Notified body
An independent, accredited third-party organisation that has been designated by a Member State authority and notified to the European Commission to carry out third-party conformity assessment procedures under the CRA. Notified bodies evaluate whether important and critical products meet the essential cybersecurity requirements before CE marking is applied.
Source citations
See also
Regulation text
Article 3(29) of Regulation (EU) 2024/2847 defines a notified body as:
"a conformity assessment body that has been notified in accordance with Article 43 of this Regulation".
Article 39 sets out the general requirements and Articles 40–51 govern the complete framework for notified bodies.
Designation and notification
- Notified bodies are national bodies — they are accredited and designated by a Member State authority (the "notifying authority") and then formally notified to the Commission
- Notification is done via the NANDO (New Approach Notified and Designated Organisations) database
- A single notified body may be designated for multiple product categories and conformity assessment procedures
Requirements for notified bodies
Notified bodies must demonstrate:
- Independence from manufacturers, importers, distributors, and entities with commercial interests in the products they assess
- Competence — relevant technical expertise and qualified staff
- Impartiality — no conflicts of interest; staff must not have provided consultancy to applicants within 5 years
- Compliance with Art. 40 accreditation requirements
Role in CRA conformity assessment
| Procedure | Notified body involvement |
|---|---|
| Module A | None |
| Module B | Examines technical documentation and tests specimen; issues EU-type examination certificate |
| Module C | No additional involvement (manufacturer self-declares conformity to examined type) |
| Module H | Audits and approves manufacturer's quality management system |
| EUCC | Acts as conformity assessment body under the Cybersecurity Act scheme |
Subcontracting
Notified bodies may subcontract specific tasks but must ensure subcontractors meet the same competence and independence requirements. The notified body remains responsible for the assessment outcome.
Where to find notified bodies
Notified bodies are searchable in the European Commission's NANDO database: https://ec.europa.eu/growth/tools-databases/nando/