Conformity assessment — modules A to H1 and when you need a notified body

“How do I get CE certified?” is the most common question in product compliance and the question contains the mistake. For most products there is no certificate and no certifying body. The manufacturer assesses the product themselves, draws up the technical documentation, signs the declaration of conformity and affixes the CE marking. Nobody issues permission. What varies between products is not whether somebody checks, but how much checking the law demands — and that is decided by a letter: A, B, C, D, E, F, G, H.

These letters are conformity assessment modules. They come from a single piece of EU law and they recur, almost unchanged, across toys, machinery, radio equipment, construction products and — through the delegated acts — the digital product passport regime. Once you can read them, the compliance route for a new product stops being a research project and becomes a lookup. This article explains the modules, the rule that decides which one applies to you, and how to tell a real notified body from a test laboratory that merely sounds like one.

Key takeaways

The modules are set out in Annex II to Decision No 768/2008/EC. They are not law by themselves — a module only binds you once a product act (a directive or regulation) chooses it for your product category.
Each module answers two questions: who checks the design, and who checks the production. Module B covers design only and never stands alone; it is always paired with C, D, E or F.
Module A is self-assessment. No notified body, no certificate, no external approval. It covers a large share of products carrying CE marking.
A notified body is required only where the applicable act says so — typically for higher-risk categories, or where the manufacturer has not applied harmonised standards in full.
A notified body’s four-digit identification number goes next to the CE marking only when that body was involved in the production control phase. A body involved only in module B design examination does not appear beside the marking.
A test laboratory is not a notified body, and accreditation is not notification. The only authoritative check is the Commission’s NANDO list, now reachable through the Single Market Compliance Space.
Under the ESPR, Article 4 lets the Commission specify, in each delegated act, either module A set out in Annex IV to the ESPR or one of modules B to H1 from Decision No 768/2008/EC. Module A is the expected default for most product groups.
Every module leaves behind a defined evidence trail — certificates, test reports, audit records. Those are the same data points the declaration of conformity and, increasingly, the product passport have to carry.
myDPP is not a notified body, does not perform conformity assessment and does not issue certificates. It stores, versions and serves the product data that the assessment produces.

Where the modules come from

Before 2008 every directive described its own assessment routes in its own words. A manufacturer selling a heater, a radio and a toy dealt with three vocabularies for what were substantially the same procedures. Decision No 768/2008/EC on a common framework for the marketing of products ended that by defining a menu of modules in Annex II, together with the common declaration model and the rules on CE marking.

Two things follow, and both matter in practice.

First, the Decision is a template for the legislator, not a duty for the manufacturer. You never comply with “Decision 768/2008/EC”. You comply with the Toy Safety Regulation or the Machinery Regulation, which reach into that menu and pick the modules that apply to your product. When a module appears in a specific act it may also be adapted slightly, so the act’s own annex always wins over the generic description.

Second, because the menu is shared, the routes are portable knowledge. Module H means the same thing in a lift as in a pressure vessel. A compliance manager who has run module D once can read the requirement in an unfamiliar regulation without starting over.

The two questions every module answers

The whole system becomes readable once you see that a module is an answer to two separate questions.

Question one: who checks the design? Is it enough that the manufacturer documents the design and keeps the file, or must an independent body examine the design and certify it?

Question two: who checks that production keeps matching that design? The manufacturer’s own controls, an approved quality system audited by a third party, or inspection of the products themselves?

That is why the modules come in families rather than a flat list:

Coverage	Modules
Design and production together, by the manufacturer	A, A1, A2
Design examined by a notified body	B (never used alone)
Production conformity to a B-approved type	C, C1, C2, D, E, F
Production assurance without a prior type examination	D1, E1, F1
Each individual unit verified	G
Full quality assurance covering design and production	H, H1

The modules, one by one

The A family — the manufacturer alone

Module A — internal production control. The manufacturer draws up the technical documentation, ensures the manufacturing process delivers conforming products, affixes the CE marking and signs the declaration. No third party is involved at any point. This is the route most consumer products carrying CE marking actually take, and it is the reason the phrase “CE certificate” usually describes something that does not exist.

Module A1 — internal production control plus supervised product testing. Module A, with one addition: tests on one or more specific aspects of the product must be carried out, either by an accredited in-house body or by a notified body of the manufacturer’s choosing. Used where a single property (an emission, a temperature, a safety cut-out) carries most of the risk.

Module A2 — internal production control plus supervised product checks at random intervals. Module A, plus product checks at random intervals — as a rule at least once a year — carried out by a notified body or accredited in-house body. Ongoing surveillance without an approved quality system.

Module B — the design gateway

Module B — EU type-examination. A notified body examines the technical design of the product and certifies that it meets the applicable requirements, issuing an EU type-examination certificate. The examination may cover a production type (a specimen representative of the production) or a design type (assessment of the technical documentation and supporting evidence, without a specimen).

Module B is the single most misread entry in the system, for one reason: it says nothing about production. A type-examination certificate proves that a design was approved. It does not prove that the unit in the box matches that design. That is why module B is always combined with one of the production-phase modules below, written as “B+C”, “B+D”, “B+F” and so on. A supplier presenting a bare type-examination certificate as proof of full conformity has answered only half the question.

C, D, E, F — conformity to the approved type

These four follow a module B examination and differ only in how production is controlled.

Module C — conformity to type based on internal production control. The manufacturer ensures products conform to the approved type. No notified body in the production phase. C1 adds supervised product testing; C2 adds product checks at random intervals.

Module D — conformity to type based on quality assurance of the production process. The manufacturer operates an approved quality system for production, final inspection and testing. A notified body approves the system, audits it periodically and may make unannounced visits. Because the body is involved in production control, its number goes beside the CE marking.

Module E — conformity to type based on product quality assurance. Similar to D but narrower: the approved quality system covers final product inspection and testing rather than the production process as a whole.

Module F — conformity to type based on product verification. No quality system. A notified body examines the products themselves — every unit, or statistical samples — and issues a certificate of conformity for what it verified.

D1, E1 and F1 are the same production routes used without a preceding module B. The design is not type-examined by anyone; the manufacturer keeps the technical documentation and the third-party involvement sits entirely on the production side.

G and H — the two ends of the scale

Module G — conformity based on unit verification. A notified body examines and tests each individual product and issues a certificate for it. The natural route for one-offs, very small series and large installations, where sampling makes no sense because there is nothing to sample from.

Module H — conformity based on full quality assurance. The manufacturer operates a quality system covering design, manufacture, final inspection and testing; a notified body approves it and keeps it under surveillance. Individual products are not examined at all — the system is what gets approved.

Module H1 — full quality assurance plus design examination. Module H with a design examination added on top: the notified body examines the design of the product and issues an EU design-examination certificate. The most demanding route in the menu, reserved for the highest-risk categories.

How an act picks your module

Legislators do not choose freely. The Decision directs them to select modules proportionate to the type of product and the nature of the risks, to involve a third party only where it is warranted, and to avoid imposing a route more burdensome than necessary. In practice you will meet three patterns.

A single mandatory route. The act names one module for the whole scope. Simple to apply, common in lower-risk categories.

A choice offered to the manufacturer. The act allows, say, “B+C2, B+D, B+E or H”. All are equally valid; the trade-off is commercial rather than legal. Unit verification costs per unit and suits low volumes; an approved quality system costs to establish and maintain and then scales across everything you make.

A route that depends on the product’s risk class or on the standards used. Two conditions in one. Higher risk classes are pushed towards third-party routes — and in several regimes the decisive question is whether harmonised standards were applied in full. Apply them fully and self-assessment may be available; deviate from them, apply them partially, or find no harmonised standard covering your product, and the same act may require a notified body. Manufacturers of genuinely novel products discover this late and often: the innovation itself is what removes the self-assessment option.

That last point connects to a maintenance obligation covered in our article on the EU declaration of conformity: references to harmonised standards are published in the Official Journal and are periodically superseded. A standard that drops out from under you can change not only your documentation but your assessment route.

When a notified body is required — and how to check one

A notified body is a conformity assessment body that a Member State has designated for tasks under a specific act and notified to the Commission. Three distinctions cause most of the confusion.

A test laboratory is not a notified body. Laboratories run tests under contract. That work can be perfectly good and still carry no legal status under the applicable act. Entering a contract laboratory in point 7 of the declaration of conformity, where a notified body belongs, is a substantive error.

Accreditation is not notification. Accreditation is granted by a national accreditation body under Regulation (EC) No 765/2008 and attests technical competence. Notification is a separate act by a Member State authority, for named tasks under a named piece of legislation. A body may be accredited broadly and notified narrowly.

Notification is scoped. A body notified for the Machinery Regulation is not thereby competent for toys. The scope, listed per act and often per annex or procedure, is the thing to verify — not the logo on the quotation.

The authoritative source is NANDO, the Commission’s list of notified and designated organisations, now reached through the Single Market Compliance Space, which brings NANDO together with other compliance databases in one place. Look up the body by its four-digit number, confirm the legislation it is notified for, and confirm that the notification covers the procedure you actually need.

One detail worth committing to memory, because it is misapplied constantly: the notified body’s identification number follows the CE marking only where that body was involved in the production control phase. Under module B alone the body examined the design; its number does not go on the product. Under B+D it audits production, so it does. A number placed beside the CE marking when no body was involved in production control is a marking defect in its own right — see also our article on CE marking and the digital product passport.

What the ESPR does

The ecodesign framework does not invent a new assessment system. Under Article 4 of Regulation (EU) 2024/1781, when the Commission adopts a delegated act setting ecodesign requirements for a product group, it also specifies the conformity assessment procedure — choosing either module A (internal production control) as set out in Annex IV to the ESPR, or one of modules B to H1 in Annex II to Decision No 768/2008/EC, with any adaptations the product or the requirements make necessary.

Two practical consequences for anyone planning passport work.

Expect module A for most product groups. Ecodesign requirements are largely about documented product characteristics — recycled content, durability, reparability, carbon footprint — and internal production control with solid technical documentation is the proportionate answer. The realistic expectation for most manufacturers is self-assessment against a demanding documentation standard, not an external certification exercise.

The route is set per product group, not once for the ESPR. You cannot know your procedure until the delegated act for your product group exists. Until then, the fixed point to work on is the technical documentation and the underlying product data, which every module requires regardless of who inspects it. Our article on the ESPR covers the wider framework and the working-plan sequence.

And a boundary worth stating plainly: the passport is a separate obligation running alongside the assessment. Passing module A does not create a passport, and publishing a passport does not discharge the assessment. Where the passport genuinely takes over a compliance document, it is a specific act that says so — the cases are compared in when the DPP replaces the EU declaration of conformity.

The evidence trail each module leaves

This is where the modules stop being a legal taxonomy and start being a data problem. Each route produces a defined set of records, and those records are exactly what later has to be cited, retained and — increasingly — served digitally.

Module	What it produces
A	Technical documentation, internal test records, declaration of conformity
A1 / A2	The above, plus supervised test or random-check reports
B	EU type-examination certificate: number, issuing body, date, validity, annexes
C / C1 / C2	Records of conformity to the approved type; test or check reports
D / D1 / E / E1	Quality system approval, periodic audit reports, surveillance decisions
F / F1	Product verification certificate, sampling records
G	A certificate per unit, tied to a serial number
H / H1	Quality system approval, surveillance records, plus an EU design-examination certificate under H1

Three properties of this trail decide whether it survives contact with reality.

It expires. Type-examination and design-examination certificates have validity periods and are tied to the design as approved. Modify the product and the certificate may no longer cover it. Quality system approvals depend on surveillance audits actually happening.

It is versioned by nature. The question an authority asks is not “is this product compliant” but “what applied to the units shipped in that quarter”. Overwrite the record and the answer is gone.

It is referenced elsewhere. The body’s number and the certificate number appear in point 7 of the declaration of conformity. The standards applied appear in point 6. When the same data also feeds a passport, a product sheet and a label, the cost of holding it in one place instead of four stops being theoretical — the argument we develop in DPP and PIM.

Five steps to establish your route

List every act that applies to the product. Not just the obvious one. A mains-powered device with a radio module and restricted substances sits under several regimes at once, and each brings its own assessment requirement.
For each act, read its conformity assessment article and annexes. That is where the module is named. The generic description in Decision 768/2008/EC is background; the act’s own text, including any adaptation, is what binds you.
Establish whether harmonised standards cover your product in full. This frequently decides between self-assessment and a notified body, and it is the answer most likely to change over time as standards are superseded.
If a body is required, verify it in NANDO before signing anything. Confirm the four-digit number, the legislation, and the specific procedure. Ask which module the quotation actually covers — a type examination is not a production audit.
Design the evidence trail before you need it. Decide where certificates, reports and audit records live, how versions are retained, and which fields feed the declaration and the passport. This is the part that is cheap to set up and expensive to reconstruct. Our DPP implementation checklist covers the surrounding programme.

Frequently asked questions

Is there such a thing as a CE certificate?

Not as a general document. For products under a self-assessment module the manufacturer issues a declaration of conformity and there is no certificate at all. Where a notified body is involved, what exists is a specific certificate — an EU type-examination certificate, a design-examination certificate, a quality system approval — issued for a named procedure, not a general “CE certificate”. Documents sold under that name are usually test reports or voluntary marks.

Do I need a notified body?

Only if the act applicable to your product requires one for the route you are taking. Many products are placed on the market lawfully under module A with no third party involved. Where an act offers a choice of modules, or makes third-party involvement conditional on whether harmonised standards were applied in full, the decision may partly be yours.

What is the difference between module B and module H?

Module B is a design examination that says nothing about production, so it is always combined with a production module. Module H is a full quality assurance system covering design and production together, approved and monitored by a notified body, with no examination of individual products. They are different answers to the same pair of questions, not different levels of the same route.

Does the notified body’s number always go next to the CE marking?

No. The number follows the CE marking only where the body was involved in the production control phase. A body that only carried out an EU type-examination under module B does not appear beside the marking, even though its certificate is cited in the declaration of conformity.

Which module will the ESPR require for my products?

It depends on the delegated act for your product group, which specifies either module A as set out in Annex IV to the ESPR or one of modules B to H1 from Decision No 768/2008/EC. Module A is the expected default for most groups. Until your group’s delegated act is adopted, the productive work is the technical documentation and product data, which every module requires.

Can myDPP carry out the conformity assessment?

No. myDPP is not a notified body and performs no assessment; it neither issues certificates nor signs declarations. What it does is hold the product data and documents the assessment produces — certificate numbers and validity dates, standards applied with their year of issue, test and audit records — versioned, so that the state that applied to a given batch can still be reproduced years later. The assessment itself stays with the manufacturer and, where the law requires it, with a notified body.

Sources

Decision No 768/2008/EC — common framework for the marketing of products (Annex II: modules) — EUR-Lex
Regulation (EC) No 765/2008 — accreditation and market surveillance — EUR-Lex
Regulation (EU) 2019/1020 — market surveillance and compliance of products — EUR-Lex
Regulation (EU) 2024/1781 — Ecodesign for Sustainable Products (ESPR) — EUR-Lex
The ‘Blue Guide’ on the implementation of EU product rules (2022) — European Commission
Notified bodies — NANDO and the Single Market Compliance Space — European Commission