Simple answer is "it depends". The device has to be assigned a risk category, and depending on that there's a range of possibilities from the manufacturer being

Simple answer is "it depends". The device has to be assigned a risk category, and depending on that there's a range of possibilities from the manufacturer being able to self-certify (so long as they stand ready to demonstrate the design process that went into a new revision of the product), and at the other extreme, every revision having to be independently verified. My employer is able to self-certify, but our products are much simpler than a Raspberry Pi.