Does my device fall under the CRA at all?
The Regulation applies to products with digital elements whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network (Art. 2(1)). For a device with firmware and an interface, that is almost always the case.
Excluded are products covered by their own legal acts: medical devices and in vitro diagnostic medical devices (Regulations (EU) 2017/745 and 2017/746) and vehicles with type approval under Regulation (EU) 2019/2144 (Art. 2(2)), as well as aviation products under Regulation (EU) 2018/1139 and marine equipment (Art. 2(3) and (4)).
Which four product groups does the CRA define?
| Group | Conformity assessment procedure (Art. 32) |
|---|---|
| Default: everything not listed in Annex III or IV | Internal control procedure (module A): the manufacturer assesses itself. |
| Important, class I (Annex III) | Module A only if the manufacturer fully applies harmonised standards, common specifications or a certificate at assurance level at least ‘substantial’. Otherwise EU-type examination (modules B and C) or full quality assurance (module H). |
| Important, class II (Annex III) | EU-type examination (modules B and C), full quality assurance (module H) or a European certificate at assurance level at least ‘substantial’. |
| Critical (Annex IV) | A European cybersecurity certificate, where the Commission requires one under Art. 8(1). Otherwise the class II procedures. |
Which products are class I?
Annex III lists 19 categories for class I and four for class II. These class I categories concern device manufacturers directly, shortened:
- 1
Point 1
identity management systems and privileged access management hardware, including authentication and access control readers.
- 2
Point 6
network management systems.
- 3
Point 8
boot managers.
- 4
Point 10
physical and virtual network interfaces.
- 5
Point 11
operating systems.
- 6
Point 12
routers, modems intended for the connection to the internet, and switches.
- 7
Points 13 and 14
microprocessors and microcontrollers with security-related functionalities.
- 8
Point 15
ASIC and FPGA with security-related functionalities.
- 9
Point 17
smart home products with security functionalities, including smart door locks, security cameras, baby monitoring systems and alarm systems.
Which products are class II or critical?
| Annex | Categories |
|---|---|
| III, class II | Hypervisors and container runtime systems · firewalls, intrusion detection and prevention systems · tamper-resistant microprocessors · tamper-resistant microcontrollers |
| IV, critical | Hardware devices with security boxes · smart meter gateways within smart metering systems and other devices for advanced security purposes, including for secure cryptoprocessing · smartcards or similar devices, including secure elements |
What do the categories cover under Implementing Regulation 2025/2392?
Annexes III and IV give names only. What falls under them is set out in Commission Implementing Regulation (EU) 2025/2392 of 28 November 2025 (Art. 7(4) CRA). For device manufacturers these descriptions matter most, in the original wording:
| Category | Implementing Regulation (EU) 2025/2392 |
|---|---|
| Class I point 10, network interfaces | “wired and wireless network interface cards, controllers and adapters, such as for Wi-Fi, Ethernet, IrDA, USB, Bluetooth, NearLink, Zigbee, or Fieldbus” |
| Class I point 11, operating systems | “This category includes but is not limited to real-time operating systems, general-purpose and special-purpose operating systems.” |
| Class I point 12, routers | “wired and wireless routers, virtual routers and routers with or without modems” |
| Class I point 14, microcontrollers | Security-related functionalities “such as encryption, authentication, secure key storage, random number generation, trusted execution environment” that aim to secure other products, networks or services “beyond the microcontroller itself”. |
| Class I point 17, smart home | Products “that protect the physical security of consumers in a residential setting and which can be controlled or managed remotely from other systems”. |
| Class II point 4, tamper-resistant microcontrollers | Microcontrollers under class I point 14 that are additionally designed to provide “protection of AVA_VAN level 2 or 3” under the Common Criteria. |
| Annex IV point 3, secure elements | Designed to provide protection “of at least AVA_VAN.4”. |
Does the whole device count, or its core functionality?
A product is important if it has the core functionality of a product category set out in Annex III (Art. 7(1)). If a manufacturer builds a microcontroller with security-related functionalities into its control unit, that does not make the control unit an important product itself: the integration does not in itself lead to the class I and II procedures.
For the manufacturer of the microcontroller the situation is different. It places a class I product on the market or, if the microcontroller is tamper-resistant, a class II product. The same applies to the vendor of a real-time operating system it sells as a product of its own.
The Implementing Regulation explains core functionality in both directions. Additional functions do not change it: a router integrating firewall functionality remains a router (recital 4). And a product that can perform a function from Annex III but has a different core functionality does not fall under the category; the Regulation's example is a smartphone with an operating system (recital 5).
How far are the harmonised standards?
For class I, everything hinges on the standards. Products in conformity with harmonised standards “the references of which have been published in the Official Journal of the European Union” are presumed to be in conformity with Annex I (Art. 27(1)). Without such standards, common specifications or a certificate, the route goes through a notified body (Art. 32(2)).
As of 23 October 2026, no reference of a harmonised standard for the CRA has been published in the Official Journal. The Commission has adopted no common specifications (Art. 27(2)) and designated no certification scheme under Art. 27(9).
The standards have been in the works since standardisation request M/606, which the European standardisation organisations, among them CEN and CENELEC, accepted on 3 April 2025; the horizontal standards are being drafted in CEN-CLC/JTC 13 WG 9. In its FAQs the Commission names 15 horizontal standards in three deliverables and 26 vertical standards for the categories in Annexes III and IV.
BSI TR-03183 helps with preparation but does not replace a standard. The BSI states: “It cannot be used as presumption of conformity.”
curl -s -G https:/"celex","title"What is the same for all classes?
The class changes only who assesses conformity. The requirements of Annex I apply to every product: no known exploitable vulnerabilities when it is made available, a secure by default configuration, protection from unauthorised access, a software bill of materials, security updates. The reporting obligation under Art. 14 has also applied to all of them since 11 September 2026.
You need the same technical documentation for a notified body as for self-assessment. What is in the firmware belongs in it: components with version, known vulnerabilities, hardening.
- 1
Classify the product
check its core functionality against Annexes III and IV and the descriptions in Implementing Regulation (EU) 2025/2392.
- 2
Choose the procedure
for class I, check whether harmonised standards, common specifications or a European certification scheme exist and are fully applied. If none is available by the time you place the product on the market, plan for a notified body.
- 3
Build the technical documentation
a bill of materials per release, the vulnerability situation, hardening, with evidence from the shipped firmware.
- 4
Plan the deadlines
reporting channels since 11 September 2026, all other obligations from 11 December 2027 (Art. 71(2)).
Questions
Is an industrial router class I or class II?
A router is listed in Annex III under class I, point 12, also with integrated firewall functionality (Implementing Regulation (EU) 2025/2392, recital 4). If the device's core functionality is that of a firewall or an intrusion prevention system, it falls under class II, point 2.
Is my control unit class I because it contains a microcontroller with security functions?
No. Integrating a product from Annex III does not in itself make the product it is integrated into an important product (Art. 7(1)). What counts is the core functionality of your device.
Is a real-time operating system an important product?
As a product of its own, yes: the Implementing Regulation counts real-time operating systems under class I, point 11. Building the RTOS into your device does not make your device an important product (Art. 7(1)).
Is a fieldbus or Bluetooth module class I?
As a product of its own, yes: network interfaces for Fieldbus, Bluetooth, Zigbee, Wi-Fi or Ethernet are listed under class I, point 10. For the device you build the module into, the core functionality decides again.
Are there harmonised standards for the CRA yet?
As of 23 October 2026, no reference has been published in the Official Journal. The standards have been in the works since standardisation request M/606. For class I that means today: without a standard, common specification or certificate, a notified body.
Does the SBOM obligation apply to default products too?
Yes. Annex I applies to all products with digital elements, regardless of class. The bill of materials is in Annex I, Part II, point 1.
From when must conformity be assessed?
From 11 December 2027 for products placed on the market from then on (Art. 71(2)). The rules for notified bodies have applied since 11 June 2026.
Sources
- [1]Regulation (EU) 2024/2847, Cyber Resilience Act, Official Journal
- [2]Commission Implementing Regulation (EU) 2025/2392
- [3]Regulation (EU) 2019/881, Cybersecurity Act
- [4]CEN-CENELEC: CRA standardisation request accepted
- [5]European Commission: FAQs on the Cyber Resilience Act
- [6]BSI: Technical Guideline TR-03183