Module A Self-Declaration: Why It's Only as Good as Your Documented Procedures

Module A (internal production control) is the self-declaration route under the Radio Equipment Directive (RED) for the cybersecurity requirements of EN 18031. The manufacturer evaluates the product, prepares the technical documentation, and signs the Declaration of Conformity (DoC) without a notified body. The catch: the phrase "internal production control" is not decorative - it obliges you to operate and document repeatable internal procedures that a market surveillance authority can later verify.

Module A is named "internal production control" for a reason. The conformity assessment framework does not just ask "is this product compliant?" - it asks "does the manufacturer have an internal process that reliably produces compliant products?" The Declaration of Conformity is the visible output. The internal production control is the machinery underneath it.

That distinction is where many self-declarations are quietly weak. Teams invest heavily in producing the conformity evidence for one device, sign the DoC, and ship - without ever documenting how that result was achieved. When the next firmware release, the next variant, or the next engineer comes along, the process has to be reconstructed from memory.

A defensible Module A self-declaration has two distinct documentation layers:

EN 18031 and the RED's conformity framework care about both. A perfect set of tables for a single device, with no documented process behind it, is a snapshot - not internal production control. Market surveillance authorities are entitled to request the technical documentation at any time after the product is on the market, and "we did it correctly, trust us" is not the same as "here is the procedure we follow every time."

Think of your self-declaration as a structure: the conformity artifacts sit on top, and the operational procedures are the foundation that holds them up. Remove the foundation and the top layer becomes a one-time achievement that nobody can repeat or defend.

The two layers are complementary, not competing. RedComply is purpose-built to generate the conformity evidence - it turns the document-heavy EN 18031 assessment into structured tables, decision trees, auto-calculated test plan verdicts, and a one-click Declaration of Conformity. What it does not do - because it is a different job - is document the human procedures your team performs on the shop floor and in the lab. That is the second layer.

The most common weakness in a Module A self-declaration is not a missing table or a wrong decision tree outcome. It is tacit knowledge: the test setup, the build-verification ritual, the vulnerability triage steps that one or two senior engineers simply know and have never written down.

This is a real compliance risk for three reasons:

The fix is to capture these operational procedures as documented, repeatable Standard Operating Procedures (SOPs) - before they walk out the door. The obstacle is that writing SOPs by hand is tedious, so it rarely gets done, especially for hands-on lab and shop-floor work.

This is exactly the gap our sister product SOPMODO is built to close. Instead of writing procedures from scratch, an engineer simply performs the procedure in the real environment - narrating the steps out loud and taking photos - and SOPMODO's AI assembles a structured, repeatable SOP from that captured walkthrough. The tacit knowledge in someone's head becomes a documented, shareable procedure that supports the "internal production control" half of your Module A self-declaration.

Used together, the picture is complete: RedComply produces the conformity evidence the standard requires, and SOPMODO documents the operational procedures behind it - so your self-declaration is not just signed, but defensible.

Use this checklist to test whether your Module A self-declaration rests on documented procedures - not just a one-time assessment. If several items are missing, your conformity evidence may be solid while your internal production control is not.

For the first item, a dedicated platform like RedComply handles the conformity evidence end to end. For the procedure items, capturing the work as you perform it - rather than writing SOPs after the fact - is what makes the documentation actually happen; that is the role SOPMODO plays.

If you are still scoping which EN 18031 parts apply and how the self-assessment runs end to end, our RED cybersecurity self-assessment guide walks through the full Module A workflow.

It requires both. "Internal production control" is the formal name of Module A, and it refers to a controlled, repeatable process that produces conformity - not only to the signed Declaration of Conformity at the end. The DoC is the output; the documented internal procedures are the control that makes the output trustworthy. A self-declaration backed only by a signed DoC and a one-time assessment is weaker than one backed by documented, repeatable procedures.

Focus on the operational processes that produce your conformity evidence: how each security test is set up and run, how every firmware build is verified before release, how a reported vulnerability is triaged and remediated, and how conformity is re-assessed when a variant or update ships. These are the procedures a market surveillance authority would expect to see when evaluating your internal production control.

Authorities can request your technical documentation at any time after market placement. If your operational procedures are undocumented, they appear - from the outside - to be procedures that were never followed. That can lead to findings of inadequate process control, requests for corrective action, and in serious cases restriction or withdrawal of the product. Documented, repeatable procedures are how you demonstrate the "control" in internal production control.

They address the two different documentation layers. RedComply is purpose-built for the EN 18031 conformity evidence - asset tables, decision trees, test plans, and Declaration of Conformity generation. SOPMODO documents the operational procedures behind that evidence: an engineer records and narrates a hands-on procedure, and its AI turns the captured walkthrough into a structured Standard Operating Procedure. RedComply proves the device is compliant; SOPMODO proves your process for producing compliant devices is real and repeatable.

Capturing procedures as the work is performed is far more reliable than reconstructing them later. After-the-fact SOP writing tends to be skipped under deadline pressure and loses the small, tacit details that matter. Recording the procedure while it is actually being done - narrating and photographing the steps - preserves those details and is the approach a tool like SOPMODO is designed around.

RedComply is purpose-built for the EN 18031 conformity evidence at the heart of a Module A self-declaration. It transforms the complex, document-heavy assessment into a guided, structured workflow with AI assistance at every step.

RedComply gives you a rock-solid conformity evidence layer. To complete the picture, pair it with documented operational procedures: our sister product SOPMODO turns the hands-on processes your team performs - in the lab and on the shop floor - into structured, repeatable SOPs by simply recording the procedure as it happens. Together they cover both halves of internal production control.

Visit redcomply.com to start your EN 18031 self-declaration, and sopmodo.com to document the procedures behind it.