Cyber Resilience Act · Annex VIII Part III

Conformity to type based on internal production control (module C)

Binds
manufacturer
Applies from
Conformity module
C
Evidence
document, process

Annex VIII Part III (1)

manufacturer · module c · Annex VIII Part III (1)

Conformity to type based on internal production control is the part of a conformity assessment procedure whereby the manufacturer fulfils the obligations set out in points 2 and 3 of this Part, and ensures and declares that the products with digital elements concerned are in conformity with the type described in the EU-type examination certificate and satisfy the essential cybersecurity requirements set out in Part I of Annex I and that the manufacturer meets the essential cybersecurity requirements set out in Part II of Annex I.

How to satisfy it: Module C never stands alone. It follows module B: the type is examined once, then each production run is declared conformant to that examined type.

Annex VIII Part III (1) on EUR-Lex · as of 2026-08-13 · Regulation (EU) 2024/2847

Annex VIII Part III (2)

manufacturer · module c · Annex VIII Part III (2)

Production The manufacturer shall take all measures necessary so that the production and its monitoring ensure conformity of the manufactured products with digital elements with the approved type described in the EU-type examination certificate and with the essential cybersecurity requirements as set out in Part I of Annex I and ensures that the manufacturer meets the essential cybersecurity requirements set out in Part II of Annex I.

Annex VIII Part III (2) on EUR-Lex · as of 2026-08-13 · Regulation (EU) 2024/2847

Annex VIII Part III (3)

manufacturer · module c · Annex VIII Part III (3)

Conformity marking and declaration of conformity 3.1. The manufacturer shall affix the CE marking to each individual product with digital elements that is in conformity with the type described in the EU-type examination certificate and satisfies the applicable requirements set out in this Regulation. 3.2. The manufacturer shall draw up a written declaration of conformity for a product model and keep it at the disposal of the national authorities for 10 years after the product with digital elements has been placed on the market or for the support period, whichever is longer. The declaration of conformity shall identify the product model for which it has been drawn up. A copy of the declaration of conformity shall be made available to the relevant authorities upon request.

Annex VIII Part III (3) on EUR-Lex · as of 2026-08-13 · Regulation (EU) 2024/2847

Annex VIII Part III (4)

manufacturer · module c · Annex VIII Part III (4)

Authorised representative The manufacturer’s obligations set out in point 3 may be fulfilled by its authorised representative, on its behalf and under its responsibility, provided that the relevant obligations are specified in the mandate.

Annex VIII Part III (4) on EUR-Lex · as of 2026-08-13 · Regulation (EU) 2024/2847

Every quoted requirement on this page is verbatim Official Journal text. The surrounding guidance is Legalithm’s commentary and is not regulation. This page states the obligation and its legal basis; it is not legal advice, and the corpus has not been reviewed by counsel.