Critical product
The critical category is the smallest one and covers hardware with the highest protection needs. Whether a European certificate becomes mandatory for it is for the Commission to decide by delegated act.
A critical product (in the Regulation: critical product with digital elements) is a product in one of the three categories in Annex IV of the CRA: hardware devices with security boxes, smart meter gateways and smartcards with secure elements. For these products, the Commission can make European cybersecurity certification mandatory.
Definition in the Regulation
Article 8(1) empowers the Commission to require, by delegated act, a European cybersecurity certificate at assurance level at least "substantial" for Annex IV products, provided a suitable scheme is available. As long as no such act exists, Article 32(4) applies the procedure for class II: modules B and C, module H or a certification scheme. Under Article 8(2), the Commission can amend Annex IV with a transitional period of at least six months.
Implementing Regulation (EU) 2025/2392 describes the three categories: physical payment terminals, hardware security modules and tamper-resistant tachographs; smart meter gateways and other devices for advanced security purposes with secure cryptoprocessing; smartcards and similar devices with secure elements, such as TPMs, eUICCs, identity and travel documents, and signature, payment and access cards.
What it means for manufacturers
As of October 2026, the Commission has not adopted a delegated act under Article 8(1). On its implementation page it announces an act on the presumption of conformity through EUCC certificates for the fourth quarter of 2026. Until then, critical products follow the class II route with a notified body. Manufacturers of payment terminals, security modules or smartcards should follow how the certification schemes develop and plan their conformity assessment so that a switch to a certificate remains possible. For small and medium-sized machinery manufacturers the category is rarely relevant: controllers, sensors and devices with encryption do not fall under it, as long as they are not a security box, a device for advanced security purposes with secure cryptoprocessing or a secure element within the meaning of Annex IV.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit