Product class
Is an industrial control component an important or critical product under the CRA?
Short answer: Not as such. An industrial control component is not listed in Annex III or Annex IV, so the default route applies unless the product's core functionality is that of a listed category, such as the entries below. Integrating a listed product, for example an operating system, does not in itself subject the host product to the Class I or Class II procedures (Article 7(1)).
“Network management systems”
“Operating systems”
“Routers, modems intended for the connection to the internet, and switches”
“Smart meter gateways within smart metering systems as defined in Article 2, point (23) of Directive (EU) 2019/944 of the European Parliament and of the Council (1) and other devices for advanced security purposes, including for secure cryptoprocessing”
Technical description
Commission Implementing Regulation (EU) 2025/2392 gives the technical description of each category in the annexes. It says what the category covers, in the Official Journal's words.
“Products with digital elements that manage connected network elements, such as servers, routers, switches, workstations, printers or mobile devices, by monitoring them and controlling their network operations and configuration.
This category includes but is not limited to end-to-end management systems and dedicated configuration management systems, such as controllers for software-defined networking.”
“Software products with digital elements that provide an abstract interface of the underlying hardware and control the execution of software, and that may provide services such as computing resource management and configuration, scheduling, input-output control, managing data, and providing an interface through which applications interact with system resources and peripherals.
This category includes but is not limited to real-time operating systems, general-purpose and special-purpose operating systems.”
“Routers are products with digital elements that establish and control the flow of data between different networks by selecting paths or routes using routing protocol mechanisms and algorithms, typically operating at the network layer.
This category includes but is not limited to wired and wireless routers, virtual routers and routers with or without modems.
Modems intended for the connection to the Internet are hardware products with digital elements that use digital modulation and demodulation techniques to convert analogue signals from and to digital signals for IP-based communication.
This category includes but is not limited to fibre modems, Digital Subscriber Line (DSL) modems, cable (DOCSIS) modems, satellite modems and cellular modems.
Switches are products with digital elements that provide connectivity between networked devices through packet forwarding mechanisms and that have a management plane, typically implemented at the data link or network layer.
This category includes but is not limited to managed switches, smart switches, multilayer switches, virtual security switches, programmable switches for software-defined networking and bridges such as wireless access points.”
“Smart meter gateways are products with digital elements that control communication between components in or connected to smart metering systems as defined in Article 2(23) of Directive (EU) 2019/944, and authorised third parties, such as utility providers. Smart meter gateways collect, process and store meter or personal data, protect data and information flows by supporting specific cryptographic needs, such as encryption and decryption of data, incorporate firewalling functionalities and provide the means to control other devices.
This category includes but is not limited to smart meter gateways related to smart metering systems measuring electricity as defined in Article 2(23) of Directive (EU) 2019/944. It may also include smart meter gateways used in other smart metering systems measuring consumption of other sources of energy such as gas or heat, provided that the gateway meets this description.”
Which conformity route applies
Industrial control / OT components are not listed in Annex III or Annex IV as such, so the default route under Article 32(1) applies, which includes internal control. The class changes where the product's core functionality is that of a listed category, for example: an operating system, a network management system, a router/modem/switch, or a physical or virtual network interface is Annex III Class I; tamper-resistant microprocessors/microcontrollers and firewalls/IDS/IPS are Class II; smart meter gateways are Annex IV critical. Verify the exact function against the annex text.
The wording of Article 32(1)(a) is quoted in the product classes guide.
When it applies
The reporting duties of Article 14 have applied since 11 September 2026. The CRA will apply in full from 11 December 2027. The wording of the application clause is quoted in the product classes guide.
Edge cases
- Free and open-source software. Article 32(5) adds nothing for a product outside Annex III: Article 32(1), which includes internal control, already applies to it.
- The core functionality decides. Check your product's core functionality against the annex text quoted above. The wording of Article 7(1) is quoted in the product classes guide.
Questions and answers
Where does an industrial control component sit in the CRA annexes?
See the short answer and the annex quote at the top of this page.
Does an industrial control component need a notified body?
Not as a category: the default route under Article 32(1) applies, which includes internal control. If the product's core functionality is that of a listed category, such as the entries quoted above, that category's route applies instead.
When do the CRA rules for an industrial control component apply?
Reporting duties under Article 14 have applied since 11 September 2026, and the CRA will apply in full from 11 December 2027.
Cybiq checks the CRA only. Orientation, not legal advice. Quoted spans come from Regulation (EU) 2024/2847 as published in the Official Journal and are re-verified against the live text by automated tests. Verify before relying on any item; for an assessment of your own product, consult a qualified lawyer.