Undergo the applicable conformity assessment procedure

Before you affix the CE mark, you must prove conformity using the right process for your product type. Most default products can self-assess. Important or critical products — those listed in Annexes III and IV — need an independent third-party auditor (a notified body) to check your work, at least partially.

Legal text

Article 13(4) of Regulation (EU) 2024/2847 requires that manufacturers shall comply with the conformity assessment procedures referred to in Article 32, prior to placing a product on the market.

Article 32 sets out the routes:

Default products — Module A (internal production control, Annex VI Module A). The manufacturer assesses conformity themselves without third-party involvement.
Important Class I products (Annex III) — Module A is available if harmonised European cybersecurity standards or common specifications are applied. Otherwise, Module B+C (EU-type examination) or Module H (full quality assurance) are required.
Important Class II products (Annex III) and Critical products (Annex IV) — always require a notified body: Module B+C or Module H.

Conformity assessment routes

Product class	Route	Notified body?
Default	Module A	No
Important Class I (with harmonised standards)	Module A	No
Important Class I (without standards)	Module B+C or H	Yes
Important Class II	Module B+C or H	Yes
Critical	Module B+C or H	Yes

Key requirements

Identify product class before selecting a conformity route (see Annexes III and IV)
Apply harmonised standards where available to maximise self-certification options
Engage a notified body if required — check the NANDO database for accredited bodies
Complete the assessment before CE marking — CE must not be affixed until conformity is established

Evidence you may need

Product classification rationale (Annex III / IV analysis)
Completed Annex VI Module A checklist (for self-certification)
Notified body certificate (Module B) where applicable
Quality-management system certificate (Module H) where applicable