Important product, class II
Class II is small and strict: four categories and no way around the notified body. If you sell a firewall or a hypervisor as a product in its own right, plan the assessment procedure now.
An important product in class II is a product with digital elements whose core functionality falls into one of the four categories of Annex III, class II, of the CRA. For these products, assessment by a notified body is mandatory in every case.
Definition in the Regulation
Article 7(1) classifies products with the core functionality of an Annex III category as important products. Implementing Regulation (EU) 2025/2392 describes the four class II categories: hypervisors and container runtime systems; firewalls, including web application firewalls, filters and anti-spam gateways, as well as intrusion detection and intrusion prevention systems; tamper-resistant microprocessors; tamper-resistant microcontrollers. The last two concern components protected under Common Criteria at AVA_VAN level 2 or 3.
For class II, Article 32(3) requires EU-type examination with conformity to EU-type (modules B and C), full quality assurance (module H) or a European cybersecurity certification scheme at assurance level at least "substantial". Internal control under module A is ruled out, even with a harmonised standard. Under Article 32(5), open-source products in Annex III categories may use any procedure, provided their technical documentation is public.
What it means for manufacturers
An OT firewall sold as a product in its own right is class II; an industrial PC with a built-in firewall function is not, as long as the firewall is not its core functionality. Class II manufacturers must involve a notified body for products placed on the market from 11 December 2027. As of October 2026, the NANDO database lists no body for the CRA; in Germany, accreditation by DAkkS and notification by the BSI are under way. As module B includes regular audits of vulnerability handling, the reporting address, CVD process and reporting route should be in place before the assessment.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kit