Skip to content

Home
About
Our Services
Resources
- Cyber Resilience Act
News
Contact Us

English 中文 (台灣)

Article 48 — Appeal against decisions of notified bodies

Cyber Resilience Act · CHAPTER IV

Cyber Resilience Act

Contents 71 articles

CHAPTER I GENERAL PROVISIONS

1 Subject matter
2 Scope
3 Definitions
4 Free movement
5 Procurement or use of products with digital elements
6 Requirements for products with digital elements
7 Important products with digital elements
8 Critical products with digital elements
9 Stakeholder consultation
10 Enhancing skills in a cyber resilient digital environment
11 General product safety
12 High-risk AI systems

CHAPTER II OBLIGATIONS OF ECONOMIC OPERATORS AND PROVISIONS IN RELATION TO FREE AND OPEN-SOURCE SOFTWARE

13 Obligations of manufacturers
14 Reporting obligations of manufacturers
15 Voluntary reporting
16 Establishment of a single reporting platform
17 Other provisions related to reporting
18 Authorised representatives
19 Obligations of importers
20 Obligations of distributors
21 Cases in which obligations of manufacturers apply to importers and distributors
22 Other cases in which obligations of manufacturers apply
23 Identification of economic operators
24 Obligations of open-source software stewards
25 Security attestation of free and open-source software
26 Guidance

CHAPTER III CONFORMITY OF THE PRODUCT WITH DIGITAL ELEMENTS

27 Presumption of conformity
28 EU declaration of conformity
29 General principles of the CE marking
30 Rules and conditions for affixing the CE marking
31 Technical documentation
32 Conformity assessment procedures for products with digital elements
33 Support measures for microenterprises and small and medium-sized enterprises, including start-ups
34 Mutual recognition agreements

CHAPTER IV NOTIFICATION OF CONFORMITY ASSESSMENT BODIES

35 Notification
36 Notifying authorities
37 Requirements relating to notifying authorities
38 Information obligation on notifying authorities
39 Requirements relating to notified bodies
40 Presumption of conformity of notified bodies
41 Subsidiaries of and subcontracting by notified bodies
42 Application for notification
43 Notification procedure
44 Identification numbers and lists of notified bodies
45 Changes to notifications
46 Challenge of the competence of notified bodies
47 Operational obligations of notified bodies
48 Appeal against decisions of notified bodies
49 Information obligation on notified bodies
50 Exchange of experience
51 Coordination of notified bodies

CHAPTER V MARKET SURVEILLANCE AND ENFORCEMENT

52 Market surveillance and control of products with digital elements in the Union market
53 Access to data and documentation
54 Procedure at national level concerning products with digital elements presenting a significant cybersecurity risk
55 Union safeguard procedure
56 Procedure at Union level concerning products with digital elements presenting a significant cybersecurity risk
57 Compliant products with digital elements which present a significant cybersecurity risk
58 Formal non-compliance
59 Joint activities of market surveillance authorities
60 Sweeps

CHAPTER VI DELEGATED POWERS AND COMMITTEE PROCEDURE

61 Exercise of the delegation
62 Committee procedure

CHAPTER VII CONFIDENTIALITY AND PENALTIES

63 Confidentiality
64 Penalties
65 Representative actions

CHAPTER VIII TRANSITIONAL AND FINAL PROVISIONS

66 Amendment to Regulation (EU) 2019/1020
67 Amendment to Directive (EU) 2020/1828
68 Amendment to Regulation (EU) No 168/2013
69 Transitional provisions
70 Evaluation and review
71 Entry into force and application

ANNEXES 8 annexes

I ESSENTIAL CYBERSECURITY REQUIREMENTS
II INFORMATION AND INSTRUCTIONS TO THE USER
III IMPORTANT PRODUCTS WITH DIGITAL ELEMENTS
IV CRITICAL PRODUCTS WITH DIGITAL ELEMENTS
V EU DECLARATION OF CONFORMITY
VI SIMPLIFIED EU DECLARATION OF CONFORMITY
VII CONTENT OF THE TECHNICAL DOCUMENTATION
VIII CONFORMITY ASSESSMENT PROCEDURES

Cyber Resilience Act › CHAPTER IV — NOTIFICATION OF CONFORMITY ASSESSMENT BODIES

Member States shall ensure that an appeal procedure against decisions of the notified bodies is available.

Previous Article 47 — Operational obligations of notified bodies Next Article 49 — Information obligation on notified bodies

Need help applying this in practice?

Reading the regulation is the easy part. We help manufacturers work out what it means for a specific product, and what evidence a notified body will expect.

CRA compliance services

Source and currency. Text of Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements, reproduced from EUR-Lex (CELEX 32024R2847) as at 16 August 2026. © European Union, 1998–2026. Reuse is authorised under the EUR-Lex legal notice.

Only the Official Journal of the European Union is authentic and produces legal effect. This reader is provided for convenience and does not constitute legal advice.

Information Security and European Compliance Consulting

Find us on LinkedIn

Meroi Security Netherlands Pastoor van Arslaan 6AEindhoven, 5622CKThe NetherlandsKVK Number: 77783077

Meroi Security Taiwan No. 412, Guangfu S Rd, 13FDa'an District106 Taipei City

© Copyright 2021 - 2026 | Meroi Security | All Rights Reserved Privacy Policy