Module A and the Presumption of Conformity: How the CRA Impacts Product Certification

The European Union is dramatically changing how it regulates products with digital elements. The Cyber Resilience Act (CRA) introduces mandatory cybersecurity requirements for hardware and software placed on the EU market. For most manufacturers, the path to compliance involves understanding CRA Module A and utilizing a powerful regulatory mechanism known as the Presumption of Conformity. 

Unlike traditional security frameworks that only target highly critical infrastructure, the CRA casts a wide net. It affects everything from smart home devices to industrial control software. This means achieving cybersecurity compliance is no longer optional for securing your EU product certification and affixing the CE mark. 

Understanding CRA Module A and Internal Control 

Under the CRA, products are categorized by their criticality. Products classified in the default category (which covers the vast majority of consumer and standard industrial devices) can undergo a CRA conformity assessment based on internal control. This process is formally defined as Module A. 

Module A allows the manufacturers to declare conformity on their own responsibility, without mandatory involvement from a third-party notified body. However, this does not mean you can simply check a box. Manufacturers must compile comprehensive technical documentation proving that their product meets the essential cybersecurity requirements laid out in CRA Annex I. You must document your risk assessment, your secure development lifecycle, and your vulnerability handling processes.

The Power of Harmonized Standards (hEN) 

Proving compliance with the broad, high-level requirements of CRA Annex I is difficult if you start from scratch. This is where harmonized standards (hEN) become vital. The European Commission issues standardization requests (such as the M/606 standards request) to European standardization organizations like CEN, CENELEC, and ETSI. Their job is to translate the legal text of the CRA into concrete, technical specifications. 

When a manufacturer fully applies these harmonized standards to their product, they benefit from the Presumption of Conformity. In legal terms, this means regulatory authorities presume the product satisfies the corresponding essential requirements of the CRA. It transforms a subjective assessment of "secure enough" into an objective checklist of technical controls. For connected consumer products, checking resources like How to Meet IoT Cybersecurity Standards Using the ETSI EN 303 645 Guide gives a practical look at how these standards operate.

CE Marking Under CRA and Market Access 

The ultimate goal of this process is obtaining the CE marking under CRA. Without it, you cannot legally sell your product in the European Union. By using Module A in combination with harmonized standards, manufacturers can streamline their time to market while ensuring strong security baselines. 

If your product falls into a higher critical class, or if you choose not to use harmonized standards, you must use stricter conformity assessment modules (like Module B or Module H) which require third-party examination. In these cases, the expertise of an accredited lab is mandatory. To understand how these frameworks compare to other major schemes, you can read about Mapping EUCC to Common Criteria. 

Practical Steps for Manufacturers 

To navigate this new regulatory landscape efficiently: 

• Conduct a Gap Analysis: Evaluate your current product against CRA Annex I. If you need a structured approach, review our insights on CRA Gap Analysis. 

• Adopt Harmonized Standards: Track the development of the M/606 standards and align your engineering practices with them early to leverage the Presumption of Conformity. 

• Prepare Technical Documentation: Build your technical files iteratively during the development phase, rather than treating them as an afterthought. 

For manufacturers operating in specific sectors, it is also important to understand overlapping regulations. For example, wireless device manufacturers should review The Radio Equipment Directive Explained to ensure they meet all applicable obligations.

How QIMA CCLab Can Help 

CCLab is an accredited IT Security Evaluation Facility (ITSEF) operating under TrustCB in the EUCC scheme. We have been running Common Criteria evaluations since 2013, making us the first accredited CC laboratory in Eastern Europe and Hungary's only CC lab. 

• Gap Analysis and Readiness: We help product teams understand their current security posture against upcoming CRA and EUCC requirements. 

• Consultancy and Training: We assist in building the design evidence, test documentation, and lifecycle management materials required for conformity assessment. 

• Cybersecurity Certification Support: Our experts guide you through every stage of the evaluation and certification process, ensuring a smooth path to market. 

FAQs

How long does evaluation take? 

A cybersecurity evaluation project typically lasts several months, but the actual duration depends on many factors such as product complexity, assurance claims, and completeness of product documentation. An evaluation project includes product preparation, documentation preparation by the vendor, engagement with an accredited evaluation laboratory, laboratory evaluation activities, and finally certification by the Certification Body. 

What happens when a certified product changes? 

Certification generally applies to the specific configurations and versions evaluated. If a certified product is updated from version 1.0 to 1.0.1, the original certificate does not automatically apply to the new version. Product changes are typically handled through Assurance Continuity processes, which allow minor changes to be appended without full re-evaluation. 

What is Assurance Continuity? 

Assurance Continuity allows minor, non-security-impacting changes to be appended to an existing certificate without a full re-evaluation. In cases where changes are security-relevant, it allows these changes to be rapidly evaluated by utilizing results from the original evaluation. Policies and implementation details vary across national schemes. 

Why buy certified products? 

Certified products have undergone a rigorous evaluation process performed by accredited third-party security labs in accordance with internationally accepted criteria. Advantages include verified product security functions, independent vulnerability assessments, reviewed development practices, and fulfillment of formal procurement policies.