Product class
Is a hardware security module or secure element a critical product under the CRA?
Short answer: Yes, as a category, and it is critical. A hardware security module or secure element can fall under one of 3 entries in Annex IV. A product whose core functionality is that of an Annex IV category is a critical product, so whether your product is one depends on its core functionality. Annex IV has its own conformity route under Article 32(4), set out below.
“Hardware Devices with Security Boxes”
“Smart meter gateways within smart metering systems as defined in Article 2, point (23) of Directive (EU) 2019/944 of the European Parliament and of the Council (1) and other devices for advanced security purposes, including for secure cryptoprocessing”
“Smartcards or similar devices, including secure elements”
Technical description
Commission Implementing Regulation (EU) 2025/2392 gives the technical description of each category in the annexes. It says what the category covers, in the Official Journal's words.
“Hardware products with digital elements that securely store, process, or manage sensitive data or perform cryptographic operations, and that consist of multiple discrete components, incorporating a hardware physical envelope providing tamper evidence, resistance or response as countermeasures against physical attacks.
This category includes but is not limited to physical payment terminals, hardware security modules that generate and manage cryptographic elements, and tachographs that meet the above description.”
“Smart meter gateways are products with digital elements that control communication between components in or connected to smart metering systems as defined in Article 2(23) of Directive (EU) 2019/944, and authorised third parties, such as utility providers. Smart meter gateways collect, process and store meter or personal data, protect data and information flows by supporting specific cryptographic needs, such as encryption and decryption of data, incorporate firewalling functionalities and provide the means to control other devices.
This category includes but is not limited to smart meter gateways related to smart metering systems measuring electricity as defined in Article 2(23) of Directive (EU) 2019/944. It may also include smart meter gateways used in other smart metering systems measuring consumption of other sources of energy such as gas or heat, provided that the gateway meets this description.”
“Secure elements are microcontrollers or microprocessors with security-related functionalities, including tamper evidence, resistance or response. They typically store, process, or manage cryptographic operations or sensitive data, such as identity credentials or payment credentials. Secure elements are designed to provide protection of at least AVA_VAN.4, as set out in the Common Criteria or the Common Evaluation Methodology. They can be discrete silicon or can be integrated into systems on chip (SoC). Secure elements can incorporate an application environment or an operating system, and can include one or more applications.
This category includes but is not limited to Trusted Platform Modules (TPMs) and embedded Universal Integrated Circuit Card (UICC).
Smartcards or similar devices are secure elements integrated into a carrier material, such as plastic or wood, in the shape of a card, or secure elements integrated into carrier materials taking other shapes.
This category includes but is not limited to identity and travel documents, qualified signature cards, replaceable UICCs, physical payment cards, physical access cards, digital tachograph cards or wrist bands with integrated payment secure elements.”
What Annex IV means for the conformity route
Hardware devices with security boxes, smart meter gateways / secure cryptoprocessing devices, and smartcards or similar devices including secure elements are Annex IV critical products. Article 32(4) routes them through a European cybersecurity certification scheme under Article 8(1), or, where the Article 8(1) conditions are not met, through the Article 32(3) procedures. Article 32(5), which lets open-source manufacturers of Annex III products use the Article 32(1) procedures, does not reach Annex IV.
The wording of Article 32(4) is quoted in the product classes guide.
When it applies
Since 11 June 2026, the rules on notified conformity assessment bodies, Chapter IV (Articles 35 to 51), have applied. The reporting duties of Article 14 have applied since 11 September 2026. The CRA will apply in full from 11 December 2027. The wording of the application clause is quoted in the product classes guide.
Edge cases
- The core functionality decides. Check your product's core functionality against the annex text quoted above. The wording of Article 7(1) is quoted in the product classes guide.
Questions and answers
Where does a hardware security module or secure element sit in the CRA annexes?
See the short answer and the annex quote at the top of this page.
Can open-source licensing change the route for a hardware security module or secure element?
No. Article 32(5) reaches only the categories set out in Annex III, so an Annex IV product keeps its Article 32(4) route regardless of licence.
When do the CRA rules for a hardware security module or secure element apply?
Reporting duties under Article 14 have applied since 11 September 2026, and the CRA will apply in full from 11 December 2027.
Cybiq checks the CRA only. Orientation, not legal advice. Quoted spans come from Regulation (EU) 2024/2847 as published in the Official Journal and are re-verified against the live text by automated tests. Verify before relying on any item; for an assessment of your own product, consult a qualified lawyer.