Applus+ Laboratories Announces Its Roadmap for CRA Conformity Assessment Under Module H

The CRA, which will become mandatory as of December 2027, establishes binding cybersecurity requirements for all products with digital elements placed on the European Union market. For certain categories—particularly Important Class II products and Critical products—the involvement of a Notified Body will be required to carry out conformity assessment.

Among the different options provided by the regulation, Module H is emerging as the preferred pathway for manufacturers with mature quality management and cybersecurity management systems, as it enables a comprehensive system-level assessment and supports a scalable and efficient approach to regulatory compliance.

Currently, the European accreditation infrastructure for the CRA is still under development, and some specific schemes—including CRA under Module H—have not yet been formally established by National Accreditation Bodies (NABs). In this context, Applus+ Laboratories has initiated strategic discussions with key stakeholders across the regulatory ecosystem to define the necessary steps toward future accreditation and designation as a CRA Notified Body.

“Our goal is to position ourselves among the first organizations capable of offering CRA certification services under Module H. This will be a key solution for manufacturers seeking a robust, scalable evaluation model aligned with international standards, in an increasingly demanding cybersecurity regulatory environment,” says Jose Ruiz, Director of the Cybersecurity Business Unit at Applus+ Laboratories.

Through this initiative, Applus+ Laboratories reinforces its commitment to anticipating new European regulatory frameworks and supporting manufacturers in their transition toward CRA compliance by providing technical expertise, strategic insight, and high value-added conformity assessment solutions.