Guidance UpdateLiveGuidance UpdateNews
European Commission updates CRA conformity assessment page reiterating mandatory notified-body assessment for Annex IV critical products
EU Cyber Resilience Act (CRA) - Critical Products Annex IVEuropean Commission (DG CONNECT)EU
Announced
Jan 12, 2026
Description
The European Commission updated its CRA conformity assessment explainer page, reiterating that Annex IV ‘critical products’ require third-party conformity assessment by a notified body in all cases (i.e., no self-assessment route). The page also points stakeholders to Implementing Regulation (EU) 2025/2392 for the technical descriptions used to determine whether a product’s core functionality falls into Annex IV categories—an important scoping input for Annex IV compliance and conformity route selection.