Provetry
FRDEGet early access
Free check
Get early access

Provetry opens in November 2026. The free CRA check, the tools and the guides are available now.

Important and critical products under the CRA: classes and conformity

9 min read

On this page
  1. Important products, class I
  2. Important products, class II
  3. Critical products
  4. The conformity assessment routes
  5. The class I trap
  6. How to find your class
  7. How Provetry helps
  8. Sources

Most products in scope of the Cyber Resilience Act are in the default category, and their manufacturer assesses conformity alone. A few categories are singled out because a flaw in them would have wider effects: they are important (class I or class II, Annex III) or critical (Annex IV), and their route to the CE marking involves more third-party checks.

What decides the class is the product’s core functionality. Implementing Regulation (EU) 2025/2392, in force since 21 December 2025, gives a technical description of each category, with examples. A product that merely contains a component from a listed category, such as a router chip in a television, is not classed by that component.

Important products, class I

Annex III, class I lists:

  1. Identity management systems and privileged access management software and hardware, including authentication and access control readers, biometric readers included
  2. Standalone and embedded browsers
  3. Password managers
  4. Software that searches for, removes or quarantines malicious software
  5. Products with the function of virtual private network (VPN)
  6. Network management systems
  7. Security information and event management (SIEM) systems
  8. Boot managers
  9. Public key infrastructure and digital certificate issuance software
  10. Physical and virtual network interfaces
  11. Operating systems
  12. Routers, modems intended for connection to the internet, and switches
  13. Microprocessors with security-related functionalities
  14. Microcontrollers with security-related functionalities
  15. Application specific integrated circuits (ASIC) and field-programmable gate arrays (FPGA) with security-related functionalities
  16. Smart home general purpose virtual assistants
  17. Smart home products with security functionalities, including smart door locks, security cameras, baby monitoring systems and alarm systems
  18. Internet-connected toys covered by Directive 2009/48/EC with social interactive features (such as speaking or filming) or location tracking features
  19. Personal wearable products to be worn or placed on a human body that have a health monitoring purpose (other than medical devices), and personal wearable products intended for use by children

Important products, class II

  1. Hypervisors and container runtime systems that support virtualised execution of operating systems and similar environments
  2. Firewalls, intrusion detection and prevention systems
  3. Tamper-resistant microprocessors
  4. Tamper-resistant microcontrollers

Critical products

Annex IV lists:

  1. Hardware devices with security boxes
  2. Smart meter gateways within smart metering systems, and other devices for advanced security purposes, including for secure cryptoprocessing
  3. Smartcards or similar devices, including secure elements

The conformity assessment routes

The modules come from the EU’s general product-safety toolbox:

  • Module A, internal production control: the manufacturer assesses conformity itself and documents it.
  • Module B + C: a notified body examines the product type (EU-type examination), and the manufacturer ensures production conforms to that type.
  • Module H: a notified body assesses and monitors the manufacturer’s full quality assurance system.
  • European cybersecurity certification: a certificate under a scheme adopted under the Cybersecurity Act, at assurance level “substantial” or higher where required.
Category Routes available
Default Module A, or any of the others if you prefer
Important, class I Module A only if you fully apply harmonised standards, common specifications or a European certification scheme (at least “substantial”) covering the requirements; otherwise B + C or H
Important, class II B + C, H, or a European certification scheme (at least “substantial”)
Critical A European cybersecurity certificate where the Commission requires one by delegated act; otherwise the class II routes

Free and open-source products of class I or II that are placed on the market may use module A if their technical documentation is made public.

The class I trap

For class I, self-assessment depends on harmonised standards. As of late 2026, no CRA harmonised standard had yet been cited in the Official Journal, and the standards bodies’ first deadlines had slipped. If none is cited in time for your product, a class I product would need a notified body from 11 December 2027. Member States have been able to notify bodies since 11 June 2026, but few are expected before the end of 2026, and capacity will be tight. If your product is class I:

  • follow the drafts of the relevant standards (EN 40000 series, and the vertical standard for your category) now;
  • plan for a notified body as a fallback, and contact one early;
  • keep your technical documentation ready for an external examination.

How to find your class

  1. Describe the product’s core functionality in one sentence.
  2. Compare it with the technical descriptions in Implementing Regulation (EU) 2025/2392, not just the short names in the annexes.
  3. If it matches no category, it is in the default category.
  4. Write down the reasoning in your technical documentation: a market surveillance authority may ask.

Our free check does a first pass in five minutes; see also Does the CRA apply to your product?.

How Provetry helps

Each product records its CRA category, and the compliance dossier (Pro and Consultant plans) shows the conformity routes open to it, asks the questions for the technical documentation, and drafts the EU declaration of conformity.

This guide is general information, not legal advice.

Sources