Important Products with Digital Elements - Class I and Class II Classification

The CRA classifies products into three risk tiers, each with different conformity assessment requirements:

The split inside Annex III matters commercially. A Class I product keeps the self-assessment route as long as harmonised standards, common specifications, or a European cybersecurity certification scheme cover all of the applicable essential requirements. A Class II product loses that option outright and must involve a notified body or a certification scheme at assurance level at least substantial.

Class I covers important products that have significant cybersecurity implications but where existing security standards or market maturity provide some assurance baseline. It is the longer of the two lists, with 19 categories:

• Identity and access management - Identity management systems, privileged access management software and hardware, authentication and access control readers including biometric readers
• Browsers - Standalone and embedded browsers
• Password managers - Software designed primarily to store and manage credentials
• Malware detection software - Products that search for, remove, or quarantine malicious software
• VPN products - Products with a virtual private network function
• Network management systems - Products managing network devices and configurations
• SIEM systems - Security information and event management software
• Boot managers - Secure boot and firmware management tools
• Public key infrastructure - Certificate issuance and PKI software
• Network interfaces - Physical and virtual network interfaces
• Operating systems
• Routers, modems intended for connection to the internet, and switches - Including consumer models
• Microprocessors with security-related functionalities
• Microcontrollers with security-related functionalities
• ASICs and FPGAs with security-related functionalities
• Smart home general purpose virtual assistants
• Smart home products with security functionalities - Smart door locks, security cameras, baby monitors, alarm systems
• Internet-connected toys - Those with social interactive features or location tracking, covered by Directive 2009/48/EC
• Personal wearables - Health monitoring wearables and wearables intended for children

For Class I, the manufacturer keeps the Module A self-assessment route when harmonised standards, common specifications, or a European cybersecurity certification scheme cover all applicable essential requirements. Where that coverage is missing, a notified body route applies.

Class II covers important products where a compromise would have more severe consequences, often affecting critical infrastructure or large populations. The list is short and closed, with four categories:

• Hypervisors and container runtime systems - Products supporting virtualised execution of operating systems and similar environments
• Firewalls, intrusion detection and prevention systems - In hardware or software form
• Tamper-resistant microprocessors
• Tamper-resistant microcontrollers

Anything outside those four is not Class II. Hardware security modules, smart meter gateways, and smartcards or secure elements sit one tier higher, in Annex IV. Routers, modems, switches, and microprocessors or microcontrollers with security-related functionality that are not tamper-resistant sit one tier lower, in Class I.

For Class II, self-assessment is unavailable in every case. The manufacturer uses EU type-examination followed by conformity to type (Module B + C), full quality assurance (Module H), or a European cybersecurity certification scheme at assurance level at least substantial.

Determining Annex III classification requires careful analysis:

1. Read the Annex III text - The classification is based on product function, not product name. A general-purpose microcontroller is a Default product; the same part shipped with security-related functionality such as secure boot or key storage is Class I, and a tamper-resistant version of it is Class II.

1. Check the intended use - The classification often depends on the primary use case and typical deployment environment.

1. Review draft delegated acts - The European Commission may add products to Annex III via delegated regulation. Monitor ENISA and Commission publications for updates.

1. Seek legal counsel - For borderline cases, the product classification has significant commercial implications (mandatory third-party audit costs, delays to market). Professional legal and technical advice is recommended.

• Module A: Internal control, available only where harmonised standards, common specifications, or a European cybersecurity certification scheme cover all applicable essential requirements
• Module B + C: Notified body reviews technical documentation (Module B) + manufacturer declares conformity to assessed type (Module C)
• Module H: Full quality assurance - notified body audits the manufacturer's quality management system

• Module B + C
• Module H
• A European cybersecurity certification scheme at assurance level at least substantial

Where a notified body is involved, the CE marking is followed by that body's identification number, and the EU declaration of conformity records the route taken.

Notified bodies for CRA conformity assessment are designated by EU member state accreditation bodies and listed in the NANDO database (New Approach Notified and Designated Organisations).

• Ensure they are notified specifically for CRA assessment (designations will expand as September 2026 approaches)
• Check their experience with your product category
• Factor in lead times - notified bodies are expected to face significant demand backlogs before the September 2026 deadline

Early engagement with a notified body is strongly recommended for Annex III manufacturers.

The technical descriptions of the categories are set out in Commission Implementing Regulation (EU) 2025/2392. Commission guidance C(2026) 5252 explains how to apply them.

A product belongs to a category where it has the core functionality of that category, meaning its main features and technical capabilities without which it could not meet its intended purpose. A product has only one core functionality for classification purposes, and it must be identified in the technical documentation.

Additional functions do not change the classification, and merely integrating a listed product does not pull the host product into the category. A smartphone that contains an operating system does not thereby have the core functionality of an operating system.

Where a product substantially exceeds or substantially falls short of a category, it is outside it. Security orchestration, automation and response software generally exceeds the SIEM category, because incident response forms a core part of its capabilities. A log collection and visualisation tool that performs no correlation and provides no actionable security insight falls short of it. This is judged objectively on the product's actual technical characteristics rather than on how it is marketed.

Where the manufacturer also offers modules of an integrated product separately, for separate purchase, licensing or subscription, each module is a standalone product classified on its own core functionality. A suite sold with separately available SIEM, intrusion detection and analytics modules yields a class I product, a class II product and a default-category product respectively.