Explanation
What conformity assessment is
Conformity assessment is the process of verifying whether the essential cybersecurity requirements set out in Annex I have been fulfilled Article 3, point (27)
. It covers both the product (Part I of Annex I) and the manufacturer's vulnerability handling processes (Part II).
What the text requires
The manufacturer must perform a conformity assessment of the product and of its processes, using one of the procedures listed in Article 32(1) (Article 32(1)):
- internal control, based on module A (Article 32(1), point (a));
- EU-type examination, based on module B, followed by conformity to EU-type based on internal production control, module C (Article 32(1), point (b));
- full quality assurance, based on module H (Article 32(1), point (c));
- where available and applicable, a European cybersecurity certification scheme pursuant to Article 27(9) (Article 32(1), point (d)).
The modules are set out in Annex VIII. Under module A, the manufacturer itself draws up the technical documentation and declares, on its sole responsibility, that the product meets the requirements (Annex VIII, Part I, point 1). Modules B and H involve a notified body: the conformity assessment bodies notified under Chapter IV, which applies from 11 June 2026.
Which route for which product?
The route depends on the category of the product, determined by its core functionality.
| Category | Where listed | Procedures |
|---|---|---|
| Default (not listed) | — | Any procedure of Article 32(1), including internal control (module A) |
| Important, class I | Annex III, Part I | Any procedure of Article 32(1) if harmonised standards, common specifications or certification schemes (at least "substantial") are fully applied; otherwise module B + C or module H (Article 32(2)) |
| Important, class II | Annex III, Part II | Module B + C, module H, or a certification scheme at assurance level at least "substantial" where available (Article 32(3)) |
| Critical | Annex IV | A European cybersecurity certification scheme in accordance with Article 8(1), or where those conditions are not met, the procedures of Article 32(3) (Article 32(4)) |
Our interpretation
Article 32(2) imposes module B + C or module H on class I products only where the manufacturer has not applied, or has applied only in part, the relevant harmonised standards, common specifications or certification schemes, or where none exist. We read this as meaning that a class I manufacturer who fully applies such instruments may use the procedures of Article 32(1), including internal control. Since harmonised standards are still being developed, check whether references have been published in the Official Journal before relying on this.
Two clarifications from the text:
- For critical products, where no delegated act has been adopted under Article 8(1), products with the core functionality of an Annex IV category are subject to the procedures of Article 32(3) (Article 8(1), second subparagraph).
- Integrating a product with the core functionality of an Annex III category does not in itself subject the host product to the procedures of Article 32(2) and (3) (Article 7(1)).
Free and open-source software in an Annex III category may use any procedure of Article 32(1), provided the technical documentation is made public when the product is placed on the market (Article 32(5)). The fees for conformity assessment must take into account the interests and needs of microenterprises and SMEs (Article 32(6)).
Harmonised standards and certification
Products and processes in conformity with harmonised standards whose references are published in the Official Journal are presumed to conform to the requirements those standards cover (Article 27(1), first subparagraph). The Commission may also specify European cybersecurity certification schemes that can be used to demonstrate conformity (Article 27(9)).
Technical documentation, EU declaration and CE marking
What the text requires
- The technical documentation must contain at least the elements of Annex VII, be drawn up before placing on the market and be continuously updated, where appropriate, at least during the support period (Article 31(1), Article 31(2)).
- The EU declaration of conformity states that fulfilment of the applicable requirements of Annex I has been demonstrated (Article 28(1)). By drawing it up,
the manufacturer shall assume responsibility for the compliance of the product with digital elements Article 28(4)
. - The CE marking is affixed visibly, legibly and indelibly before the product is placed on the market. For software, it is affixed either to the EU declaration of conformity or on the website accompanying the software product (Article 30(1), Article 30(3)).
Where a product is subject to several EU acts requiring a declaration of conformity, a single declaration covers all of them (Article 28(3)). Products may be accompanied by a simplified declaration giving the internet address of the full one (Article 13(20)).
Conformity assessment does not end at placing on the market: documentation is updated during the support period, and series production must remain in conformity (Article 13(14)).
Practical case
Fictional example — Three products at Lumen Systems
Lumen Systems, a fictional manufacturer, prepares conformity assessment for three products.
- A connected desk lamp with a mobile app. It is not listed in Annex III or IV. Lumen can use internal control (module A): it draws up the technical documentation, draws up the EU declaration of conformity and affixes the CE marking.
- A password manager — "password managers" are listed in class I of Annex III. Harmonised standards covering all the relevant requirements are not yet available to Lumen. Under Article 32(2), Lumen must use module B followed by module C, or module H, involving a notified body.
- A firewall appliance — "firewalls, intrusion detection and prevention systems" are listed in class II of Annex III. Module A is not available: Lumen must use module B + C, module H, or a certification scheme at assurance level at least "substantial" where one is available and applicable.
Lumen plans notified-body capacity and lead times early for products 2 and 3.
Exercise
EXERCISE — PICK THE PROCEDURE
For each fictional product, identify its category and the procedures available.
- A smart home security camera.
- A hypervisor.
- A connected coffee machine with a mobile app.
- A smartcard with a secure element, assuming no delegated act under Article 8(1) has been adopted.
Show a suggested answer
- "Smart home products with security functionalities, including … security cameras" are in class I of Annex III (Part I, point 17): Article 32(2) applies — module B + C or module H, unless harmonised standards, common specifications or certification schemes are fully applied.
- "Hypervisors and container runtime systems" are in class II (Annex III, Part II, point 1): module B + C, module H, or a certification scheme at least "substantial" (Article 32(3)).
- Not listed in Annex III or IV: any procedure of Article 32(1), including internal control (module A).
- "Smartcards or similar devices, including secure elements" are in Annex IV (point 3). Without a delegated act under Article 8(1), the procedures of Article 32(3) apply (Article 8(1), second subparagraph).
Key takeaways
KEY TAKEAWAYS
- Article 32(1) offers four routes: module A, module B + C, module H, or a European cybersecurity certification scheme.
- Default products can use internal control; class I products need a third party unless harmonised standards or equivalent instruments are fully applied; class II and critical products need a notified body or a certification scheme.
- The category depends on core functionality; integrating an Annex III product does not by itself change the host product's procedure.
- The EU declaration of conformity makes the manufacturer assume responsibility; the CE marking is affixed before placing on the market.
- Conformity is maintained through documentation updates during the support period.