IN SHORT
Before placing a product with digital elements on the market, the manufacturer must carry out a conformity assessment of the product and of its vulnerability handling processes against Annex I, using one of the procedures in Article 32. For most products the manufacturer can use internal control (module A) — a self-assessment under its own responsibility, without a third party. A notified body or a European cybersecurity certificate becomes necessary for certain important products listed in Annex III and for critical products listed in Annex IV. Once conformity is demonstrated, the manufacturer draws up the EU declaration of conformity and affixes the CE marking (Article 13(12)).
The sequence for a manufacturer
What the text requires
Before placing a product on the market, the manufacturer must draw up the technical documentation (Article 13(12), first subparagraph), carry out the chosen conformity assessment procedures referred to in Article 32 or have them carried out (Article 13(12), second subparagraph), and — once compliance with Annex I, Part I (product) and Part II (processes) has been demonstrated — draw up the EU declaration of conformity and affix the CE marking (Article 13(12), third subparagraph).
The assessment covers two objects: the product itself (Part I of Annex I) and the processes put in place by the manufacturer, in particular vulnerability handling (Part II of Annex I) (Article 32(1)).
The four procedures
Article 32 refers to procedures described in Annex VIII and to European cybersecurity certification:
| Procedure | Where it is described | Third party involved? |
|---|---|---|
| Internal control (module A) | Annex VIII, Part I | No — the manufacturer declares on its sole responsibility |
| EU-type examination (module B) followed by conformity to type based on internal production control (module C) | Annex VIII, Part II, Annex VIII, Part III | Yes — a notified body carries out the EU-type examination |
| Full quality assurance (module H) | Annex VIII, Part IV | Yes — a notified body assesses the quality system |
| European cybersecurity certification scheme | Article 32(1), point (d), Article 27(9) | Yes — under Regulation (EU) 2019/881, where available and applicable |
Internal control is described in Annex VIII as the procedure whereby the manufacturer ensures and declares on its sole responsibility that the product and its processes satisfy Annex I (Annex VIII, Part I, point 1).
Which procedure for which product
What the text requires
- Default products (not listed in Annex III or IV): the manufacturer may use any of the procedures in Article 32(1), including
the internal control procedure (based on module A) set out in Annex VIII Article 32(1), point (a)
. - Important products, class I (Annex III, Part I): internal control remains possible only if the manufacturer has applied harmonised standards, common specifications or European cybersecurity certification schemes at assurance level at least "substantial" covering the relevant requirements. If they have not been applied, have been applied only in part, or do not exist, the product must go through module B + C or module H for those requirements (Article 32(2)).
- Important products, class II (Annex III, Part II): module B + C, module H, or, where available and applicable, a European cybersecurity certification scheme at assurance level at least "substantial" (Article 32(3)).
- Critical products (Annex IV): a European cybersecurity certification scheme in accordance with Article 8(1), or, where the conditions of Article 8(1) are not met, one of the procedures for class II (Article 32(4)).
What makes a product "important" or "critical"
A product is an important product when it has the core functionality of a category listed in Annex III (Article 7(1)). Integrating such a component into another product does not by itself change the procedure for the final product: The integration of a product with digital elements which has the core functionality of a product category set out in Annex III shall not in itself render the product in which it is integrated subject to the conformity assessment procedures referred to in Article 32(2) and (3). Article 7(1)
Annex III lists, for example, password managers, VPN products and operating systems in class I, and firewalls, intrusion detection and prevention systems and hypervisors in class II. The Commission was required to adopt an implementing act giving the technical description of these categories (Article 7(4)) — read it alongside Annex III before classifying a product.
For critical products (Annex IV), the Commission may adopt delegated acts requiring a European cybersecurity certificate; where no such delegated acts have been adopted, critical products follow the procedures referred to in Article 32(3) (Article 8(1), second subparagraph).
Uncertain / awaiting guidance
Whether the implementing act on the technical description of Annex III and IV categories, delegated acts under Article 8, harmonised standards and certification schemes are available — and their content — must be checked at the time of assessment. This guide does not list them, as we have not yet verified their adoption and publication.
Free and open-source software in Annex III
Manufacturers of products qualifying as free and open-source software that fall under Annex III may use any procedure of Article 32(1), including internal control, provided that the technical documentation is made available to the public at the time of placing on the market (Article 32(5)).
Presumption of conformity
Products and processes that conform to harmonised standards whose references are published in the Official Journal are presumed to conform to the Annex I requirements covered by those standards (Article 27(1), first subparagraph). A European cybersecurity certificate or EU statement of conformity under Regulation (EU) 2019/881 also gives a presumption of conformity for the requirements it covers (Article 27(8)). A European cybersecurity certificate at assurance level at least "substantial" under schemes specified by the Commission eliminates the obligation to carry out a third-party assessment for the corresponding requirements (Article 27(9)).
Technical documentation
What the text requires
The technical documentation must contain all relevant data on how the product and processes meet Annex I, and at least the elements of Annex VII (Article 31(1)). It is drawn up before placing on the market and updated, where appropriate, at least during the support period (Article 31(2)). It is kept at the disposal of market surveillance authorities for at least ten years after placing on the market or for the support period, whichever is longer (Article 13(13)).
Annex VII includes, among other things, a general description of the product, information on design and vulnerability handling processes including the software bill of materials, the cybersecurity risk assessment, the information used to determine the support period, the standards or schemes applied, test reports and a copy of the EU declaration of conformity (Annex VII).
EU declaration of conformity
The EU declaration of conformity states that the fulfilment of the applicable essential requirements has been demonstrated (Article 28(1)). It follows the model structure of Annex V; a simplified declaration follows Annex VI and must give the exact internet address of the full declaration (Article 28(2), Article 13(20)). Where several Union acts require a declaration, a single declaration is drawn up (Article 28(3)). Importantly: By drawing up the EU declaration of conformity, the manufacturer shall assume responsibility for the compliance of the product with digital elements. Article 28(4)
CE marking
The CE marking is affixed visibly, legibly and indelibly to the product before it is placed on the market; where not possible, to the packaging and the declaration. For software, it is affixed either to the EU declaration of conformity or on the website accompanying the software product (Article 30(1), Article 30(3)). When a notified body is involved in the full quality assurance procedure (module H), its identification number follows the CE marking (Article 30(4), first subparagraph).
Notified bodies (Chapter IV)
Third-party procedures are carried out by notified bodies. Chapter IV (Articles 35 to 51) governs how Member States notify these bodies to the Commission and the requirements they must meet. Chapter IV applies from 11 June 2026, ahead of the general date of application of 11 December 2027 (Article 71(2), second subparagraph), so that bodies can be in place when manufacturers need them. This is not related to the reporting of vulnerabilities by manufacturers under Article 14.
Fees for conformity assessment procedures must take into account the interests and needs of microenterprises and SMEs and be reduced proportionately (Article 32(6)).
Fictional example — Northwind Home
Northwind Home, a fictional company, makes a connected kitchen scale (not listed in Annex III or IV) and a smart door lock (smart home product with security functionalities, listed in class I of Annex III). For the scale it can use internal control. For the lock, it checks whether harmonised standards covering the relevant Annex I requirements have been published and fully applied; if not, it must use module B + C or module H with a notified body. It draws up one technical file per product, an EU declaration of conformity for each, and affixes the CE marking only after the assessment.
Our interpretation
Classification is the decisive step. In our reading, the test is the product's core functionality, not the presence of a security feature: a product that merely includes a password field is not thereby a "password manager". Document the classification reasoning in the technical documentation, as it determines the procedure.
Good practice (recommendation, not a legal requirement)
Start with an inventory of products, classify each one against Annex III and IV with a written rationale, identify which harmonised standards you intend to apply, and contact notified bodies early if a third-party procedure is likely — capacity may be limited when the general obligations start applying. These are practical suggestions, not legal requirements.
What to do next
Classify your products against Annex III and Annex IV, then read Article 32 and Annex VIII for the procedures that apply to each class.