1. A European cybersecurity certification scheme may allow for the conformity self-assessment under the sole responsibility of the manufacturer or provider of ICT products, ICT services or ICT process. Conformity self-assessment shall be permitted only in relation to ICT products, ICT services and ICT process that present a low risk corresponding to assurance level ‘basic’.

2. The manufacturer or provider of ICT products, ICT services or ICT process may issue an EU statement of conformity stating that the fulfilment of the requirements set out in the scheme has been demonstrated. By issuing such a statement, the manufacturer or provider of ICT products, ICT services or ICT process shall assume responsibility for the compliance of the ICT product, ICT service or ICT process with the requirements set out in that scheme.