Fictitious example. ACME Embedded GmbH, its products, records and document IDs are invented for illustration. Use this as a structural model, not as a template to adopt unchanged — and not as legal advice.
REG-REC-021 — Conformity Assessment Route Decision
| Document ID | REG-REC-021, rev. 1.0 |
| Product | SensorNode S300 (project P-2026-04) |
| Reference | CRA Art. 32; Annex VIII (Modules A, B+C, H); classification per REG-REC-020 |
| Prepared by | Product Manager with Product Security Lead, 2026-07-06 |
| Approved by | Managing Director |
1. Decision logic applied
| Classification | Available routes | Our case |
|---|---|---|
| Default | Module A (internal control / self-assessment) | ✔ applicable |
| Important Class I | Module A only if harmonised standards / European cybersecurity certification scheme fully applied; otherwise Module B+C or H (Notified Body) | — |
| Important Class II | Module B+C or H — Notified Body always required | — |
| Critical | European cybersecurity certification scheme where mandated, else B+C / H | — |
2. Decision
S300 is classified Default (REG-REC-020). Selected route: Module A — internal production control (self-assessment) per Annex VIII.
What Module A requires from us in practice:
- Technical documentation per Annex VII, complete before placing on market (incl. pre-development risk assessment SEC-RA-S300, all versions).
- Design/development/production conformity with Annex I Part I, evidenced via SDL-POL-001 and the release conformity dossier.
- Vulnerability handling per Annex I Part II operational at launch (PSM-PROC-002 covers S300 from first shipment).
- EU Declaration of Conformity drawn up and signed by the Managing Director; CE marking affixed.
3. Contingency and lead-time planning
Although no Notified Body is required today, we record the contingency because classification can shift (see sensitivity note in REG-REC-020):
- If a later feature moves S300 (or a variant) into Important Class I and we can apply a cited harmonised standard in full, Module A remains available — the standards watchlist is maintained by the PSL (currently: monitoring hEN development under the CRA standardisation request).
- If harmonised standards are not applicable or the product reaches Class II, a Notified Body procedure (Module B+C or H) becomes mandatory. Observed lead times at NBs are 4–10 months; therefore the project plan (P-2026-04, milestone M2) contains a decision gate: "Classification re-confirmed" at the end of pre-development. Any reclassification after M2 triggers an immediate NB pre-booking to protect the launch date.
- Budget placeholder for NB scenario: recorded in the project risk register (R-07, est. €25–60k depending on module).
4. Outcome for the project plan
- No NB engagement now; self-assessment tasks are scheduled into the existing release-gate process.
- DoC template: Annex V; simplified declaration (Annex VI) will accompany the product; technical documentation per Annex VII assembled continuously in the release dossier.
Approved: Managing Director (signed, 2026-07-08)