Article 35 — Notification

Cyber Resilience Act (CRA) · Chapter IV

Member States shall notify the Commission and the other Member States of bodies authorised to carry out conformity assessments in accordance with this Regulation.

Member States shall strive to ensure, by 11 December 2026 that there is a sufficient number of notified bodies in the Union to carry out conformity assessments, in order to avoid bottlenecks and hindrances to market entry.

In practiceMeroi Security’s note, not part of the regulation

Designation and notification are separate steps. The Blue Guide explains that designation is the act of the designating authority, and that only the act of notifying the Commission and the other Member States turns a designated body into a notified body. It also records that notification falls within the discretion of Member States, so they are not obliged to notify every body demonstrating technical competence, nor to notify a body in respect of each procedure under a given act. That is the Blue Guide describing how the New Legislative Framework has always worked and is not mandated by the CRA, which in Article 35(2) asks only that Member States strive to ensure a sufficient number of notified bodies by 11 December 2026.

Source: the Regulation, Article 35; Blue Guide 2022 (2022/C 247/01) §5.3.2.1, horizontal product-law guidance that predates the CRA

General information. This does not constitute legal advice.