Product class
Is a security microprocessor or microcontroller an important product under the CRA?
Short answer: It depends on the function. A security microprocessor or microcontroller can fall under Annex III, Class I (items 13, 14 and 15), or under Annex III, Class II (items 3 and 4). The entry that matches what the product does decides the class.
“Microprocessors with security-related functionalities”
“Microcontrollers with security-related functionalities”
“Application specific integrated circuits (ASIC) and field-programmable gate arrays (FPGA) with security-related functionalities”
“Tamper-resistant microprocessors”
“Tamper-resistant microcontrollers”
Technical description
Commission Implementing Regulation (EU) 2025/2392 gives the technical description of each category in the annexes. It says what the category covers, in the Official Journal's words.
“Products with digital elements that are integrated circuits that carry out central processing functions relying on external memory and peripherals, including microcode and other low-level firmware. They additionally provide security-related functionalities, such as encryption, authentication, secure key storage, random number generation, trusted execution environment, or other hardware-based protection mechanisms, that aim to secure other products, networks or services beyond the microprocessor itself, such as secure boot chain, virtualization or secure communication interfaces.”
“Products with digital elements that are integrated circuits that carry out central processing functions integrating memory allowing the microcontroller to be programmable and typically also other peripherals, including microcode and other low-level firmware. They additionally provide security-related functionalities, such as encryption, authentication, secure key storage, random number generation, trusted execution environment, or other hardware-based protection mechanisms, that aim to secure other products, networks or services beyond the microcontroller itself, such as secure boot chain, virtualization or secure communication interfaces.”
“Application specific integrated circuits (ASIC) with security-related functionalities are products with digital elements that are integrated circuits, fully or partially custom-designed to perform a specific function or implement a specific application, including microcode and other low-level firmware. They additionally provide security-related functionalities, such as encryption, authentication, secure key storage, random number generation, trusted execution environment, or other hardware-based protection mechanisms, that aim to secure other products, networks or services beyond the ASIC itself, such as secure boot chain, virtualization or secure communication interfaces.
Field-programmable gate arrays (FPGA) with security-related functionalities are products with digital elements that are integrated circuits characterized by a matrix of configurable logic blocks designed to be reprogrammable after manufacturing to perform a specific function or implement a specific application, including microcode and other low-level firmware. They additionally provide security-related functionalities, such as encryption, authentication, secure key storage, random number generation, trusted execution environment, or other hardware-based protection mechanisms, that aim to secure other products, networks or services beyond the FPGA itself, such as secure boot chain, virtualization or secure communication interfaces.”
“Products with digital elements that are microprocessors with security-related functionalities referred to in Table ‘Class I’, point 13, of this Annex, including tamper evidence, resistance or response, and which additionally are designed to provide protection of AVA_VAN level 2 or 3, as set out in the Common Criteria and the Common Evaluation Methodology.”
“Products with digital elements that are microcontrollers with security-related functionalities referred to in Table ‘Class I’, point 14, of this Annex, including tamper evidence, resistance or response, and which additionally are designed to provide protection of AVA_VAN level 2 or 3, as set out in the Common Criteria and the Common Evaluation Methodology.”
What this means for the conformity route
Annex III, Class I. Article 32(2) caveat: self-assessment via internal control remains available only if you apply in full harmonised standards, common specifications or European cybersecurity certification schemes at assurance level at least 'substantial'; where you apply them only in part or not at all, or none exist, EU-type examination followed by production control (module B+C) or full quality assurance (module H) applies.
The wording of Article 32(2) is quoted in the product classes guide.
Annex III, Class II. Article 32(3): conformity is demonstrated through EU-type examination followed by conformity to EU-type based on internal production control (module B+C), through full quality assurance (module H), or, where available and applicable, through a European cybersecurity certification scheme at assurance level at least 'substantial'. The first two run through a notified body.
The wording of Article 32(3) is quoted in the product classes guide.
When it applies
Since 11 June 2026, the rules on notified conformity assessment bodies, Chapter IV (Articles 35 to 51), have applied. The reporting duties of Article 14 have applied since 11 September 2026. The CRA will apply in full from 11 December 2027. The wording of the application clause is quoted in the product classes guide.
Edge cases
- Free and open-source software. Article 32(5) has its own rule for Annex III products. The wording of Article 32(5) is quoted in the product classes guide.
- Annex III, Class II entries. A product that matches an entry in Annex III, Class II (items 3 and 4) follows the Annex III, Class II route, not the Annex III, Class I route.
- The core functionality decides. Check your product's core functionality against the annex text quoted above. The wording of Article 7(1) is quoted in the product classes guide.
Questions and answers
Where does a security microprocessor or microcontroller sit in the CRA annexes?
See the short answer and the annex quote at the top of this page.
Does a security microprocessor or microcontroller need a notified body?
It depends on the entry. For Annex III, Class I entries: Article 32(2) caveat: self-assessment via internal control remains available only if you apply in full harmonised standards, common specifications or European cybersecurity certification schemes at assurance level at least 'substantial'; where you apply them only in part or not at all, or none exist, EU-type examination followed by production control (module B+C) or full quality assurance (module H) applies. For Annex III, Class II entries: Article 32(3): conformity is demonstrated through EU-type examination followed by conformity to EU-type based on internal production control (module B+C), through full quality assurance (module H), or, where available and applicable, through a European cybersecurity certification scheme at assurance level at least 'substantial'. The first two run through a notified body.
When do the CRA rules for a security microprocessor or microcontroller apply?
Reporting duties under Article 14 have applied since 11 September 2026, and the CRA will apply in full from 11 December 2027.
Cybiq checks the CRA only. Orientation, not legal advice. Quoted spans come from Regulation (EU) 2024/2847 as published in the Official Journal and are re-verified against the live text by automated tests. Verify before relying on any item; for an assessment of your own product, consult a qualified lawyer.