What happened
Articles 35 to 51 of the Cyber Resilience Act, on notifying authorities and conformity assessment bodies, apply from 11 June 2026 under Article 71(2). Member States must have designated their notifying authorities by that date and, under Article 35(2), should strive to have a sufficient number of notified bodies by 11 December 2026. On 31 July 2026 the Commission wrote that NANDO will list CRA notified bodies "once available".
What it means for machine builders
If any product you place on the market is important class II or critical, you will need a notified body from 11 December 2027. There is none yet. Capacity will be tight in 2027. Technical directors should decide now which products need third-party assessment, pre-select a body with CRA ambitions and prepare the technical documentation so the assessment can start the day a body is notified. For default and class I products this item changes nothing.
Official source EUR-Lex, Regulation (EU) 2024/2847, Article 71
See also Official: Commission, CRA conformity assessment page
Published 16 October 2026 by Edge SDN. A summary, not legal advice. Always check the official text for your case.