The CRA Notified Body Capacity Crisis: What Class II and Critical Manufacturers Should Actually Do

Chapter IV of the Cyber Resilience Act - the part that lets national authorities designate notified bodies - started applying back on 11 June 2026. As of today, zero CRA notified bodies are listed in NANDO, the EU's official registry of conformity assessment bodies. If your product needs third-party assessment, the queue you're waiting in doesn't exist yet.

The good news: this affects a minority of manufacturers, and it isn't a reason to stop working. It's a reason to work on the parts that don't depend on a notified body existing.

Who this actually hits

Roughly 90% of products under the CRA - everything in the default tier and Important Class I - can go through self-assessment (Module A) and never need a notified body at all. This crisis is specific to two tiers:

• Important Class II products: firewalls, hypervisors, container runtimes, intrusion detection/prevention systems, tamper-resistant microcontrollers.
• Critical products (Annex IV): hardware security modules, smart meter gateways, secure elements.

If your product doesn't fall into one of those categories, the notified body gap doesn't block your path to CE marking. If it does, keep reading.

Why there's no queue to join

Designating a notified body isn't a registration form - it's an accreditation process, a review by the national notifying authority, and a Commission notification, and that sequence typically takes 12 to 18 months from a standing start. Chapter IV only opened the door on 11 June 2026, so the earliest realistic designations are still some way off.

There's a second, compounding problem even once bodies exist. Module B assessments (the per-product route) depend on harmonised standards to assess against - and none has been cited in the Official Journal yet, so there's nothing concrete for an assessor to check your product against. Module H (quality-system audits) has a different snag: candidate bodies are currently building their audit designs around different base standards - ISO 27001, ISO 9001, IEC 62443-4-1 - with no single reference point, which slows down how fast any of them can start operating consistently.

What to do while the queue doesn't exist

The manufacturers treating this well aren't waiting for capacity to appear - they're building the evidence a notified body will eventually need to review, so the eventual assessment is a formality rather than a scramble. Concretely, before a notified body exists to talk to:

• Finish your technical documentation now. Risk assessment, SBOM, vulnerability handling process - all of it needs to exist regardless of who signs off on it.
• Pick your base quality standard. If you're heading toward a Module H route, decide now whether you're building your quality system around ISO 27001, ISO 9001 or IEC 62443-4-1, so you're not retrofitting later.
• Start watching for "CRA readiness" programs. Some candidate bodies are already running early-engagement programs ahead of formal designation - being on their radar early is worth more than being first in line once they're designated.
• Work backward from 11 December 2027, not forward from today.

A working timeline for a Class II product

For a Class II product you want on the market around the full-application deadline, a reasonable backward plan looks like:

• Q3-Q4 2026: complete technical documentation, risk assessment and SBOM.
• Q1 2027: begin notified body search and contracting - expect 2-4 months once bodies exist.
• Q1-Q3 2027: complete the Module B or Module H assessment itself - plan for 3-6 months.
• By September 2027: finalise CE marking mechanics with a buffer before the deadline.

Compress this and you're gambling on a bottleneck resolving faster than accreditation timelines suggest it will.

The one-line version

The queue is a vendor dependency, not a waiting room. What you control - your risk analysis, your design controls, your vulnerability process - is exactly what determines how fast the eventual assessment goes once a notified body is finally there to do it. Manufacturers who used this gap to get that evidence airtight will clear conformity assessment fast when it opens up; manufacturers who waited will be doing in three months what could have been done over the last year.