CRA Conformity and Documentation Workflow

Default vs Important Class I and II vs Critical: how the CRA tiers products and which conformity route each tier requires.

Not all 13 security requirements apply to every product. Work out which ones bind yours, and start from a worked example instead of a blank page.

When self-assessment is enough (Module A), when a notified body is required (Module B+C or H), which fits your classification, and how the cost compares.

The third route to presumption of conformity: a certificate under a European cybersecurity certification scheme. What EUCC covers, the "substantial" assurance level, and why it is not yet switched on.

The technical documentation file CRA Annex VII requires you to compile, what each of its eight sections must cover, the retention floor under Article 13(13), and what market surveillance can request.

Prepare the declaration that ties your conformity assessment, technical documentation, and product identity into one market-facing statement. Legal basis: CRA Article 28 and Article 13(20).