Guidance UpdateLiveGuidance Update
European Commission updates CRA conformity assessment guidance reiterating mandatory notified body for Annex IV critical products and referencing Implementing Regulation (EU) 2025/2392 technical descriptions
EU Cyber Resilience Act (CRA) - Critical Products Annex IVEuropean Commission (DG CONNECT)EU
Announced
Jan 12, 2026
Description
The European Commission updated its official CRA “Conformity assessment” guidance page (last update shown on-page: 12 January 2026). The page operationalizes Annex IV (critical products) compliance by stating that use of a notified body is mandatory in all cases for critical products, and it directs stakeholders to Commission Implementing Regulation (EU) 2025/2392 for the technical descriptions of Annex III/IV product categories. This is relevant for Annex IV scoping because the technical descriptions and the ‘core functionality’ concept determine whether a product falls within a critical category, which triggers stricter conformity assessment planning (e.g., budgeting/timelines for notified body involvement).