CRA Conformity Assessment & Notified Bodies

Last updated: 24 October 2026

At a Glance

Conformity under the CRA (Regulation (EU) 2024/2847) is demonstrated, depending on the product class, through Module A (self-declaration), Module B (EU-type examination) or Module H (full quality assurance).
The technical descriptions of important and critical products have been clarified by Implementing Regulation (EU) 2025/2392.
The authorised representative (Article 18) represents the manufacturer; the notified body performs independent third-party assessment — the two roles cannot be combined for the same product.
A Turkish CRA notified body cannot be designated until the CRA is transposed into national legislation; until then, bodies established in the EU are used.
EA AfN preferred standards: EN ISO/IEC 17065 plus 17025 testing capability for Module B; EN ISO/IEC 17021-1 for Module H.
For the critical 2026–2027 timeline for exporting to the EU, see our CRA timeline overview.

Placing a product within the scope of the EU Cyber Resilience Act (CRA) on the EU market requires conformity to be demonstrated through self-declaration or third-party assessment, depending on the product’s risk class. Nesil Teknoloji runs all three pillars of this process under one roof: security testing of products with digital elements against the Annex I essential requirements and production of technical file evidence, coordination of an EU-based authorised representative, and coordination with EU notified bodies where third-party assessment is required. For the scope, timeline and essential requirements of the CRA, see our CRA Compliance Consulting main page.

Conformity Assessment Routes: Modules A, B and H

The CRA classifies products by risk level, and the class determines the conformity assessment module to follow. Since the choice of module also determines which party produces which evidence, it is the first step in project planning.

Conformity Module	Nature	Preferred standard	Nesil’s role
Module A (internal production control)	Self-assessment — the majority of default-class products	Manufacturer’s self-declaration	Annex I test report as direct technical file evidence
Module B (EU-type examination)	Product-focused third-party examination	EN ISO/IEC 17065 + testing and inspection capability	Product security testing; evidence for the notified body file
Module H (full quality assurance)	System-focused third-party audit	EN ISO/IEC 17021-1 + product knowledge of the auditor	Secure development and quality management system consulting

Default-class products can self-declare under Module A. For Important Class I products, self-declaration is possible if the harmonised standard is applied fully and correctly; otherwise a notified body is involved. Important Class II and critical products are subject to third-party assessment. To find out which class your product falls into, see the product classification and conformity routes section.

Product Security Testing and Annex VII Technical File Evidence

The product is tested against the CRA Annex I essential requirements and the result is added to the Annex VII technical file as evidence. For default-class products the report is sufficient on its own; for Important Class I it is the basis of the self-declaration when fully compliant; for Important Class II and critical products it feeds the notified body’s assessment file. Testing is carried out by our test organisation, structured independently of our consulting services, and positioned within the requirements of clause 6 (resources) and clause 7 (process, excluding 7.9) of EN ISO/IEC 17025:2017 — the basis of the capability expected at EU level for CRA Module B testing. For test scope, standards and process, see our CRA Product Security Testing page.

EU Authorised Representative Coordination (CRA Article 18)

An authorised representative is a representative appointed within the EU by a manufacturer established outside the EU through a written mandate. Its role is not conformity assessment; it provides the technical file and EU Declaration of Conformity upon an authority’s request, handles communication with market surveillance authorities and ensures the recipient CSIRT for Article 14 reporting is identified. For manufacturers not established in the EU, the recipient of reports is, as a rule, the CSIRT of the Member State where the authorised representative is located — which makes the choice of representative an operational decision. Through its network of EU-based authorised representatives and partnerships, Nesil Teknoloji manages the appointment process, the definition of the mandate’s scope and the reporting recipient set-up.

Key distinction: The authorised representative and the notified body are two entirely separate roles. The authorised representative represents the manufacturer; the notified body performs independent third-party assessment. One organisation cannot take on both roles for the same product.

Notified Body Coordination

For products requiring third-party assessment, the notified body is designated by the notifying authority of an EU Member State. For Turkish institutions such as TSE to be designated as CRA notified bodies, the CRA must first be transposed into national legislation and formally notified on the EU side; until this process is complete, notified bodies established in EU Member States are used. Nesil Teknoloji carries out the preparation and technical file work, coordinates the relationship with the notified body in the EU and produces the required test evidence.

Competence Consulting for Organisations Seeking to Become Notified Bodies

A conformity assessment body seeking to become a CRA notified body is assessed by the notifying authority under CRA Article 39. Article 39(7) requires technical and vocational training covering all conformity assessment activities, sufficient knowledge of and authority over the assessments carried out, command of the Annex I requirements and harmonised standards, and the ability to draw up certificates, records and reports. ENISA’s assessor competence framework dated June 2026 and the European Accreditation (EA) Accreditation for Notification (AfN) project make these requirements concrete: for Module B, EN ISO/IEC 17065 with testing capability (EN ISO/IEC 17025:2017 clauses 6 and 7, excluding 7.9) and product knowledge (EN ISO/IEC 17020:2012 clauses 6.1.2, 6.1.3 and 6.1.6–6.1.10); for Module H, EN ISO/IEC 17021-1 with specific product knowledge of the auditor. Nesil Teknoloji provides consulting on assessor competence matrices, personnel profile and equivalence definitions, competence management process setup and gap analysis against the current state.

Why Nesil Teknoloji

Penetration testing authorisation certificate of the Republic of Türkiye Ministry of Industry and Technology (STB03-250), TSE Class A Approved Penetration Testing Company certificate (TSE-STF-065), CREST membership and TÜRKAK-accredited ISO/IEC 27001:2022, ISO/IEC 27701, ISO 9001, ISO/IEC 20000-1 and ISO 22301 integrated management systems. An expert team holding OSCP, CEH, CISSP, GPEN, LPT and Security+ certifications; 400+ corporate references. This competence base makes it possible to run both the product testing and the management system audit pillars of CRA conformity assessment under one roof.

Frequently Asked Questions

Is Nesil Teknoloji a CRA notified body?

No. A CRA notified body is designated by the notifying authority of an EU Member State, and in Türkiye this mechanism requires the CRA to be transposed into national legislation; transposition has not yet been completed. Nesil Teknoloji carries out product security testing and technical file preparation, coordinates with notified bodies established in the EU and provides competence consulting to organisations seeking to become notified bodies.

Is your test report sufficient on its own for CRA conformity?

It depends on the product class. For default-class products and Important Class I products that fully apply the harmonised standard, the report goes directly into the Annex VII technical file as the basis of the self-declaration. For Important Class II and critical products, the report feeds the notified body’s assessment file; it does not replace the notified body.

Are an authorised representative and a notified body the same thing?

No. The authorised representative (CRA Article 18) represents the manufacturer; it handles functions such as providing the technical file, communicating with market surveillance and identifying the Article 14 reporting recipient, but it does not carry out conformity assessment. A notified body is the organisation that performs independent third-party assessment.

What support do you provide to organisations seeking to become notified bodies?

Consulting under CRA Article 39(7) and the ENISA assessor competence framework: assessor competence matrices, personnel profile and equivalence definitions, competence management process setup and gap analysis. The work is structured according to the Module B and Module H preferred standards of the EA AfN project.

Official Sources

Preliminary Meeting

To determine your product’s conformity route, test scope and need for an authorised representative: Request a Quote · Ankara +90 312 911 46 40 · Istanbul +90 216 232 24 33