Formal non-compliance is not the same as a finding that the product fails an Annex I cybersecurity requirement. It concerns specified conformity and documentation defects. Those defects can often be corrected directly, but they should not be treated as harmless paperwork because Article 58 provides an escalation path to market restriction, recall or withdrawal when the manufacturer does not put the problem right.
Article 58 Lists the Formal Non-Compliance Findings
Formal non-compliance under the CRA is a defined Article 58 enforcement route. The market surveillance authority does not need to invent the category case by case. Article 58 identifies the CE marking, declaration, notified-body identification and technical-documentation defects that trigger the manufacturer's duty to put an end to the formal non-compliance.
Incorrect CE Marking Can Be Formal Non-Compliance
Article 58 includes the case where CE marking has been affixed in violation of Articles 29 and 30. This can include problems with the conditions and rules governing how CE marking is affixed. The manufacturer should therefore review both whether the mark is present and whether it has been used correctly.
Missing CE Marking Is a Separate Finding
The absence of required CE marking is separately listed in Article 58. A product that otherwise has substantial cybersecurity evidence can still face formal enforcement if the required CE marking has not been affixed.
A Missing EU Declaration of Conformity Is Formal Non-Compliance
Article 58 lists failure to draw up the EU declaration of conformity as formal non-compliance. The declaration is therefore not optional administrative paperwork. It is part of the manufacturer's formal demonstration that the product complies with the applicable CRA requirements.
An Incorrectly Drawn Declaration Also Counts
The EU declaration of conformity can exist and still be formally non-compliant if it has not been drawn up correctly. Manufacturers should therefore review required declaration content, product identification, applicable legislation, standards or specifications referenced and the authorised signatory information rather than checking only for the existence of a PDF.
Notified-Body Identification Can Be Required
Where a notified body is involved in the applicable conformity assessment procedure, Article 58 includes failure to affix its identification number as a formal non-compliance finding. This applies where the identification number is required for the procedure used, not to every CRA product automatically.
Unavailable Technical Documentation Is Formal Non-Compliance
Article 58 includes technical documentation that is not available. A manufacturer should therefore maintain the Annex VII technical file in a form that can actually be retrieved for market surveillance rather than treating document creation at product release as sufficient if the records later become inaccessible.
Incomplete Technical Documentation Also Counts
Technical documentation can exist but still be incomplete. The manufacturer should check that the file contains the information needed by Annex VII and remains consistent with the released product, cybersecurity risk assessment, conformity assessment, test evidence and relevant vulnerability-handling information.
Formal Non-Compliance Is Different From Substantive Cybersecurity Non-Compliance
Article 58 addresses specified conformity-form defects. A separate investigation may find that a product fails an Annex I cybersecurity requirement or presents a significant cybersecurity risk. Those are different enforcement questions. A product can have correct paperwork yet fail substantive requirements, or it can have a correct technical product but defective formal conformity records.
The Manufacturer Is First Required to End the Defect
When an Article 58 finding is made, the market surveillance authority must require the relevant manufacturer to put an end to the non-compliance. This creates an opportunity to correct the CE marking, declaration, notified-body identification or technical documentation problem before the case escalates.
Persistent Formal Non-Compliance Can Restrict Market Access
If the Article 58 non-compliance persists, the Member State must take appropriate measures to restrict or prohibit the product from being made available on the market or ensure that it is recalled or withdrawn. Formal defects should therefore be corrected promptly and verified rather than left open because they appear administrative.
Official sources
Read the full legal text and Commission material for precise wording, qualifications and updates.