ProofwrightScenario

Scenario: choosing your conformity route

Self-assessment or a notified body? Walk the decision the CRA forces on you, and what each path costs in time and proof.

Self-assessment or a notified body? Walk the decision the CRA forces on you, and what each path costs in time and proof. Related demos: Scenario: answering a security questionnaire and Scenario: ending support the CRA way.

Your product is ready. Before the CE mark goes on, the CRA makes you choose how conformity is assessed — and the choice depends on what your product is.

Where your product sits

QuestionAnswer
On the critical list?No
Important — class II?No
Important — class I?Yes (network management)

The route that follows

As an important, class I product you have two paths — and one is far cheaper if your house is already in order.

RouteRequiresCost
Self-assessmentFull application of harmonised standardsTime + rigour
Notified bodyThird-party technical reviewFee + weeks

The decision

You've applied the harmonised standards in full and can evidence it — SBOM, vulnerability handling, secure-by-default, technical file. So you self-assess, keep the evidence current, and hold the notified body in reserve for the day a product moves up a class.

The cheaper route is only open to teams who can prove they met the standards. Evidence is what turns "notified body" into "self-assessment."

Proofwright keeps that evidence audit-ready, so the cheaper route stays open.

this is Proofwright

It's live.

See the real thing at Proofwright.