BSI has received ISO/IEC 17065 & 17021 pre-accreditation from the Dutch Accreditation Council (RvA) for CRA Modules B and H. This covers the full scope of CRA product categories, including:
- Default,
- Important Class I and Class II,
- and Critical (see scope C646).
This milestone represents a significant step in our journey to CRA Notified Body designation.
About the CRA
The CRA sets mandatory cybersecurity requirements for hardware and software products placed into the European Union (EU) market. It entered into force on 10 December 2024.
Reporting obligations came into force on 11 September 2026. From 11 December 2027, full obligations will apply across the market. This means products with digital elements must meet CRA requirements and carry a CE mark before they enter the EU market.
Our four steps to Notified Body status
This milestone gets our journey to full Notified Body status underway. Here’s what comes next:
Step one: we are here
BSI achieves ISO/IEC accreditation from the RvA for CRA Modules B AND H on 3 November 2026.
Step two: where we are going next
We’ll go through the RDI’s (Dutch notifying authority) notification process to be notified as a CRA Notified Body.
Step three: pilot assessment
We will complete a pilot conformity assessment to implement our Module B and Module H assessment processes in practice under applicable conditions.
Step four: from accreditation to Notified Body
If step three is completed, we then receive final designation by the national authority. That gives us recognition as a CRA Notified Body across the EU. After this step, we’ll be able to provide CRA conformity assessments under Module B and H.
What does this mean for you?
Choosing a conformity route is a key decision under the CRA. As of October 2026, no CRA Notified Bodies have been officially designated.
We are pursuing accreditation for both Modules B and H so we can meet customers’ different expectations and approaches to CRA compliance. With accreditation for both modules, we can assess your products under either route:
- EU-type examination - including assessment of the technical design and development of a product with digital elements and the vulnerability handling processes
- Full quality assurance – certification process that assures the manufacturer fulfils the obligations. This allows it to ensure and declare, on its sole responsibility, that the products with digital elements satisfy the CRA’s essential cybersecurity requirements.
We’ll continue to post updates on our journey to official CRA Notified Body designation.
However, if you would like to be exclusively updated on progress and how we can help you now, you can sign up here.
