DQS auditors assess how effectively your management system governs the design, development, production, and vulnerability handling of products with digital elements — through accredited ISO/IEC 27001 certification, refined in line with Technical Guideline TR-03183-H of the Federal Office for Information Security (BSI), so the evidence behind your EU Declaration of Conformity is independently audited rather than self-asserted.
Auditors who understand Annex I requirements
We assess your system, we never design it
Your ISO 27001 evidence counts toward scoping
Assessed once, across every product line
For manufacturers, importers, and distributors placing products with digital elements on the EU market, cybersecurity is shifting from a product feature to a condition of market access. Organizations that put an independently audited system behind that obligation early can answer customers, OEM buyers, and market surveillance authorities with documented evidence instead of assurances. In tenders and regulated supply chains, that difference increasingly decides who stays on the shortlist.
The value of certification extends beyond external proof of conformity. Many organizations use recurring audits and assessment processes as a framework for continuous improvement, operational transparency, and stronger cross-functional alignment. In practice, companies often report effects such as:
Regulation (EU) 2024/2847 entered into force on December 10, 2024, and its obligations apply on a fixed timetable regardless of whether harmonized standards are cited in time. The reporting duties under Article 14, covering actively exploited vulnerabilities and severe incidents, have applied since September 11, 2026, including for products already on the market, while the essential requirements, conformity assessment, technical documentation, and CE marking follow on December 11, 2027. Building your audited evidence base now means entering full application with a management system that has already been through a complete certification cycle — and DQS accompanies you through every stage of that timetable.
Save time and internal effort with a clearly structured certification process. Request your personal quote for your Cyber Resilience Act Compliance now.
The Cyber Resilience Act applies broadly to products with digital elements placed on the EU market. Certification is the right next step for organizations in these situations:
A clear process means fewer questions and faster results. These are the stages of your Cyber Resilience Act compliance with DQS — transparent from start to finish.
Once you can describe your product portfolio, your role as manufacturer, importer, or distributor, and your system boundaries, you are ready to start. Your initial interaction will involve discussing your products with digital elements, the product classes involved, your management system, and the objectives you aim to achieve. Based on this, you will promptly receive a detailed quote tailored to your individual needs. For complex certification processes, project planning can help coordinate timelines and audit execution across sites, product lines, or development teams. Open-enrollment training courses on Annex I requirements, product classification, and reporting obligations are available separately from any certification activity.
The certification audit begins with a system analysis (stage 1 audit) as well as an evaluation of your documentation, the results of your management review, and your internal audits. The goal is to determine whether your management system is adequately developed and ready for certification. In the next stage, the system audit (stage 2), your auditor evaluates the effectiveness of all management system processes on-site or through suitable remote techniques, including the design, development, production, and vulnerability handling processes for the products in scope. After the audit is completed, you will receive a detailed presentation of the results in a closing meeting, along with information on potential areas of improvement for your company. If necessary, action plans will be agreed upon.
After the certification audit, the results are evaluated by the independent certification body of DQS. You will receive an audit report documenting the audit results. If all standard requirements are met, following a positive certification decision, you will receive the accredited ISO/IEC 27001 certificate of DQS, refined in line with Technical Guideline TR-03183-H where a product scope applies. It gives you structured, third-party audited evidence supporting your own technical documentation and EU Declaration of Conformity, which remain your responsibility as manufacturer.
To support continuous improvement and the ongoing effectiveness of your management system, key system components are audited at least once a year, during which potential areas for improvement are once again identified.
Your certificate is valid for three years. Well before expiration, a recertification is performed to confirm ongoing conformance with the standard requirements. If all requirements are met, a new internationally recognized certificate will be issued.
For manufacturers whose product class calls for third-party involvement, full quality assurance (Module H) assesses your development, production, and inspection system as a whole rather than one product type at a time — the route Technical Guideline TR-03183-H is written for. DQS is preparing for notification as a conformity assessment body for Module H, and the ISO/IEC 27001 foundation you establish now is the same evidence that carries forward into it.
Your Cyber Resilience Act evidence does not start from zero if you already hold ISO/IEC 27001 or ISO 9001 certification: both contribute directly to the quality and security system the regulation expects. DQS factors that existing evidence into scoping, so a combined audit program reduces duplication, cost, and disruption across your portfolio.
The time required depends on the size of your product portfolio, the number of product lines and sites in scope, and the complexity of your development processes. Certification runs through a two-stage audit, and once your management system covers the products in scope, the process can often be completed within a few months. Learn more on our Cyber Resilience Act Focus Page.
The accredited certificate that underpins your Cyber Resilience Act evidence is valid for three years. During that time, annual surveillance audits confirm that your management system remains effective, and a recertification audit before expiry renews the certificate. Your EU Declaration of Conformity and CE marking remain your own responsibility as manufacturer throughout.
There is no flat fee for Cyber Resilience Act certificationompliance — cost depends on the size of your portfolio, the number of product lines and sites in scope, and the complexity of your development and vulnerability handling processes. The most reliable way to understand your investment is a tailored quote based on your specific situation. Request a quote to receive a precise offer.
For organizations that already operate a management system, the main effort lies in extending its scope to the products with digital elements, preparing the supporting documentation, and completing an internal audit and management review. DQS structures the certification audit around your operational reality, keeping the demand on your teams focused and predictable. Learn more on our Cyber Resilience Act Focus Page.
Compliance with the Cyber Resilience Act is demonstrated by the manufacturer through an EU Declaration of Conformity and CE marking, following a conformity assessment route that depends on the product class. What DQS provides is the independently audited foundation behind that declaration: accredited ISO/IEC 27001 certification, refined in line with Technical Guideline TR-03183-H of the Federal Office for Information Security (BSI) where a product scope applies.
DQS is preparing for notification as a conformity assessment body for Module H. Until that notification is complete, DQS supports your Cyber Resilience Act compliance through accredited ISO/IEC 27001 certification extended per Technical Guideline TR-03183-H, applicability and classification checks, and open training courses. The evidence you build now carries directly into a Module H assessment once it becomes available.
