Important and Critical Products under the CRA

The Cyber Resilience Act (Regulation (EU) 2024/2847), or CRA, sorts products with digital elements into three classes: default products, important products, and critical products. The class decides whether you can assess conformity yourself or must involve a notified body.

Classification comes before any testing. If you place your product in the wrong class, your plan for effort, time, and budget will be wrong too. The classes are one part of the wider set of requirements that the CRA sets for manufacturers.

Contents

1. The three CRA product classes at a glance
2. Default products with digital elements
3. Important products under Annex III
   1. Class I
   2. Class II
4. Critical products under Annex IV
5. Core functionality decides: Implementing Regulation (EU) 2025/2392
6. Standards for implementation
7. What manufacturers should do

The three CRA product classes at a glance

Each class is tied to its own article and its own conformity assessment route. The security requirements themselves do not differ between classes: the essential cybersecurity requirements in Annex I apply to all products. What differs is the procedure you use to demonstrate conformity.

Class	Legal basis	Annex	Conformity route (in brief)
Default	Article 6	none	internal control (module A)
Important, class I	Article 7	Annex III, class I	module B+C, module H, or harmonized standard
Important, class II	Article 7	Annex III, class II	module B+C, module H, or European cybersecurity certificate at least “substantial”; internal control (module A) excluded
Critical	Article 8	Annex IV	possibly also a European cybersecurity certificate at assurance level at least “substantial”; otherwise the procedures under Article 32(3)

We explain the individual procedures and modules on a separate page on CRA conformity assessment.

Default products with digital elements

The default class is the normal case. Under Article 6 of the CRA, a product with digital elements may only be made available on the market if it meets the essential cybersecurity requirements in Annex I, Part I. In addition, the manufacturer's processes must comply with the requirements in Annex I, Part II.

For these products, the CRA provides for internal control, which is module A in the system of the New Legislative Framework. You assess conformity on your own responsibility, draw up the technical documentation, affix the CE marking, and issue the EU declaration of conformity. You do not need to involve a notified body.

Most products with digital elements fall into this class. A stricter procedure only applies when the core functionality of a product matches a category in Annex III or Annex IV.

Important products under Annex III

Article 7 of the CRA governs important products with digital elements. A product is important if it has the core functionality of a product category listed in Annex III. Such products are subject to the stricter conformity assessment procedures in Article 32.

Annex III divides important products into two classes. A category is included if it meets at least one of the two criteria in Article 7(2):

• Under point (a), the product primarily performs functions critical to the cybersecurity of other products, networks, or services, for example authentication and access, intrusion detection, or network protection.
• Under point (b), the product performs a function with a significant risk of adverse effects, for example a central system function such as network management, configuration control, or virtualization.

Class I

Class I of Annex III includes, among others, identity management systems, standalone and embedded browsers, password managers, and products with the function of a virtual private network (VPN). The full list is longer and also covers operating systems, routers, and network management systems, for example.

For class I, several routes are open. You can apply a relevant harmonized standard, common specification, or European cybersecurity certification scheme. Alternatively, you can involve a notified body through module B followed by module C, or through module H.

The route without a notified body requires that you apply the relevant harmonized standards, common specifications, or European cybersecurity certification schemes in full. If you do not apply them, apply them only in part, or if they do not exist, you must involve a notified body through module B+C or module H.

Class II

Class II is the stricter level within the important products. Annex III lists here, among others, firewalls, intrusion detection systems, and intrusion prevention systems, as well as hypervisors and container runtime systems that support virtualized execution of operating systems.

For class II, the standards route without third-party assessment is not available. You must involve a notified body, either through module B followed by module C or through module H. Article 32(3) also allows a European cybersecurity certification scheme at assurance level at least “substantial”, where one is available and applicable. Internal control (module A) is not open to class II.

Critical products under Annex IV

Article 8 of the CRA governs critical products with digital elements, and Annex IV lists them. They include hardware devices with security boxes, smart meter gateways within smart metering systems, and smartcards or similar devices, including secure elements.

For this category, the CRA provides an additional option. Through delegated acts, the Commission can require certain critical products to obtain a European cybersecurity certificate at assurance level at least “substantial”. The certificate then demonstrates conformity with the requirements in Annex I or parts of them. The certificate is issued under a European cybersecurity certification scheme adopted under the Cybersecurity Act (Regulation (EU) 2019/881).

This certification obligation only takes effect once such a delegated act has been adopted and a suitable certification scheme is available to manufacturers. As long as no such delegated act exists, critical products are subject to the conformity assessment procedures in Article 32(3). That is the same strict route as for important products of class II.

Core functionality decides: Implementing Regulation (EU) 2025/2392

In practice, the hardest question is not what the annexes say but how to classify a specific product. This is what Commission Implementing Regulation (EU) 2025/2392 addresses. The Commission adopted it on November 28, 2025. It sets the binding technical descriptions of the categories:

• Annex I of the implementing regulation describes the important products of classes I and II.
• Annex II describes the critical products.

The principle is clear: the core functionality of a product decides its class. This follows from the CRA itself, and the implementing regulation confirms it explicitly. Integrating an important component does not in itself force the whole product into the stricter procedure.

The smartphone is a good example. It usually contains components that on their own match several Annex III categories, such as an operating system and an integrated password manager. A smartphone's core functionality, however, is not that of an operating system or a password manager. So it generally does not meet the technical description of these categories and does not become an important product for that reason alone.

This logic does not lower the security requirements. Integrating components does not change the class, but the product as a whole must meet the essential cybersecurity requirements in Annex I. The manufacturer of a messaging app, for example, must demonstrate that the app as a whole conforms and, where appropriate, take the security of the embedded browser into account.

For a detailed analysis of this regulation, including the AVA_VAN levels for tamper-resistant microcontrollers, tamper-resistant microprocessors, and secure elements, see our article Implementing Regulation (EU) 2025/2392 Defines CRA Product Categories.

Standards for implementation

Whatever the class, you need to know which standards help you meet the requirements in practice. A tiered set of standards is currently being developed for this.

The horizontal EN 40000 series addresses the essential cybersecurity requirements across all products. Vertical series for specific product groups complement it: ETSI EN 304 6xx for IT and consumer products, and EN 50770-x for operational technology (OT).

It is not yet settled whether, and which, of these standards will be listed as harmonized standards in the Official Journal of the European Union. Only a listing gives a formal presumption of conformity. Applying them consistently already helps you meet the requirements in a structured way. Whether that application counts formally as proof of conformity depends on a later listing and remains open for now.

The European standardization organizations publish the status of the CRA standardization work. CEN and CENELEC report on the standardization request M/606 and the committees involved, including CEN-CLC/JTC 13, in their news item on the accepted CRA standardization request. ETSI publishes its draft CRA standards in an open area.

What manufacturers should do

Classification follows a clear sequence. It starts with what the product does and ends with the right procedure.

1. Determine the core functionality of the product. What matters is what the product is essentially for, not which additional components it contains. A router with an integrated firewall function keeps the core functionality of a router.
2. Check the core functionality against Annex III and Annex IV of the CRA and against the technical descriptions in Implementing Regulation (EU) 2025/2392. If the core functionality matches a category in Annex IV, the product is critical. If it matches a category in Annex III, the product is important, and you assign it to class I or class II.
3. Derive the conformity route from the class: internal control for default products, a stricter procedure for important products, and possibly an additional European cybersecurity certification for critical products.

Classification is part of the wider CRA obligations of manufacturers.

When the conformity assessment effort actually applies depends on the CRA's application dates, which our overview of the CRA transition periods brings together.