Guide
Which products are Class I, Class II or critical under the CRA?
Short answer: Annex III of Regulation (EU) 2024/2847 lists important products in two classes. Annex IV lists critical products. Cybiq covers 21 product categories. Of these, 16 sit mainly in Class I, 3 in Class II and 1 in Annex IV (critical). One category, industrial control component, is not listed as such.
“IMPORTANT PRODUCTS WITH DIGITAL ELEMENTS”
“CRITICAL PRODUCTS WITH DIGITAL ELEMENTS”
Annex III, Class I
Article 32(2) caveat: self-assessment via internal control remains available only if you apply in full harmonised standards, common specifications or European cybersecurity certification schemes at assurance level at least 'substantial'; where you apply them only in part or not at all, or none exist, EU-type examination followed by production control (module B+C) or full quality assurance (module H) applies.
“the manufacturer has not applied or has applied only in part harmonised standards, common specifications or European cybersecurity certification schemes at assurance level at least ‘substantial’ as referred to in Article 27, or where such harmonised standards, common specifications or European cybersecurity certification schemes do not exist, the product with digital elements concerned and the processes put in place by the manufacturer shall be submitted with regard to those essential cybersecurity requirements to either of the following procedures”
- Browser: Class I
- Password manager: Class I
- IAM and PAM product: Class I
- Anti-malware software: Class I
- VPN: Class I
- Network management system: Class I
- SIEM system: Class I
- Boot manager: Class I
- PKI and certificate issuance software: Class I
- Operating system: Class I
- Security microprocessor or microcontroller: Class I or II
- Smart home general purpose assistant or security product: Class I
- Connected toy: Class I
- Health wearable: Class I
- Router, modem or switch: Class I
- Smart meter gateway or network interface: Class I or Annex IV
Annex III, Class II
Article 32(3): conformity is demonstrated through EU-type examination followed by conformity to EU-type based on internal production control (module B+C), through full quality assurance (module H), or, where available and applicable, through a European cybersecurity certification scheme at assurance level at least 'substantial'. The first two run through a notified body.
“Where the product is an important product with digital elements that falls under class II as set out in Annex III, the manufacturer shall demonstrate conformity with the essential cybersecurity requirements set out in Annex I by using any of the following procedures”
- Firewall or intrusion detection system: Class II
- Tamper-resistant microprocessor or microcontroller: Class II
- Hypervisor or container runtime: Class II
Annex IV
“Critical products with digital elements listed in Annex IV shall demonstrate conformity with the essential cybersecurity requirements set out in Annex I by using one of the following procedures: (a) a European cybersecurity certification scheme in accordance with Article 8(1); or (b) where the conditions in Article 8(1) are not met, any of the procedures referred to in paragraph 3 of this Article.”
Not listed as such
Industrial control / OT components are not listed in Annex III or Annex IV as such, so the default route under Article 32(1) applies, which includes internal control. The class changes where the product's core functionality is that of a listed category, for example: an operating system, a network management system, a router/modem/switch, or a physical or virtual network interface is Annex III Class I; tamper-resistant microprocessors/microcontrollers and firewalls/IDS/IPS are Class II; smart meter gateways are Annex IV critical. Verify the exact function against the annex text.
“the internal control procedure (based on module A) set out in Annex VIII”
- Industrial control component: Not listed
The core functionality decides
A product falls under a category when it has that category's core functionality (Article 7(1)); integrating a listed product does not in itself subject the host product to the Class I or Class II procedures. Check your product's core functionality against the annex text quoted on its category page before you rely on that page.
“Products with digital elements which have the core functionality of a product category set out in Annex III shall be considered to be important products with digital elements and shall be subject to the conformity assessment procedures referred to in Article 32(2) and (3). The integration of a product with digital elements which has the core functionality of a product category set out in Annex III shall not in itself render the product in which it is integrated subject to the conformity assessment procedures referred to in Article 32(2) and (3).”
Two worked cases: how an Ethernet interface or network device is read against Annex III, and how a hardware security module is read against the critical-product list in Annex IV.
Free and open-source software
If the product qualifies as free and open-source software, Article 32(5) lets its manufacturer demonstrate conformity 'by using one of the procedures referred to in paragraph 1 of this Article, provided that the technical documentation referred to in Article 31 is made available to the public at the time of the placing on the market of those products'. Article 32(1) includes internal control (module A). If that documentation is not public at the time of placing on the market, the ordinary Annex III route applies instead.
“Manufacturers of products with digital elements qualifying as free and open-source software, which fall under the categories set out in Annex III, shall be able to demonstrate conformity with the essential cybersecurity requirements set out in Annex I by using one of the procedures referred to in paragraph 1 of this Article, provided that the technical documentation referred to in Article 31 is made available to the public at the time of the placing on the market of those products.”
When it applies
Since 11 June 2026, the rules on notified conformity assessment bodies, Chapter IV (Articles 35 to 51), have applied. The reporting duties of Article 14 have applied since 11 September 2026. The CRA will apply in full from 11 December 2027.
“This Regulation shall apply from 11 December 2027. However, Article 14 shall apply from 11 September 2026 and Chapter IV (Articles 35 to 51) shall apply from 11 June 2026.”
For the four tiers in one place, see what the CRA is.
Cybiq checks the CRA only. Orientation, not legal advice. Quoted spans come from Regulation (EU) 2024/2847 as published in the Official Journal and are re-verified against the live text by automated tests. Verify before relying on any item; for an assessment of your own product, consult a qualified lawyer.