Annex III Important Product Classification

Annex III of the EU Cyber Resilience Act lists categories of products with digital elements that are classified as Important (further divided into Class I and Class II) or Critical due to their higher cybersecurity risk potential. Products not listed in Annex III fall into the Default class. The classification determines the conformity assessment route available to the manufacturer: higher-class products require increasingly rigorous third-party assessment. The classification also affects regulatory scrutiny intensity: market surveillance authorities are expected to prioritise higher-class products. The European Commission may update Annex III via delegated acts as the threat landscape and product categories evolve.

Class I Important Products include categories with significant cybersecurity risk but where self-assessment against harmonised standards is permitted. Examples listed in Annex III include:

• Identity management software and privileged access management tools.
• Password managers.
• Browsers.
• Network traffic monitoring tools.
• Routers and modems for home and SOHO use.
• Microprocessors with security-relevant functionality (e.g. TPM, secure enclaves).
• Firewalls for home and SOHO use.
• General-purpose operating systems.
• Wearable health monitoring devices.

For Class I, manufacturers may self-assess if applying harmonised standards. Without harmonised standards, a third-party conformity assessment module is required.

Class II Important Products carry higher risk and require mandatory third-party conformity assessment by a notified body. Examples include:

• Hypervisors and container runtime environments.
• Industrial firewalls, IDS/IPS, and PKI systems.
• Network switches and routers for industrial use.
• Industrial control systems (SCADA, PLCs, DCS).
• Medical devices with connected components.
• Automotive components with network connectivity.

Critical products (Annex IV) include hardware security modules (HSMs), smartcard chips, and industrial IoT gateways used in critical infrastructure. Critical products require a European Cybersecurity Certification Scheme assessment. The distinction between Class I and Class II is primarily the mandatory third-party assessment requirement for Class II.

Classification is not always straightforward. Key guidance:

• Function, not form - a product's classification depends on what it does, not what it is called. A home router used in an industrial environment may still be Class I.
• Multi-function products - a product that performs functions listed in both Class I and Class II is classified at the higher level.
• Software components vs. products - a software library integrated into another product is assessed as part of that product; a standalone software product is assessed independently.
• Manufacturer responsibility - the manufacturer (or importer for EU market purposes) determines classification and documents the reasoning in technical documentation. Market surveillance authorities may challenge this determination.
• ENISA guidance - ENISA publishes classification guidance that manufacturers should consult when their product's classification is ambiguous.