are met. Where relevant harmonised standards or technical specifications are not applied in full, the manufacturer documents the alternative means used. This brings vulnerability handling into the same controlled quality framework as product design and production.
- Vulnerability handling procedures.
- Applicable standards.
- Alternative procedural solutions.
- Part II control evidence.
Production and Quality Assurance Techniques Must Be Documented
The quality system includes production, quality-control and quality-assurance techniques, processes and systematic actions. For software, these can include controlled builds, release pipelines, signing, configuration management and release approvals where relevant. The evidence should show how the production system prevents the released product from drifting away from the assessed security design.
- Production controls.
- Quality control.
- Quality assurance.
- Release processes.
- Configuration control.
The Quality System Must Define Examinations and Tests
Annex VIII requires the quality system to describe the examinations and tests carried out before, during and after production and the frequency with which they are performed. Testing should therefore be integrated into the controlled system rather than treated as an occasional standalone activity. The selected tests should support the applicable product-security and process requirements.
- Pre-production examinations.
- In-process verification.
- Post-production testing.
- Defined test frequency.
- Security-relevant acceptance criteria.
Quality Records Form Part of the Evidence
Module H quality records can include inspection reports, test data, calibration data and qualification reports on relevant personnel. The system also describes how achievement of required design and product quality and the effective operation of the quality system are monitored. These records provide evidence that the approved process is actually being followed.
- Inspection reports.
- Test data.
- Calibration records where relevant.
- Personnel qualification records.
- Quality-system monitoring records.
The Notified Body Audits the Quality System
The notified body assesses the quality system to determine whether it satisfies Annex VIII Part IV. The audit team must include suitable product-field and technology experience and knowledge of the CRA requirements. The audit includes an assessment visit to the manufacturer's premises where such premises exist, and the team reviews technical documentation to verify the manufacturer's ability to identify and examine the applicable requirements.
- Quality-system assessment.
- Relevant product and technology expertise.
- Knowledge of CRA requirements.
- Assessment visit where premises exist.
- Technical-documentation review.
Approved Quality-System Changes Must Be Reported
The manufacturer must keep the notified body that approved the quality system informed of intended changes to that system. The notified body evaluates the proposed change and decides whether the modified system will continue to satisfy the requirements or whether reassessment is necessary. The manufacturer should therefore build notified-body change review into its quality governance.
- Notify intended quality-system changes.
- Notified body evaluates the change.
- Reassessment may be required.
- Preserve the reasoned assessment decision.
Module H Includes Ongoing Notified-Body Surveillance
Surveillance is intended to make sure that the manufacturer fulfils the obligations arising from the approved quality system. The manufacturer must allow the notified body access to design, development, production, inspection, testing and storage sites and provide the necessary quality-system documentation and records. The notified body carries out periodic audits and provides audit reports.
- Access to relevant sites.
- Quality-system documentation.
- Design quality records.
- Manufacturing quality records.
- Periodic audits.
- Audit reports.
Module H CE Marking Includes the Notified Body Number
Under Annex VIII Part IV, the manufacturer affixes the CE marking and, under the responsibility of the notified body that assessed the quality system, that body's identification number to each individual product satisfying Annex I Part I. Article 30(4) confirms this CRA notified-body identification-number rule specifically for the full quality assurance procedure based on Module H.
- Affix CE marking.
- Include the notified body's identification number.
- Apply the number under the notified body's responsibility.
- Use the rule for Module H.
Module H Has Long-Term Retention Obligations
The manufacturer keeps the written declaration of conformity and the Module H evidence for at least 10 years after market placement or for the support period, whichever is longer. Annex VIII also identifies technical documentation, quality-system documentation, approved changes and notified-body decisions and reports among the records to be kept available to national authorities.
- Technical documentation.
- Quality-system documentation.
- Approved quality-system changes.
- Notified-body decisions and reports.
- 10 years or the longer support period.
Module H Is Different From B Plus C
Module H is a full-quality-assurance route and does not depend on a preceding Module B EU-type examination. B plus C instead separates notified-body type examination from manufacturer internal production control. A manufacturer selecting between these permitted routes should consider how its design, production, quality and vulnerability handling systems are organised and which route is legally available for the product classification.
- Module H: approved quality system plus surveillance.
- B plus C: type examination plus production conformity.
- Module H does not require a preceding Module B certificate.
- Use only a route permitted by Article 32.
Official sources
Read the full legal text and Commission material for precise wording, qualifications and updates.