Free regulatory intelligence — powered by Certivo
Guidance UpdateLiveGuidance Update

European Commission updates CRA conformity assessment guidance reiterating mandatory notified body for Annex IV critical products and referencing Implementing Regulation (EU) 2025/2392 technical descriptions

EU Cyber Resilience Act (CRA) - Critical Products Annex IVEuropean Commission (DG CONNECT)EU
Announced

Jan 12, 2026

Description

The European Commission updated its official CRA “Conformity assessment” guidance page (last update shown on-page: 12 January 2026). The page operationalizes Annex IV (critical products) compliance by stating that use of a notified body is mandatory in all cases for critical products, and it directs stakeholders to Commission Implementing Regulation (EU) 2025/2392 for the technical descriptions of Annex III/IV product categories. This is relevant for Annex IV scoping because the technical descriptions and the ‘core functionality’ concept determine whether a product falls within a critical category, which triggers stricter conformity assessment planning (e.g., budgeting/timelines for notified body involvement).

Get compliance alerts for EU Cyber Resilience Act (CRA) - Critical Products Annex IV

Certivo tracks regulatory changes and automates compliance workflows for your products.

Start Free Trial