Self-assessment vs notified body: why most products skip the lab
The CRA lets the majority of manufacturers assess their own products. Here is who can, who cannot, and what self-assessment actually involves.
One of the most expensive misunderstandings about the CRA is that compliance means hiring a lab. For most products, it does not. The regulation is built to let manufacturers assess their own products, and it expects them to.
The three buckets
Your conformity route depends on how your product classifies. There are three broad buckets.
- Default category: products not named as important or critical. These can be self-assessed by the manufacturer. Most products land here.
- Important products (Annex III): split into two classes. Under Art. 32(2), the lower class can self-assess only by applying in full a cited harmonised standard, a common specification or a European cybersecurity certification scheme at assurance level at least 'substantial', and no CRA harmonised standard is cited yet, so for now it usually needs a third party too. The higher class needs a third-party assessment or, where one applies, a European cybersecurity certificate.
- Critical products (Annex IV): the highest-risk categories. Today they follow the same third-party procedures as the higher Annex III class, and a future delegated act may require a European cybersecurity certificate.
Free and open-source software in either Annex III class may self-assess if its technical documentation is public (Art. 32(5)).
About 90% of products fall into the default category. That is why most manufacturers can comply without a notified body.
What self-assessment actually is
Self-assessment is not a lighter obligation. It is documentation work you do yourself instead of paying someone else to watch you do it. In practice it means: confirm your classification, run the mandatory risk assessment, work through the Annex I essential requirements and show how your product meets each one, capture the evidence (including an SBOM and vulnerability screening), and produce the technical file and Declaration of Conformity.
The reason a lab costs tens of thousands per product is not that the work is exotic. It is that the standards are written for assessors and you are paying someone to interpret them. Where your product may self-assess, software that translates the requirements into plain language and captures the evidence for you does that interpretation for a fraction of the cost.
What each route costs, and where the money goes
Your class decides the route, and the route decides the cost. A Default-category product may always self-assess (Art. 32(1), Module A), so no lab fee is due: the real spend there is consultant fees and your own team's weeks. Where a third party is needed, it is a line in the budget that software does not remove; what software changes is how ready the evidence is when the assessor asks for it.
Where your product may self-assess, three ways to get the work done, side by side. On a phone, scroll the table sideways to see every column.
| Compared on | Test lab or notified body | Compliance consultant | Guided self-assessment software |
|---|---|---|---|
| Typical cost | €25,000 or more per product | Tens of thousands of euros | A fraction of that, per year |
| Typical time | Weeks to months | Weeks | Hours to answer; closing the gaps it finds takes longer |
| Your team's time | Hours of preparation and chasing | Hours of interviews and reviews | Answering guided questions |
| Who does the work | The lab, while you wait | The consultant, from your briefing | You, guided step by step |
| What you learn | Little | Some | How your own product complies |
| When the rules change | Pay again | Pay again | The assessment updates with the requirement pack |
These are orders of magnitude, not quotes: a notified body prices each product itself. Where one is required, the classification step in Vandorisk says so, and the evidence it helps you prepare is what makes that assessment faster.
Not sure which bucket your product is in? The classification is the first thing our free check gives you, along with the conformity route it implies.