Article 40 — Presumption of conformity of notified bodies

Cyber Resilience Act (CRA) · Chapter IV

Where a conformity assessment body demonstrates its conformity with the criteria laid down in the relevant harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union it shall be presumed to comply with the requirements set out in Article 39 in so far as the applicable harmonised standards cover those requirements.

In practiceMeroi Security’s note, not part of the regulation

This article assumes accreditation without describing it. The Blue Guide fills that in: accreditation performed to the EN ISO/IEC 17000 series of standards by nationally recognised accreditation bodies that are members of the European co-operation for Accreditation is a technical assessment of the competence of the body seeking notification, and although it is not a requirement it remains an important and favoured instrument, which national notifying authorities should treat as the most favoured technical basis so as to reduce differences in the criteria applied for notification. The European Cooperation for Accreditation has developed a recommendation on standards for accreditation for each relevant piece of Union harmonisation legislation and each conformity assessment module. That account of practice comes from the Blue Guide and is not mandated by the CRA.

Source: Blue Guide 2022 (2022/C 247/01) §5.3.2.3, horizontal product-law guidance that predates the CRA

General information. This does not constitute legal advice.