Conformity assessment based on internal control (module A)

Annex VIII Part I (1)

manufacturer · module a · Annex VIII Part I (1)

Internal control is the conformity assessment procedure whereby the manufacturer fulfils the obligations set out in points 2, 3 and 4 of this Part, and ensures and declares on its sole responsibility that the products with digital elements satisfy all the essential cybersecurity requirements set out in Part I of Annex I and the manufacturer meets the essential cybersecurity requirements set out in Part II of Annex I.

How to satisfy it: Module A is the only self-assessment route. It is available for default-class products and, under Article 32(2), for Annex III class I products only where harmonised standards were applied in full. No CRA harmonised standard is cited in the Official Journal as of 13 Aug 2026.

Annex VIII Part I (1) on EUR-Lex · as of 2026-08-13 · Regulation (EU) 2024/2847

Annex VIII Part I (2)

manufacturer · module a · Annex VIII Part I (2)

The manufacturer shall draw up the technical documentation described in Annex VII.

Annex VIII Part I (2) on EUR-Lex · as of 2026-08-13 · Regulation (EU) 2024/2847

Annex VIII Part I (3)

manufacturer · module a · Annex VIII Part I (3)

Design, development, production and vulnerability handling of products with digital elements The manufacturer shall take all measures necessary so that the design, development, production and vulnerability handling processes and their monitoring ensure compliance of the manufactured or developed products with digital elements and of the processes put in place by the manufacturer with the essential cybersecurity requirements set out in Parts I and II of Annex I.

Annex VIII Part I (3) on EUR-Lex · as of 2026-08-13 · Regulation (EU) 2024/2847

Annex VIII Part I (4)

manufacturer · module a · Annex VIII Part I (4)

Conformity marking and declaration of conformity 4.1. The manufacturer shall affix the CE marking to each individual product with digital elements that satisfies the applicable requirements set out in this Regulation. 4.2. The manufacturer shall draw up a written EU declaration of conformity for each product with digital elements in accordance with Article 28 and keep it together with the technical documentation at the disposal of the national authorities for 10 years after the product with digital elements has been placed on the market or for the support period, whichever is longer. The EU declaration of conformity shall identify the product with digital elements for which it has been drawn up. A copy of the EU declaration of conformity shall be made available to the relevant authorities upon request.

Annex VIII Part I (4) on EUR-Lex · as of 2026-08-13 · Regulation (EU) 2024/2847

Annex VIII Part I (5)

manufacturer · module a · Annex VIII Part I (5)

Authorised representatives The manufacturer’s obligations set out in point 4 may be fulfilled by its authorised representative, on its behalf and under its responsibility, provided that the relevant obligations are specified in the mandate.

Annex VIII Part I (5) on EUR-Lex · as of 2026-08-13 · Regulation (EU) 2024/2847