Source: OJ L 2024/2847, 20.11.2024

Current language: EN

Article 45 Changes to notifications


Summary What does Article 45 of the CRA regulation say?

This article deals with the consequences of a notified body falling short of its obligations — essentially, it is the enforcement mechanism that sits alongside the designation process established in Article 43.

Where a notifying authority becomes aware that a notified body no longer meets the required standards or is failing in its duties, it must take action by restricting, suspending, or withdrawing that body's notification, with the severity of the response calibrated to the seriousness of the failure.

The article also addresses the practical matter of what happens to the body's files and ongoing work if it loses its status or ceases operating entirely.

Important points:

  • Notifying authorities are required to restrict, suspend, or withdraw a notified body's notification if it no longer meets the requirements of Article 39 or fails to fulfil its obligations, and must immediately inform the Commission and other Member States.
  • The Commission and all Member States must be informed immediately when such action is taken.
  • The notifying Member State must ensure that any files held by a restricted, suspended, withdrawn, or inactive notified body are either transferred to another notified body or kept available for the relevant authorities upon request.

Springlex's summary of the article, a reading aid, not a substitute for the legal text.

    1. Where a notifying authority has ascertained or has been informed that a notified body no longer meets the requirements laid down in Article 39, or that it is failing to fulfil its obligations, the notifying authority shall restrict, suspend or withdraw notification as appropriate, depending on the seriousness of the failure to meet those requirements or fulfil those obligations. It shall immediately inform the Commission and the other Member States accordingly.

    1. In the event of restriction, suspension or withdrawal of notification, or where the notified body has ceased its activity, the notifying Member State shall take appropriate steps to ensure that the files of that body are either processed by another notified body or kept available for the responsible notifying and market surveillance authorities at their request.

We're continuously improving our platform to serve you better.

Your feedback matters! Let us know how we can improve.

Found a bug?

Springflod is a Swedish boutique consultancy firm specialising in cyber security within the financial services sector.

We offer professional services concerning information security governance, risk and compliance.

Crafted with ❤️ by Springflod