Conformity Assessment Module Selection Checklist for EU CE Marking

Selecting the wrong EU conformity assessment module can stall a CE marking project, trigger market surveillance action, or force a redesign of the technical file. The choice is not a preference; it follows from the product legislation, the risk profile, and the availability of harmonised standards. This guide explains how to build a defensible conformity assessment module selection checklist.

What the EU Conformity Assessment Framework Requires

EU product rules use the New Legislative Framework. Decision No 768/2008/EC, Annex II, sets out the modules that legislation can reference. Each module defines who assesses conformity, what evidence is needed, and what happens after assessment. Regulation (EU) 2019/1020 adds market surveillance and economic operator obligations across many product areas. The Blue Guide explains how the Commission expects these rules to work in practice.

Conformity assessment is not the same as testing. ISO/IEC 17000:2020 defines it as a process that demonstrates whether specified requirements are met. A test report is one input. The module determines whether a manufacturer can self-declare, whether a notified body must perform EU-type examination, and whether production must be covered by a quality system.

Start with the applicable product legislation. It will name the module or modules allowed. If it gives a choice, document why you selected one route over another. That rationale belongs in the technical file.

Core Modules and Their Risk Logic

Decision No 768/2008/EC uses lettered modules. Module A is internal production control. The manufacturer prepares technical documentation, carries out assessment, and signs the EU declaration of conformity. Module A is common for low-risk products where harmonised standards cover all essential requirements.

Module B is EU-type examination. A notified body examines a representative sample and issues an EU-type examination certificate. Module B is almost always combined with a production module: Module C (conformity to type), Module D (quality assurance of the production process), Module E (quality assurance of the product), or Module F (product verification).

Module G is unit verification. A notified body examines an individual product. Module H is full quality assurance. It requires a quality management system approved and monitored by a notified body. Module H1 adds design examination. These modules appear when risks are higher, when harmonised standards are missing, or when legislation requires third-party involvement.

Module A vs Module H: When Self-Declaration Is Not Enough

Module A works only if the legislation allows it and the manufacturer can demonstrate compliance without a notified body. Module H is not a shortcut to CE marking. It requires documented procedures, internal audits, management review, and corrective action. If your organisation already runs ISO 9001, some Module H requirements may look familiar, but ISO 9001 certification alone does not replace notified body approval under the relevant EU legislation. Use the ISO 9001 documentation requirements guide to check whether your system produces the records a notified body will expect.

Building a conformity assessment module selection checklist

Use a conformity assessment module selection checklist before you contact a notified body or finalise the technical file. The checklist should turn legal text into verifiable decisions.

1. Identify every EU legal act that applies to the product. Check the scope, definitions, and exclusions. Do not rely on a supplier's CE certificate for a different product.
2. Extract the conformity assessment procedure. Note whether the act permits self-assessment, requires a notified body, or offers a choice between modules.
3. Map each essential requirement to evidence. Link harmonised standards, test reports, risk assessments, and design drawings. If a standard does not cover a requirement, record the alternative solution.
4. Assess the risk profile. Consider electrical safety, machinery hazards, EMC, chemicals, pressure, medical claims, and environmental impact. Higher risk usually points to third-party involvement.
5. Confirm notified body scope. Check the NANDO database. A notified body must be designated for the specific legislation and module. An ISO/IEC 17025 test laboratory is not automatically a notified body.
6. Decide the production control route. If Module B applies, choose C, D, E, or F based on how production is controlled and what the legislation allows.
7. Document the selection. Record the legal basis, module, notified body, certificate numbers, and review dates. Keep this record with the technical file.

A conformity assessment module selection checklist is not a one-time form. Review it when the legislation changes, when the product design changes, or when the notified body's scope changes. The EU CE Marking Technical File guide explains how the module decision feeds into the technical documentation.

Evidence, Documentation, and GDPR Touchpoints

Each module has its own evidence set. Module A needs technical documentation, internal production control records, and a declaration of conformity. Module B needs a technical file and a sample for examination. Module D or H needs quality system documentation, audit records, and surveillance plans. Module F needs product verification records.

Notified bodies and market surveillance authorities may receive personal data, such as employee training records or customer complaint files. If your documentation includes personal data, apply GDPR principles: purpose limitation, minimisation, and secure retention. A data processing agreement may be needed when a notified body or service provider processes personal data on your behalf. The GDPR Data Processing Agreement Clauses guide covers the contract terms to check.

Keep documents in a controlled system. Version control, approval dates, and traceability matter because the module decision must be auditable. If your quality system already follows ISO 9001, use its document control process, but extend it to cover EU declaration of conformity, notified body certificates, and module-specific records.

Common Selection Errors and Verification Questions

Errors usually come from assumptions. A manufacturer may choose Module A because a competitor did. A supplier may claim that a test report is enough for a high-risk product. A team may treat a voluntary certificate as legal proof of conformity.

Ask these verification questions: Does the applicable EU legislation allow the chosen module? Is the notified body designated for that legislation and module? Does the EU-type examination certificate cover the exact product variant? Are production sites included in the quality system approval? Are harmonised standards current? Is the declaration of conformity complete and signed? Are review dates set?

Market surveillance authorities can challenge the module choice years after CE marking. If the legal basis is weak, the technical file will not save the product. The conformity assessment module selection checklist should be signed off by someone with authority to accept compliance risk.

Final Verification Before You Commit

Before you sign the declaration of conformity, run a final check. Confirm the legal act, module, notified body, certificate, standards, and technical file are aligned. Confirm the production control route matches the module. Confirm the declaration lists the correct legislation and standards. Confirm the person signing has the mandate.

Use the conformity assessment module selection checklist as a living record. Update it when the product, process, or law changes. That discipline keeps CE marking defensible and reduces the chance of recalls, withdrawals, or penalties.