Important product, class I
Class I is the larger of the two groups of important products. In principle, the manufacturer may carry out the assessment itself here, but only with a standard. And in October 2026 that standard is still missing.
An important product in class I is a product with digital elements whose core functionality falls into one of the 19 categories of Annex III, class I, of the CRA, such as operating systems, routers, VPN products or password managers. Stricter conformity assessment rules apply to these products.
Definition in the Regulation
Under Article 7(1), products with the core functionality of an Annex III category are important products; merely integrating such a product does not by itself make the overall product important. Article 7(2) sets out the criteria: a function critical to the cybersecurity of other products or networks, or a function that carries a significant risk of adverse effects. Implementing Regulation (EU) 2025/2392, in force since 21 December 2025, describes the categories technically. Class I includes, among others, identity and access management, browsers, password managers, malware scanners, VPNs, network management, SIEM, boot managers, PKI, network interfaces, operating systems, routers, modems and switches, microprocessors, microcontrollers, ASICs and FPGAs with security-related functionalities, smart home virtual assistants, smart home products with security functionalities, connected toys and health wearables.
Article 32(2) allows internal control under module A only if the manufacturer fully applies harmonised standards, common specifications or a certification scheme; otherwise modules B and C or module H are required.
What it means for manufacturers
As no harmonised standard has been published in the Official Journal as of October 2026, class I manufacturers are in practice left with only the route through a notified body. The NANDO database does not yet list any for the CRA; in Germany, accreditation by the national accreditation body DAkkS and notification by the BSI are under way. Manufacturers should contact assessment bodies early, as industry associations warn of bottlenecks before December 2027. An industrial PC with a real-time operating system remains in the default category; the operating system sold separately, or a managed switch sold as an accessory, is class I.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit