CRA Product Classes: How Is Your Product Classified - and What Does That Mean?

The Cyber Resilience Act (Regulation (EU) 2024/2847) divides products with digital elements into four risk classes. This classification determines which conformity assessment procedure a manufacturer must complete before the product may bear the CE marking and be placed on the EU market. This article explains the classes, provides typical examples, and shows which assessment path applies to each category.

Full product requirements under the CRA - including the CE marking obligation - apply from 11 December 2027. Manufacturers who determine now which class their product falls into gain valuable time for development adjustments, documentation, and, where necessary, engaging a notified body.

The Risk-Based Class System at a Glance

The CRA follows a risk-based approach: the more critical a product is to the security of users, infrastructure, or society, the stricter the requirements for demonstrating conformity. The basic structure:

The specific product list for Classes I and II was further detailed through Implementing Regulation (EU) 2025/2392 of 28 November 2025 with technical descriptions. Since individual classifications may require interpretation, manufacturers should seek expert guidance when in doubt about their product's classification.

Standard Class: The Default - Self-Assessment Suffices

Products with digital elements that are listed neither in Annex III nor in Annex IV fall into the standard category. For these products, internal control under Module A is sufficient: the manufacturer assesses whether its product meets the essential cybersecurity requirements (Annex I CRA), creates the technical documentation, and draws up the EU declaration of conformity. Assessment by a notified body is not required.

Typical products in this category (non-exhaustive):

• Simple mobile apps without safety-critical functions
• Computer games
• Memory chips without independent security functions
• Smart home appliances (provided no Class I functions are performed)

Even for standard products, the following obligations apply: security by design, vulnerability handling, SBOM as part of technical documentation, and reporting obligations, which have applied since 11 September 2026. Class membership only eases the conformity assessment path - it does not reduce the substantive security requirements.

Important Products - Class I: Self-Assessment Under Conditions

For Class I products (Annex III, Class I), self-assessment under Module A remains possible - but only if the manufacturer demonstrably applies harmonised standards, common specifications or a European cybersecurity certification scheme (assurance level at least “substantial”) in full. Without such evidence, or where they are applied only in part, a notified body must be involved (Module B+C or H).

In practice: manufacturers of Class I products who build on established technical standards (e.g., relevant ETSI standards once harmonised under the CRA) can avoid the cost and effort of third-party assessments. Those who fully apply neither harmonised standards nor common specifications nor a certification scheme cannot avoid external assessment (Module B+C or H).

Examples of Class I products (schematic - not a binding case-by-case determination):

• Identity and access management (IAM) software
• Browsers and browser-like products
• Password managers
• Software that searches for, removes or quarantines malicious software
• VPN products
• Network management tools
• SIEM systems
• Boot managers
• Public key infrastructure (PKI) and certificate management
• Routers, modems, and switches
• Microprocessors and microcontrollers with security-related functionalities
• Smart speakers with an integrated virtual assistant (Annex III, Class I, point 16)

Important Products - Class II: Third-Party Assessment Always Required

Class II products (Annex III, Class II) are subject to significantly stricter requirements: self-assessment is ruled out, even where harmonised standards are applied. Conformity is demonstrated either via Module B + Module C (EU type-examination plus conformity to type) or Module H (full quality assurance), each with a notified body, or, where available and applicable, via a European cybersecurity certificate at least at assurance level “substantial” (Art. 32(3)).

For manufacturers, this means: plan coordination with a notified body early, as all manufacturers are working towards the same dates.

Typical Class II products (schematic - not a binding case-by-case determination):

• Hypervisors and container runtimes
• Firewalls and intrusion detection/prevention systems (IDS/IPS)
• Tamper-resistant microprocessors
• Tamper-resistant microcontrollers

Critical Products: Highest Conformity Requirements

Products in the “critical” class (Annex IV) have the highest risk potential for security and critical infrastructure. Self-assessment is ruled out. Where the Commission mandates a European certification scheme by delegated act, they need a European cybersecurity certificate at least at assurance level “substantial” (Art. 8(1)); as long as that is not the case, the Class II routes apply (Art. 32(4)).

Typical products in this category:

• Smart cards and comparable products
• Secure elements (hardware security modules at chip level)
• Smart meter gateways
• Hardware devices with security boxes

The Core Function Principle: What Drives Classification

Whether a product qualifies as “important” or “critical” is determined by its core functionality (Art. 7(1), Art. 8(1)); brand names and industry labels play no role. A product does not become important merely because it integrates an important product or can perform its functions on the side: a browser embedded in a messaging app does not, by itself, subject the app to the assessment procedure for browsers. If its core functionality matches a category in Annex III, however, it is important even if it has additional functions (Implementing Regulation (EU) 2025/2392, recitals 2 to 5).

Implementing Regulation (EU) 2025/2392 provides technical descriptions for classification. Since the final classification of a specific product depends on its function, deployment context, and technical characteristics, a structured assessment and classification analysis is advisable for complex products.

Conformity Assessment Procedures in Detail

Module A - Internal Control

The manufacturer creates technical documentation, assesses conformity internally, draws up the EU declaration of conformity, and affixes the CE marking. No external body involved. Permitted for standard products and for Class I products with full application of harmonised standards, common specifications or a European cybersecurity certification scheme (at least “substantial”). Manufacturers of products in Annex III categories that qualify as free and open-source software may use any procedure under Art. 32(1), including Module A, if they make the technical documentation public when placing the product on the market (Art. 32(5)).

Module B - EU Type-Examination

A notified body examines the product specimen and issues an EU type-examination certificate. Must be combined with Module C.

Module C - Conformity to Type

The manufacturer uses internal production control to ensure that products conform to the examined type and declares this. Assessment of a quality management system by a notified body only comes with Module H.

Module H - Full Quality Assurance

A notified body assesses the manufacturer's entire quality management system (design, manufacturing, final inspection) and monitors it on an ongoing basis. Alternative to Module B+C for Class I and Class II products.

Timeline and Strategic Recommendations

The deadlines are tight:

• 11 September 2026: Since then, reporting and notification obligations for actively exploited vulnerabilities and severe incidents have applied, regardless of product class.
• 11 December 2027: Full product requirements including CE marking and conformity assessment for all classes.

Manufacturers of Class II and critical products should begin their classification analysis now, because coordination with a notified body and, on the Module H route, the assessment of the quality system need lead time. Manufacturers of Class I products benefit from clarifying early whether applicable harmonised standards, common specifications or a European cybersecurity certification scheme (at least “substantial”) exist - this determines whether Module A suffices or Module B+C or H is needed.

For an initial check of whether your product falls within the scope of the CRA at all, the interactive applicability check is a good starting point. We are happy to discuss the specific classification and the appropriate conformity path in an initial consultation.

Further Reading

• Clarify applicability first, then classification - systematic steps for manufacturers, importers, and distributors
• SBOM requirements - formats, contents and archiving
• Cyber Resilience Act overview - all CRA obligations at a glance