CRA conformity assessment — choosing a defensible route
A self-assessment tool is not the legal conformity assessment. Route selection depends on classification and the applicable, current legal and technical basis.
Module A and third-party routes
Default products can generally use internal production control. For Class I, check the full qualifying basis and risk coverage before relying on self-assessment. Class II and critical products require the applicable more stringent route, which may involve Module B+C, Module H or a qualifying European cybersecurity certification scheme.
Four standard checks
Verify adoption, Official Journal citation, covered requirements and full application to the relevant risks. Public enquiry, comment assessment or approval as EN is not by itself an OJEU citation.
Prepare the assessment package
Freeze the product/version boundary and retain risk assessment, applicability, test evidence, SBOM, lifecycle records and the route decision. Verify a notified body's actual scope where needed. A declaration and CE marking remain the manufacturer's responsibility.
Next steps
Official sources and review context
Regulation (EU) 2024/2847 · European Commission · ENISA SRP
CRA-I18N-2026-10-14-DRAFT-4
Operational tools and retained records. No legal opinion, conformity assessment, certification or confirmation of CRA compliance is generated.