Default: you check yourself. For an ordinary product the manufacturer performs the conformity assessment alone, through the internal-control procedure (Module A). No notified body is involved (Art. 32(1), Annex VIII).
Stricter routes apply only to the product categories listed in Annex III (important products) and Annex IV (critical products).
A product is "important" when its core functionality matches a category in Annex III (Art. 7(1)). The categories split into two classes. These are the main ones; the annex is the authoritative list.
| Class | Examples from Annex III | Route |
|---|---|---|
| Not listed | Most software and devices: an app, a sensor, a dev tool, a point-of-sale system, a connected appliance without a security function | Self-assessment, Module A |
| Class I | Browsers, password managers, anti-malware, VPN products, network management tools, SIEM, boot managers, PKI software, operating systems, routers and modems and switches, security-enabled microcontrollers, smart-home voice assistants, smart locks and cameras and alarms, connected toys with chat or location features, children's wearables | Self-assessment is allowed only if you fully apply harmonised standards, common specifications or an EU certification scheme; otherwise a third-party route (Art. 32(2)) |
| Class II | Hypervisors and container runtimes, firewalls and intrusion detection or prevention systems, tamper-resistant microprocessors and microcontrollers | Third-party route in every case: EU-type examination plus production control (Modules B and C), full quality assurance (Module H), or an EU certification scheme at substantial assurance or higher (Art. 32(3)) |
| Critical (Annex IV) | Hardware security devices, smart meter gateways, smartcards and secure elements | EU cybersecurity certification scheme where one has been made mandatory (Art. 8, Art. 32(4)) |
A frequent worry, settled by the text: building a product that contains a component with Annex III functionality, say a product that embeds a VPN library or ships with an operating system, "shall not in itself render the product in which it is integrated" subject to the stricter routes (Art. 7(1)). The question is what your product's own core function is.
Module A is not a formality, it is you doing the auditor's job and signing for it. You check the product against the essential requirements of Annex I, you draw up the technical documentation of Annex VII, you issue the EU declaration of conformity (Art. 28, Annex V), and you affix the CE marking (Arts. 29–30). The evidence stays with you for at least ten years (Art. 13(13)). If an authority asks later, the file either holds up or it does not; nobody stamped it for you in advance.
Manufacturers of products that qualify as free and open-source software may use the self-assessment route regardless of class, on one condition: the technical documentation is made publicly available when the product is placed on the market (Art. 32(5)).
For Class I the route depends on whether you can apply harmonised standards in full. Those standards are being written by CEN and CENELEC and were not yet published as of this writing. Until they are, a Class I manufacturer should plan for the possibility of a third-party route and watch the standards work closely.
Two free tools that apply this to your case: the 2-minute applicability check (does the CRA apply to you, with the clauses) and the SBOM generator (CycloneDX + SPDX from your manifest, signed). Neither asks for an account.
Sources, primary only: Regulation (EU) 2024/2847 (EUR-Lex) · European Commission, CRA summary · European Commission, CRA reporting · ENISA, Single Reporting Platform. This is not legal advice; the regulation text controls.