Source: OJ L 2024/2847, 20.11.2024

Current language: EN

Article 35 Notification


Summary What does Article 35 of the CRA regulation say?

This brief but practically important article opens the chapter on notified bodies by establishing two foundational obligations for Member States.

It sets up the notification mechanism — whereby Member States must inform the Commission and each other about bodies authorised to carry out conformity assessments — and it introduces a capacity goal, requiring Member States to work toward having enough of these bodies in place by a specific date.

The article connects directly to the conformity assessment framework established elsewhere in the regulation, as notified bodies are the entities that assess whether products with digital elements meet the essential cybersecurity requirements set out in Annex I.

Important points:

  • Member States are required to notify the Commission and all other Member States of any bodies authorised to conduct conformity assessments under this Regulation.
  • Member States must strive to ensure a sufficient number of notified bodies exist in the Union by 11 December 2026.
  • The sufficiency requirement is explicitly aimed at preventing bottlenecks and hindrances to market entry.

Springlex's summary of the article, a reading aid, not a substitute for the legal text.

    1. Member States shall notify the Commission and the other Member States of bodies authorised to carry out conformity assessments in accordance with this Regulation.

    1. Member States shall strive to ensure, by 11 December 2026 that there is a sufficient number of notified bodies in the Union to carry out conformity assessments, in order to avoid bottlenecks and hindrances to market entry.

We're continuously improving our platform to serve you better.

Your feedback matters! Let us know how we can improve.

Found a bug?

Springflod is a Swedish boutique consultancy firm specialising in cyber security within the financial services sector.

We offer professional services concerning information security governance, risk and compliance.

Crafted with ❤️ by Springflod