What is module A? How does it work? What conformity assessment activities are expected for self-assessment?

Module A, set out in part I of Annex VIII, is a conformity assessment procedure in which the manufacturer verifies that the product with digital elements complies with the essential requirements of the CRA and declares compliance on its sole responsibility.

No notified bodies participate in this procedure.

The following categories of products are allowed to use module A:

• All products with digital elements that do not have the core functionality of a category of important or critical products (‘default category’).
• Important products with digital elements of class I, if a harmonised standard has been applied in accordance with Article 32(2);
• Important products with digital elements of class I or II, if they are free and open-source software provided that the technical documentation is made available to the public, in accordance with Article 32(5).

The manufacturer has to perform the following activities:

• Implement the necessary cybersecurity mitigation measures in the product following the risk assessment described in section 4.1 Risk-based approach and risk-assessment.
• Verify (via testing or other mechanism) that the product complies to the relevant essential requirements of the CRA. When applicable, see also section 6.5 Which evaluation methodology should a manufacturer apply?
• Draw up the technical documentation. See also section 6.6 What is the technical documentation?
• Once the manufacturer is in a position to demonstrate that the product with digital elements is compliant with the CRA essential requirements, affix the CE marking (see section 6.7 What is the CE marking?), draw up and sign a declaration of conformity (see section 6.8 What is the declaration of conformity?).
• Ensure that the production of the different units of the product with digital elements does not alter the compliance with the CRA essential requirements.