Implementing Regulation (EU) 2025/2392 Defines CRA Product Categories
On November 28, 2025, the European Commission adopted Commission Implementing Regulation (EU) 2025/2392. It sets out the technical descriptions of the product categories listed in Annexes III and IV of the Cyber Resilience Act (CRA).
The implementing regulation closes gaps in interpretation that the CRA (Regulation (EU) 2024/2847) had left open. For manufacturers, classifying their products correctly is essential, because the class determines which conformity assessment procedure applies.
Contents
Main provisions
Core functionality decides the classification
The core functionality of a product determines its classification, not the components embedded in it. A smartphone with an integrated password manager therefore does not become a password manager within the meaning of the CRA. Likewise, an operating system with an integrated browser remains an operating system and does not become a browser.
A full security assessment remains mandatory
Regardless of the classification, manufacturers must carry out a cybersecurity risk assessment under Article 13 of the CRA. It must cover the security of the entire product, including all integrated components.
AVA_VAN levels for hardware components
For tamper-resistant microcontrollers, tamper-resistant microprocessors, and secure elements, the implementing regulation uses the AVA_VAN levels from the Common Criteria. They serve as a common language to describe the required level of resistance against attacks. The levels range from AVA_VAN.1 to AVA_VAN.5, and higher levels mean stronger protection.
Manufacturers do not have to obtain a Common Criteria certification. The AVA_VAN level describes the product category; it is not a separate proof of conformity. Tamper-resistant microprocessors and microcontrollers are important products of class II, and secure elements are critical products. Their conformity assessment therefore involves a notified body or a European cybersecurity certificate under Article 32(3) of the CRA. Internal evidence alone is not enough for these products.
Scope of the implementing regulation
The implementing regulation sets out the technical descriptions for all categories listed in Annex III (important products, classes I and II) and Annex IV (critical products) of the CRA. They include network components, security software, operating systems, smart home products, wearables, and hardware security components, among others.
The full list of product categories with their technical descriptions is in Annexes I and II of the implementing regulation.
What this means for manufacturers
You should use the technical descriptions to check whether your products qualify as important or critical. The result determines the conformity assessment procedure under Article 32 of the CRA. Our page on important and critical products under the CRA explains the classes and the procedures that follow from them.
Regardless of the classification, you must carry out a risk-based cybersecurity assessment under Article 13 of the CRA. You should prepare the documentation in good time before the CRA applies in full on December 11, 2027.
Assessment
Implementing Regulation (EU) 2025/2392 specifies the CRA product categories and narrows the room for interpretation. Its main provisions are the clarification that core functionality decides the classification and the use of AVA_VAN levels for hardware components.
The new implementing regulation narrows the room for interpretation, but it does not automatically make classification easier. If you want to understand how the CRA applies to your products and which next steps make sense, we can discuss this in a no-obligation call.
Further reading:
