A notified body is an organisation designated to carry out specified conformity-assessment tasks under EU legislation. In CRA work, the term should be understood in the context of the product, its supported release and the relevant legal duty.
What it means in practice
Verify the body’s designation and scope for the applicable route. A testing lab, consultancy and notified body are not automatically the same role. Class I route conditions and Class II third-party requirements need separate review.
How to use the term in a product review
Begin by asking which product version the discussion concerns. Record the source of the information and the person responsible for reviewing it. A familiar acronym can conceal different assumptions between a firmware engineer, a compliance manager and a supplier. Write down the intended meaning in the technical evidence so those assumptions can be checked later.
Distinguish an input, an engineering conclusion and a formal conformity decision. A tool output can be a useful input without proving that an obligation is fulfilled. A reviewer needs to see the underlying artifact, the relevant requirement and the rationale connecting the two. Keep uncertain facts visible and assign a follow-up rather than silently turning an unknown into an approval.
Related work
Read the practical guide for the operational workflow and the Cyber Resilience Act overview for the broader obligations. Connect product evidence to the release inventory and ensure the incident contact understands the Article 14 process.
A useful question to ask your supplier
Ask for an example linked to an actual release and a description of who reviews it. Clarify what is automated, what an engineer decides and what remains the manufacturer’s responsibility. This separates a useful deliverable from an unexplained label in a sales presentation. External tools and advisers can support the work, but the manufacturer remains accountable for product obligations.
An illustrative engineering scenario
For example, a Class I camera project may discover that the conditional self-assessment route is unavailable. The team then identifies an appropriately designated body and agrees its assessment scope. Keep the designation reference, legislation, authorised scope and product configuration with the project evidence. A familiar corporate name alone does not establish that every office or service line can perform the required role. Engineering support, laboratory testing and statutory conformity assessment complement each other but must be described and contracted accurately.
Review questions for the product owner
Ask which product and supported version the evidence describes, which facts were checked directly and which remain assumptions. Identify the reviewer who can explain the result and the artifact that supports it. A document should not become authoritative merely because it appears in a customer portal. If its boundary is narrower than the finished product, make that limitation clear to everyone relying on it.
Check how this information enters the release process. Decide who updates the record after a component change, a new function, a supplier advisory or a change in the product’s support status. Keep older decisions available for older supported versions. Copying the latest release’s conclusion onto every branch can hide differences that matter to vulnerability handling and customer communication.
A handover that remains useful
Give the next engineer the source reference, the technical conclusion, the remaining uncertainty and the next action. Define what evidence would close an open question, who owns that work and when the team will review it. This turns a glossary concept into a practical engineering task rather than an unexplained acronym.
External suppliers can help create and maintain these records, but the manufacturer still needs to understand the basis for its decisions. Clarify which work is automated, which requires engineering judgment and which needs a separate conformity or legal specialist. Preserve the reasoning in a form your team can inspect and export. The goal is continuity across releases and personnel changes, with an evidence trail that remains connected to the actual product.
Sources
General engineering information, reviewed on the date above. Product-specific interpretations and current standards should be checked before a conformity decision. Roja helps manufacturers prepare for the Cyber Resilience Act. We do not certify products or provide legal advice.