CE Marking Self-Certification, Explained

Not every CE-marked product needs a lab, a notified body, or a stack of paid certificates. For a large share of everyday electronics and equipment, the law lets the manufacturer test, document and declare compliance themselves, with nobody else involved. That route is Module A, usually just called self-certification. This guide sets out what it actually covers, which products genuinely qualify, and where guessing wrong stops being a shortcut and turns into a real compliance problem, backed by a number worth sitting with: EU market surveillance authorities logged 4,671 dangerous-product alerts in 2025, the highest count since the rapid-alert system began.

What is Module A self-certification, exactly?

Module A, or internal production control, is one of several conformity assessment procedures set out in Decision No 768/2008/EC, the framework decision that standardised how CE marking legislation handles conformity checks. Under Module A, the manufacturer builds the technical documentation, works out which harmonised standards apply, does or commissions the necessary testing, and then signs a Declaration of Conformity under their own sole responsibility. Nobody outside the company reviews the file or certifies the result before it goes to market.

That doesn't mean no testing happens. It means the testing and the judgement about whether the product passes stay inside the manufacturer's own process, rather than being formally assessed and signed off by an accredited third party. See our plain explainer on what CE marking actually means if you want the fuller picture of what the mark is asserting.

Which products typically qualify for self-certification?

Self-certification is the default route for most low and moderate-risk goods covered by the New Legislative Framework directives: general electronics falling under the Low Voltage Directive and EMC Directive, most radio equipment under the Radio Equipment Directive, the bulk of toys under the Toy Safety Directive, and general machinery that doesn't appear on the high-risk list in Annex IV of the Machinery Regulation. A basic LED desk lamp, a Bluetooth speaker, a domestic kettle, and a standard router or webcam almost always sit here.

It's worth being precise about what "self" means in practice. Nothing stops a manufacturer paying an accredited lab to run EMC or safety tests and hand back a test report. That report becomes part of the technical file either way. What makes it Module A is that no external body is formally assessing the product against the directive and issuing a certificate before the manufacturer applies the mark: the manufacturer reads the results, decides they meet the standard, and signs the declaration themselves.

Which products legally need a notified body instead?

A meaningful slice of CE-marked goods are legally barred from self-certification altogether, regardless of how confident the manufacturer feels about the design. The trigger is risk, not product complexity or company size. Class IIa and above medical devices, PPE rated Category III (equipment meant to guard against mortal danger or irreversible harm, such as fall-arrest harnesses or breathing apparatus), pressure equipment above set thresholds, lifts, cableway installations, and the specific high-risk machinery types listed in Annex IV of the Machinery Regulation, such as certain power presses and chainsaws, all require a notified body to examine the design, the production process, or both.

The table below shows how the same broad product families can split between the two routes depending on the exact model and its risk profile.

Treat this as a starting map, not a final answer: the specific directive or regulation for your product family is what actually decides the assessment route, and thresholds vary by category. Our free product check tool walks through the applicable rules for your specific product rather than a general table.

What does self-certifying actually involve doing?

Four things, done properly rather than skipped past. First, a genuine risk assessment against the relevant essential requirements, not a box-ticking exercise copied from a competitor's listing. Second, identifying and applying the harmonised standards that give presumption of conformity, and testing against them, whether in-house or through a lab. Third, compiling a technical file that documents the design, the testing, and the reasoning, kept for ten years and produced on request if a market surveillance authority asks. Fourth, signing the Declaration of Conformity, naming the specific legislation and standards relied on rather than a vague claim of "EU compliance".

None of these steps are optional extras layered on top of self-certification. They are what self-certification is. Skipping the risk assessment or the technical file doesn't make the process faster; it makes the declaration you signed inaccurate, which carries the same legal exposure whether or not a notified body was ever supposed to be involved.

Getting it wrong: why self-certification isn't a shortcut

Picture a small workwear brand that has spent two years self-certifying hi-vis vests and cut-resistant gloves, both PPE Category I items, in an afternoon each. It decides to add a fall-arrest harness for scaffolders to its range and treats it the same way: write the file, sign the declaration, ship it. A fall-arrest harness is PPE Category III under EU Regulation 2016/425, because it protects against a fall from height, a risk of serious or fatal injury. By law it needs EU type-examination by a notified body, plus an ongoing production-monitoring procedure, not a manufacturer's own signature. The brand's neatly formatted Declaration of Conformity is worthless in that scenario: the harness was never validly CE marked, and if it fails in the field, there is no third-party assessment record to stand behind it, only a paper trail showing the company knew how conformity assessment worked and applied the wrong tier anyway.

That distinction matters because market surveillance in the EU has been getting more active, not less. The Commission's 2025 Safety Gate report recorded 4,671 alerts for dangerous non-food products, a 13% rise on the year before, alongside a sharp increase in follow-up enforcement actions across member states. Wrongly self-certified goods in a high-risk category are exactly the kind of product this system exists to catch: mis-declaring the assessment route doesn't just risk a fine, it can mean the product is treated as never having been lawfully placed on the market at all, with a recall and reputational damage that dwarfs whatever the notified body's fee would have cost.

How do you check which route your product needs?

Start with the specific directive or regulation your product falls under, since that document (not a general guide) defines the risk categories and their assessment modules. The Blue Guide on the implementation of EU product rules, the Commission's own reference on how these rules are meant to work in practice, is the authoritative explainer if you want to read the source material directly, alongside the Your Europe CE marking overview for a plainer-language summary. Neither is a substitute for reading your product's specific legislation carefully, particularly around any annex listing high-risk categories by name.

If reading directive annexes isn't how you want to spend an afternoon, our free product compliance check asks about your product and returns the legislation, standards and conformity assessment route that actually apply, including whether you can self-certify or need to budget for a notified body. Getting this one decision right at the start saves the far more expensive conversation that happens after a customs hold or a market surveillance letter.