Conformity assessment and declaration of conformity

(1) For the requirements and specifications laid down by the BSI in a Technical Guideline, the BSI may permit a manufacturer or provider of ICT products, ICT services and ICT processes that are not consumer products under section 55, and a person or an IT security service provider, to carry out a self-assessment of their conformity. Under the conditions of the first sentence, the manufacturer or provider of ICT products, ICT services and ICT processes, the person or the IT security service provider may issue a declaration of conformity confirming that they satisfy the requirements laid down in the Technical Guideline. By issuing the declaration of conformity, the manufacturer or provider of the ICT products, ICT services and ICT processes, the person or the IT security service provider (issuer) assumes responsibility for the ICT product, ICT service, ICT process, person or IT security service satisfying the requirements laid down in the Technical Guideline. A declaration under the third sentence may be used for an ICT product, an ICT service and ICT process, a person or an IT security service provider only where the manufacturer, the provider, the person or the IT security service provider has issued it and it has been neither revoked nor declared invalid under subsection (5), no. 3.
(2) The Technical Guideline under subsection (1) may in particular contain requirements on
1. the content and format of the declaration of conformity,
2. evidence and procedures substantiating the particulars of the declaration of conformity,
3. the conditions for maintaining, continuing and renewing the declaration of conformity,
4. the use of a mark and seal provided by the BSI, and the conditions for their use,
5. the reporting and handling of detected vulnerabilities of the ICT product, ICT service or ICT process, or of the IT security service,
6. the provision of information on the BSI's website concerning the declaration of conformity, its issuer, and the ICT product, service, process, person or IT security service, or
7. the time-limiting of the declaration of conformity's period of validity.
(3) Where it is laid down in the requirements under subsection (2) that the particulars of the declaration of conformity may be substantiated only by an accredited conformity assessment body, the BSI may, on application, authorise conformity assessment bodies intending to become active within the scope of application of this section, where the material conditions of the Technical Guideline are satisfied. Conformity assessment bodies may not become active within the scope of application of this section without authorisation by the BSI.
(4) The issuer keeps the declaration of conformity, the technical documentation and all other relevant information relating to the conformity of the ICT products, ICT services and ICT processes, the person or the IT security service, with the specified criteria available for the BSI during a period determined by the BSI in the Technical Guideline under subsection (1). A copy of the declaration of conformity must be submitted to the BSI.
(5) The BSI may take suitable measures to ensure that issuers of declarations of conformity satisfy the requirements of the scheme and the provisions of this section, and in particular may
1. require issuers of declarations of conformity to provide it with all information it needs to perform its tasks,
2. carry out investigations in the form of test purchases or audits at the issuers of declarations of conformity, to review their compliance with the requirements and specifications laid down in the Technical Guideline under subsection (1), and
3. declare declarations of conformity under subsection (1) invalid.
(6) The BSI may charge fees for measures under subsection (4), where it has acted on the basis of indications giving rise to legitimate doubts as to compliance with the requirements of the Technical Guideline or of this section.