On 11 June 2026, the CRA's Rules on Notified Bodies Started to Apply, but None Are Designated Yet
Den Cyber Resilience Act applies in full from 11 December 2027, but it switches on in stages. On 11. september 2026 the 24-hour vulnerability reporting duty under Article 14 begins. Three months earlier, on 11 June 2026, a quieter milestone passed: under Article 71, Chapter IV of the CRA (Articles 35 to 51) started to apply. That chapter is the legal machinery for notified bodies, the independent assessors that some manufacturers will have to use before placing a product on the EU market. The rules are now live. The bodies are not.
What a notified body actually does
Under Article 32, every manufacturer must run a conformity assessment to show its product meets the essential cybersecurity requirements in Bilag I. There are several routes. The lightest is the internal control procedure (module A) set out in Annex VIII, which is pure self-assessment: the manufacturer evaluates its own product, draws up the technical documentation, and signs the EU declaration of conformity. The heavier routes, module B plus C, or the full quality assurance of module H, bring in a third party. That third party is a bemyndiget organ: under Article 2(29), a conformity assessment body that a Member State has designated through the procedure in Article 43.
Who needs one
For the large majority of products with digital elements, self-assessment is enough. The third-party route bites for the higher-risk categories the CRA singles out:
- Important products (Annex III). For class I, a manufacturer can still self-assess, but only if it fully applies the relevant harmonised standards or a cybersecurity certification scheme. Without those, it must use a notified body. For class II, a third-party route is required.
- Critical products (Annex IV). These face the strictest treatment and may be required to obtain a European cybersecurity certificate once the relevant schemes exist.
In short, the products that matter most for security are exactly the ones that will depend on a functioning notified body network.
The catch: the rules are live, the bodies are not
A notified body does not appoint itself. Under Article 36, each Member State must first designate a notifying authority, the national body responsible for assessing, designating and monitoring conformity assessment bodies. Only then can it notify bodies to the Commission, which lists them in the EU's NANDO database. As of late June 2026, that list is effectively empty for the CRA.
Although Chapter IV applies from 11 June 2026, no notified bodies have yet been designated for the CRA in the Commission's NANDO database. Manufacturers of products that require a third-party assessment cannot complete it until designations appear. Article 35(2) sets the target: Member States are to strive to ensure a sufficient number of notified bodies by 11 December 2026, specifically to avoid bottlenecks that hinder market entry.
What manufacturers should do now
The empty list is not a reason to wait. The timeline runs the other way:
- Classify your product. Decide whether it is a default product, an important product under Annex III, or a critical product under Annex IV. That single decision determines whether you can self-assess at all.
- Prepare as if for self-assessment regardless. The Annex I requirements and the technical documentation are the same work whoever signs off, so none of it is wasted.
- If you will need a notified body, get in the queue early. Several existing assessors under the Radio Equipment Directive and other frameworks have announced CRA readiness programmes. Demand will rise sharply as 11 December 2027 approaches, and capacity is finite.
The 11 June 2026 date is easy to overlook because nothing visibly happened: no platform launched, no penalty kicked in. But it started the clock on building an entire assessment capability from close to zero in eighteen months. For anyone shipping an important or critical product, the scarce resource will not be the standard or the paperwork. It will be a notified body with an open slot.