Product class
Is a hypervisor or container runtime an important product under the CRA?
Short answer: Yes, in Class II, as a category. A hypervisor or container runtime is listed in Annex III, Class II. Under Article 7(1), a product whose core functionality is that of a listed category is an important product, so whether your product is one depends on its core functionality. Class II has its own conformity route under Article 32(3), set out below.
“Hypervisors and container runtime systems that support virtualised execution of operating systems and similar environments”
Technical description
Commission Implementing Regulation (EU) 2025/2392 gives the technical description of each category in the annexes. It says what the category covers, in the Official Journal's words.
“Hypervisors are software products with digital elements that abstract and/or allocate computing resources and enable the execution, management and orchestration of virtual machines that are logically separated from each other and/or from the physical hardware. Hypervisors may run directly on hardware (bare metal), on top of an operating system, or within another virtual machine (nested virtualisation).
In the context of this category of products, a virtual machine is a software-defined logical separation of a computing environment, which includes a virtualised set of hardware resources (e.g. CPU, memory, storage, network interfaces) and typically hosts its own operating system.
This category includes but is not limited to type 1 hypervisors (bare metal), type 2 hypervisors (hosted on an operating system) and hybrid hypervisors.
Container runtime systems are software products with digital elements that manage the execution and lifecycle of containers running on a single host operating system as isolated processes, allocating resources and allowing the management and orchestration of individual containers.
In the context of this category of products, a container is a software-based execution environment that encapsulates one or more software components and their dependencies in a single package, enabling it to run independently and consistently.”
What Class II means for the conformity route
Article 32(3): conformity is demonstrated through EU-type examination followed by conformity to EU-type based on internal production control (module B+C), through full quality assurance (module H), or, where available and applicable, through a European cybersecurity certification scheme at assurance level at least 'substantial'. The first two run through a notified body.
The wording of Article 32(3) is quoted in the product classes guide.
When it applies
Since 11 June 2026, the rules on notified conformity assessment bodies, Chapter IV (Articles 35 to 51), have applied. The reporting duties of Article 14 have applied since 11 September 2026. The CRA will apply in full from 11 December 2027. The wording of the application clause is quoted in the product classes guide.
Edge cases
- Free and open-source software. Article 32(5) has its own rule for Annex III products. The wording of Article 32(5) is quoted in the product classes guide.
- The core functionality decides. Check your product's core functionality against the annex text quoted above. The wording of Article 7(1) is quoted in the product classes guide.
Questions and answers
Where does a hypervisor or container runtime sit in the CRA annexes?
See the short answer and the annex quote at the top of this page.
Does a hypervisor or container runtime need a notified body?
Not on every route: under Article 32(3), the first two procedures run through a notified body and the certification scheme option does not, as the route section above sets out.
When do the CRA rules for a hypervisor or container runtime apply?
Reporting duties under Article 14 have applied since 11 September 2026, and the CRA will apply in full from 11 December 2027.
Cybiq checks the CRA only. Orientation, not legal advice. Quoted spans come from Regulation (EU) 2024/2847 as published in the Official Journal and are re-verified against the live text by automated tests. Verify before relying on any item; for an assessment of your own product, consult a qualified lawyer.