Certification bodies play an important role in the Cyber Resilience Act (CRA): they assess whether the essential cybersecurity requirements have been addressed properly.

Together with six certification bodies, RvA started a pilot for accreditation against EN-ISO/IEC 17065 for Module B and/or against EN-ISO/IEC 17021-1 for module H. In their application, the participants of the pilots defined which products will be certified based on Annex 3 and 4 of the CRA and which standards will be used for certification.

In Spring 2026, the pilot assessments with these six certification bodies take place. When temporary accreditation with restrictive conditions (TAB) is granted, certification bodies can apply for notification at the Dutch Authority for Digital Infrastructure (RDI). More information on temporary accreditation with restrictions is to be found in article 74 of BR001.

The costs for developing accreditation for the Cyber Resilience Act are divided amongst the participants of the development project. The costs for developing accreditation include, for example, training, qualification of assessors and developing the scope of accreditation. Certification bodies participating in the pilot have been invoiced a set development fee. Certification bodies that apply for a (scope) extension within two years after the pilot, pay a development fee of €1.500,-.