Conformity assessment

## Conformity assessment Conformity assessment is the process of demonstrating that a product meets specified requirements, covering testing, inspection, certification and quality system auditing. In EU product law it is the structured route by which a manufacturer proves compliance with harmonisation legislation before affixing CE marking, from internal production control to full third-party examination by a notified body. ### Key facts - Conformity assessment is defined by ISO/IEC 17000 as the demonstration that specified requirements are fulfilled; it includes testing, inspection, certification, and accreditation of the bodies that perform them. - The EU New Legislative Framework organises conformity assessment into modules, labelled A through H, matched to product risk: low-risk products use manufacturer self-assessment, high-risk products require notified body involvement. - The choice of module is dictated by the applicable directive or regulation, not by the manufacturer; using the wrong procedure invalidates the assessment. - Notified bodies are independent organisations designated by member states to carry out third-party assessment tasks such as EU type examination and quality system approval. - Conformity assessment generates the technical documentation and test evidence that support the EU declaration of conformity and that market surveillance authorities can demand. - Outside the EU, equivalent concepts include third-party certification to US standards, CPSC-accepted laboratory testing, and type approval regimes in other jurisdictions. - A flawed conformity assessment, such as testing the wrong variant or applying a withdrawn standard, leaves the product non-compliant even if the paperwork looks complete. ### What conformity assessment is Every regulated market needs an answer to the same question: who checks that the product actually meets the rules, and how? Conformity assessment is the name for the system that answers it. At its simplest, the manufacturer checks its own product against the requirements, documents the result, and declares conformity: this is first-party assessment. At its most rigorous, an independent body examines the product type, audits the factory's quality system, and tests production samples on an ongoing basis: this is third-party assessment. Between them lie supervised variants where a third party witnesses tests or inspects production. The international vocabulary comes from the ISO/IEC 17000 series and the CASCO toolbox: ISO/IEC 17025 for testing laboratories, 17020 for inspection bodies, 17065 for product certification bodies, 17021 for management system certification. Accreditation bodies assess these conformity assessment bodies against the standards, creating a chain of trust from the test bench to the regulator. When a manufacturer cites a test report, the report's credibility rests on this chain. In the EU, the New Legislative Framework standardised the procedures into modules so that every sector directive uses the same building blocks. This modular system is what makes CE marking work across 20-plus instruments: the manufacturer identifies the applicable module from the legislation, follows its steps, and produces the same kinds of outputs, a technical file and a declaration, regardless of sector. ### Why it matters for market access Conformity assessment is where market access is won or lost in practice. The legal right to sell follows the assessment, not the other way round: a product may not be placed on the market until the applicable procedure is complete. Companies that treat assessment as a final checkbox discover too late that it constrains design, materials, software, labelling and documentation, and that rework at that stage is the most expensive kind. The module determines the timeline and budget. Self-assessment under Module A can be completed in weeks if test data exists; EU type examination plus production quality assurance can take the better part of a year when notified body queues, factory audits and retesting are included. Because the legislation chooses the module, there is no negotiating a lighter procedure: a product classified in a higher risk category must go through the heavier assessment. Early regulatory scoping that identifies the correct module is therefore one of the highest-value activities in a launch plan. Assessment quality also determines enforcement resilience. Market surveillance authorities do not re-test every product; they review the technical file and the assessment trail. A file showing the right standards, competent laboratories, production-representative samples and a coherent risk assessment passes quickly. A file with gaps, such as testing to a withdrawn standard version or a risk assessment that ignores foreseeable misuse, invites deeper investigation, sample testing and potentially withdrawal orders. The assessment is the product's legal defence, and it should be built to withstand scrutiny. ### Who it applies to Conformity assessment obligations attach primarily to manufacturers, but the surrounding duties spread across the supply chain: - Manufacturers, who must carry out or arrange the applicable procedure, compile the technical documentation, and draw up the declaration of conformity. A non-EU manufacturer needs an EU-based route for documentation and authority contact. - Authorised representatives, who may perform specified assessment-related tasks under a written mandate, such as keeping documentation available, but cannot assume the manufacturer's design responsibilities. - Importers, who must verify that the manufacturer carried out the appropriate procedure, that the technical documentation can be made available, and that the product bears the required marking and labelling. - Distributors, who must act with due care that their handling does not compromise compliance and must check marking and documentation before making products available. - Notified bodies, which perform the third-party tasks the legislation assigns to them: type examination, design examination, quality system approval, product verification and unit verification. - Accreditation bodies, the national bodies that assess and monitor the competence of notified bodies and other conformity assessment bodies. Anyone who places a product on the market under their own name or trademark, or who modifies a product in a way that may affect its compliance, is treated as the manufacturer and inherits the full assessment duty. ### Requirements and the module system The EU module system organises procedures by increasing rigour. The manufacturer follows the module or combination the legislation prescribes for the product. Module A: Internal production control. The manufacturer carries out the assessment itself: identifies requirements, applies harmonised standards or equivalent solutions, performs tests, compiles the technical file, and declares conformity. No third party is involved. This covers many low-risk products, such as simple electrical equipment under the EMC Directive. Modules A1 and A2: Internal production control with supervised checks. As Module A, plus product testing by an accredited in-house body or under the responsibility of a notified body, at random intervals or for specific aspects. Modules B + C/D/E/F: EU type examination plus production conformity. The notified body examines a representative type (Module B) through design review and testing. Production conformity is then ensured by internal control (C), production quality assurance (D), product quality assurance (E), or product verification with testing of each batch or statistical sample (F). Module G: Conformity based on unit verification. The notified body examines and tests every individual unit. Used for one-off or very small series of higher-risk products. Module H: Conformity based on full quality assurance. The notified body approves and audits the manufacturer's full quality system covering design, manufacture and testing, with design examination (H1) for the highest-risk categories. Across all modules, the outputs are the same in kind: a technical file demonstrating how conformity was assessed, test and inspection evidence from competent bodies, and the EU declaration of conformity. The file must be kept for ten years after the last product is placed on the market and produced to authorities on request. | Approach | Who assesses | Assurance level | Cost and time | |---|---|---|---| | Self-assessment (Module A) | Manufacturer | Baseline; relies on market surveillance | Lowest; weeks with data in hand | | Supervised self-assessment (A1/A2) | Manufacturer with third-party checks | Moderate | Moderate | | Type examination + production control (B+C/D/E/F) | Notified body + manufacturer | High | Significant; months including audits | | Unit verification (G) | Notified body per unit | Very high per unit | High per unit; for small series | | Full quality assurance (H/H1) | Notified body audits system | Highest systemic | Highest; ongoing surveillance audits | ### Market access relevance Conformity assessment planning belongs at the concept stage of product development. The module determines which design evidence is needed: risk assessments that drive design choices, critical component lists, software lifecycle documentation for programmable products, and material specifications tied to restricted substance limits. Retrofitting this evidence after design freeze is slow and sometimes impossible without redesign. Laboratory and notified body capacity must be booked against the project plan. Sectors with mandatory third-party assessment have finite notified body capacity, and waiting lists are a normal feature of medical devices, machinery and radio equipment. Test samples must represent final production, including firmware, materials and suppliers, because assessment of a prototype that differs from production is invalid. Supply chain control is part of assessment. Material changes, supplier substitutions and manufacturing transfers can invalidate type examination or test results, triggering retesting or reassessment. Contracts with manufacturers should include change notification clauses, and the technical file should record the assessed configuration so deviations are detectable. Finally, assessment does not end at launch. Standards are updated, legislation is revised, and products evolve. A surveillance process that tracks the Official Journal for standard updates, reviews design changes for assessment impact, and refreshes declarations keeps market access continuous rather than episodic. ### Common misconceptions | Misconception | Reality | |---|---| | "Testing to any standard proves compliance." | Only the applicable harmonised standards give presumption of conformity, and only in the version cited in the Official Journal. Other standards need documented justification. | | "A test report from any lab is sufficient." | Reports must come from competent laboratories, and for notified body modules the body directs or performs the assessment. Accreditation underpins credibility. | | "We can choose the easiest module." | The legislation prescribes the module for the product and risk class. Choosing a lighter procedure invalidates the assessment. | | "Once assessed, always compliant." | Design changes, new variants, updated standards and new legislation require reassessment. Assessment covers the configuration actually assessed. | | "The notified body guarantees our product." | The notified body attests conformity of the type or system within its task scope. The manufacturer remains responsible for every unit produced. | | "Self-assessment means no evidence is needed." | Module A still requires testing, a risk assessment, a technical file and a declaration. Self-assessment is a procedure, not an exemption. | ### Frequently asked questions What is the difference between conformity assessment and certification? Conformity assessment is the whole process of demonstrating that requirements are met; certification is one form of it, in which a third party attests conformity. A CE marking based on Module A involves conformity assessment without third-party certification. How do we find a notified body for our product? The European Commission maintains the NANDO database of notified bodies, searchable by legislation and task. Engage early: scope discussions, quotation and queue time all precede the assessment itself. Can one assessment cover multiple directives? The technical file can be unified, but each applicable directive's procedure must be satisfied. A product under three directives needs three sets of essential requirements addressed, though a single test campaign and a single declaration can cover them together. What happens if a [harmonised standard](/glossary/harmonised-standard) is withdrawn? The Official Journal sets transition dates. After the date of cessation of presumption of conformity, the old version no longer gives automatic presumption, and products should be reassessed against the replacement. Surveillance processes should flag these transitions. Is US testing accepted for EU conformity assessment? Test data can support the assessment if it demonstrates compliance with the EU requirements, but the assessment itself must follow the EU module procedure. For notified body modules, the body's involvement cannot be replaced by foreign certificates. How does conformity assessment relate to market surveillance? Assessment happens before placing on the market; surveillance happens after. Authorities check the outputs of assessment, the marking, declaration and technical file, and can test products themselves. A robust assessment is the best preparation for surveillance. ### Sources - European Commission, conformity assessment building block: https://single-market-economy.ec.europa.eu/single-market/goods/building-blocks/conformity-assessment_en - European Commission, New Legislative Framework and the Blue Guide: https://single-market-economy.ec.europa.eu/single-market/goods/new-legislative-framework_en - Regulation (EU) 2019/1020 on market surveillance and compliance of products (EUR-Lex): https://eur-lex.europa.eu/eli/reg/2019/1020/oj/eng