A notified body is not simply a cybersecurity testing company, certification consultancy or accredited laboratory. It has a formal legal status under the CRA notification framework. Its authority is limited to the conformity assessment activities, modules and products covered by its notification. Article 47 requires CRA assessments to be proportionate but still sufficiently rigorous, and gives notified bodies duties when non-conformity is found before or after certification.
A CRA Notified Body Is a Formally Notified Conformity Assessment Body
A CRA notified body is a conformity assessment body that has satisfied the applicable CRA requirements and completed the formal notification process. Article 35 requires Member States to notify the Commission and the other Member States of bodies authorised to carry out conformity assessments under the Regulation. Article 35 also requires Member States to strive by 11 December 2026 to ensure that there is a sufficient number of notified bodies in the Union to avoid bottlenecks and hindrances to market entry. The legal status comes from notification, not merely from offering cybersecurity assessment services.
- Conformity assessment body.
- CRA requirements satisfied.
- Formally notified by a Member State.
- Authorised for specified conformity activities.
A Notified Body Is Not the Same as a Testing Laboratory
A testing laboratory can perform security tests and provide evidence without being a CRA notified body. A notified body has a formal role in the conformity procedures for which it has been notified, such as EU-type examination under Module B or quality-system assessment and surveillance under Module H. Manufacturers should not describe an ordinary penetration-testing provider or laboratory as a CRA notified body unless its notification status and scope support that claim.
- Testing labs can provide technical evidence.
- Consultants can provide advice.
- Notified bodies perform legally recognised conformity activities.
- Verify formal notification and scope.
Member States Designate Notifying Authorities
Article 36 requires each Member State to designate a notifying authority responsible for procedures concerning assessment, designation and notification of conformity assessment bodies and their monitoring. The notifying authority and the notified body therefore have different roles: the authority controls the notification framework, while the notified body performs the conformity assessment activities within its notified scope.
- Notifying authority manages notification procedures.
- Notified body performs conformity assessment.
- Do not confuse the two roles.
Article 39 Requires Independence
Article 39 requires a conformity assessment body to be established under national law, have legal personality and operate as a third-party body independent of the organisation or product it assesses. The CRA also contains conflict-of-interest restrictions for the body, its management and assessment personnel. Independence is therefore part of notified-body status rather than a voluntary professional preference.
- Legal personality.
- Third-party status.
- Independence from assessed organisations and products.
- Conflict-of-interest controls.
Notification Is Tied to Competence and Scope
A conformity assessment body applies for notification for specified conformity assessment activities, procedures and products for which it claims competence. The notification sent to the Commission and other Member States identifies the conformity assessment activities, module or modules and products concerned. A manufacturer's due diligence should therefore check scope rather than relying only on the organisation's name or general reputation.
- Conformity assessment activity.
- Module or modules.
- Product scope.
- Evidence of competence.
Accreditation Supports Notification but Is Not the Same Thing
Article 42 allows an application for notification to include an accreditation certificate from a national accreditation body attesting that the conformity assessment body fulfils Article 39. Where no accreditation certificate is provided, documentary evidence must support verification and monitoring of compliance with Article 39. Accreditation can therefore support the notification process, but CRA notified-body status comes from the completed notification procedure.
- Accreditation certificate can support the application.
- Alternative documentary evidence is possible under Article 42.
- Notification creates notified-body status for CRA purposes.
- Do not treat accreditation alone as CRA notification.
Article 43 Controls the Notification Procedure
Notifying authorities notify only conformity assessment bodies that satisfy Article 39. The notification includes details of conformity assessment activities, the module or modules, the products concerned and the relevant attestation of competence. The body may perform notified-body activities only after the Article 43 notification conditions have been satisfied and the applicable objection period has passed without objection.
- Article 39 requirements first.
- Notification identifies activities and modules.
- Notification identifies product scope.
- Applicable objection period must pass.
The Commission Assigns an Identification Number
Article 44 requires the Commission to assign an identification number to a notified body. The Commission also makes publicly available the list of bodies notified under the CRA, including their identification numbers and the activities for which they have been notified, and keeps that list up to date. Manufacturers should use that official information when verifying a prospective body's status and scope.
- Commission identification number.
- Public notified-body list.
- Published conformity activities.
- List kept up to date.
Check the Activities for Which the Body Is Notified
A body having an identification number does not mean that every possible CRA conformity activity is automatically within its scope. Article 44 refers to the activities for which bodies have been notified. Manufacturers should verify that the body is notified for the required module and relevant product scope before lodging a Module B or Module H application.
- Verify CRA status.
- Verify module scope.
- Verify product scope.
- Confirm current notification status.
Notified Bodies Perform Article 32 and Annex VIII Assessments
Article 47 requires notified bodies to carry out conformity assessments in accordance with Article 32 and Annex VIII. Their role depends on the selected procedure. In Module B they perform EU-type examination. In Module H they assess the quality system and carry out surveillance. Manufacturers should therefore select a body whose notified activities match the chosen conformity route.
- Article 32 procedures.
- Annex VIII procedures.
- Module B EU-type examination.
- Module H quality-system assessment and surveillance.
Assessments Must Be Proportionate but Still Rigorous
Article 47 requires conformity assessments to be carried out proportionately and to avoid unnecessary burdens for economic operators. Notified bodies take account of factors including undertaking size, sector, structure, product and technology complexity, cybersecurity risk level and the mass or serial nature of production. At the same time, they must respect the degree of rigour and level of protection required for CRA compliance.
- Avoid unnecessary burden.
- Consider enterprise size.
- Consider product complexity and cybersecurity risk.
- Maintain the required degree of rigour.
A Notified Body Cannot Ignore Non-Conformity
Where a notified body finds that Annex I requirements or corresponding harmonised standards or common specifications have not been met, Article 47 requires it to demand appropriate corrective measures and not issue a certificate of conformity. Purchasing an assessment therefore does not guarantee a positive conformity outcome.
- Identify unmet requirements.
- Require corrective measures.
- Do not issue a certificate while requirements remain unmet.
- Manufacturer must resolve the conformity gap.
Certificates Can Be Suspended or Withdrawn After Issuance
Article 47 also governs monitoring after a certificate has been issued. If a notified body finds that a product no longer complies, it requires appropriate corrective measures and suspends or withdraws the certificate if necessary. Where corrective action is not taken or does not have the required effect, the body restricts, suspends or withdraws certificates as appropriate.
- Post-certificate monitoring matters.
- Corrective action may be required.
- Certificates can be restricted.
- Certificates can be suspended.
- Certificates can be withdrawn.
Subcontracting Does Not Remove the Notified Body's Responsibility
Article 41 allows specific conformity assessment tasks to be subcontracted or performed through a subsidiary only under the CRA conditions. The notified body must ensure the subcontractor or subsidiary satisfies the relevant requirements, takes full responsibility for the tasks and can subcontract activities only with the manufacturer's agreement. Manufacturers should therefore distinguish the legal notified body from any supporting laboratory or subcontractor involved in the assessment.
- Subcontractor must satisfy relevant requirements.
- Notified body retains full responsibility.
- Manufacturer agreement is required.
- Supporting lab does not become the notified body.
Manufacturers Have an Appeal Route
Article 48 requires Member States to ensure that an appeal procedure against decisions of notified bodies is available. A certificate refusal or other adverse notified-body decision is therefore not outside procedural review. Manufacturers should obtain the applicable appeal information from the relevant national framework and body when necessary.
- Appeal procedure must be available.
- Applies to notified-body decisions.
- Follow the relevant national procedure.
Notified Bodies Have Reporting Duties
Article 49 requires notified bodies to inform the notifying authority about matters including certificate refusals, restrictions, suspensions and withdrawals, circumstances affecting notification scope or conditions and requests received from market surveillance authorities about conformity assessment activities. This reporting framework supports oversight of notified-body activity.
- Certificate refusal.
- Certificate restriction.
- Certificate suspension or withdrawal.
- Changes affecting notification.
- Market-surveillance information requests.
A Practical CRA Notified-Body Due-Diligence Check
Before appointing a body for CRA conformity work, confirm that it appears on the Commission's public notified-body information, verify its current identification number, confirm the exact activities and module scope, confirm the relevant product scope, understand which entity will perform the work, distinguish subcontracted testing from the notified-body decision and obtain the assessment, change-notification and appeal procedures that will apply.
- Confirm official notified status.
- Confirm identification number.
- Confirm module scope.
- Confirm product scope.
- Understand subcontracting.
- Understand certificate and appeal processes.
Official sources
Read the full legal text and Commission material for precise wording, qualifications and updates.