Cyber Resilience Act: designation of conformity assessment bodies begins

From 11 June 2026, the Cyber Resilience Act hits an operational milestone: designation and notification of conformity assessment bodies (notified bodies) becomes workable across Europe. For manufacturers, importers and industrial integrators, certification, compliance and product security in the CRA sense leave the planning phase — those shipping important or critical products need concrete capacity and scheduling now.

What CRA Chapter IV triggers

The CRA distinguishes product classes with different conformity-assessment modules. Many standard products need self-assessment (Module A). Important products (Annex III, class 2) and critical products (Annex IV) generally require notified bodies or certification under European schemes.

Chapter IV from 11 June 2026:

• member states designate notifying authorities,
• procedures to assess, designate and notify conformity assessment bodies must be in place,
• bodies can be listed in the EU NANDO database,
• by 11 December 2026 sufficient Union-wide capacity should prevent market access failing for lack of CABs.

In Germany the BSI holds the notifying role and expands market surveillance.

Notified bodies vs certification

Mechanism	For what	Who
Module A	standard products	manufacturer
Module B/C, H	important/critical products	notified body
EU certification scheme	critical products (Annex IV)	scheme + body

Notified bodies examine type, quality system or model — they do not replace internal secure development lifecycle, but confirm conformity to CRA requirements and referenced standards.

Check synergies with the EU Cybersecurity Act (EUCC etc.) where products already need high assurance — schemes do not automatically cover all CRA duties.

Product security and compliance reality

Product security under CRA covers the cyber lifecycle: secure defaults, updates, vulnerability handling, support communication. Notified bodies assess whether manufacturer processes and product types meet these requirements — compliance is a documented evidence chain, not marketing.

The BSI is developing technical guideline TR-03183 (general requirements, SBOM, vulnerability reports) as a national orientation frame — alongside Commission CRA guidelines.

Harmonised standards bottleneck

Horizontal CRA standards are announced but not everywhere cited in the Official Journal. Consequence:

• important class 1 products without standards may need CABs earlier than planned,
• self-assessment via presumption of conformity fails without norm reference,
• parallel Annex I evidence building remains mandatory.

Manufacturers should budget “with standard” and “without standard” scenarios — see conformity requirements for manufacturers.

Impact on industry and procurement

Integrators and operators placing OEM products on market or under own label should verify:

• supplier proof: which module, which CAB, which file?
• contractual update and reporting responsibility,
• CRA link in industrial readiness and NIS2 supplier registers.

Procurement must not confuse CAB status with ISO certificates — different schemes, different validity.

Questions for a notified body (RFQ core)

Which CRA product categories and modules do you cover?

Lead time and duration for type examination / Module H?

Which technical file do you expect before audit?

How do you handle missing harmonised standards?

Conclusion

Designation of conformity assessment bodies starts CRA infrastructure for certification and compliance: notified bodies, BSI coordination and capacity targets by end-2026. Manufacturers of important and critical products should mesh CAB capacity, technical files and reporting now — industry and procurement should tighten supplier proof. Waiting means competing for limited audit slots before full application in 2027.

Further reading: EU CRA for companies. Hiring: Cybersecurity recruitment.