Product classes and conformity assessment: default, important, critical
A product's class decides who assesses its conformity: the manufacturer itself or a notified body. This page lists every category in Annexes III and IV with the examples from the implementing regulation and explains what the lack of standards and notified bodies means in October 2026.
The Cyber Resilience Act divides products with digital elements into three classes. By far the largest share, from machine controllers and sensors to ERP software, falls into the default category: the manufacturer assesses conformity itself (Article 32(1), module A). Important products under Annex III, whose core functionality is security or network control, need a notified body in class I as long as no harmonised standard has been published in the Official Journal, and in class II always (Article 32(2) and (3)). For critical products under Annex IV, a delegated act can require a European cybersecurity certificate (Article 8(1)). What counts is the core functionality of the product, not a component it contains (Article 7(1), second sentence).
Key points
- Three classes: default (the normal case), important class I and II (Annex III), critical (Annex IV). The technical descriptions are set out in Implementing Regulation (EU) 2025/2392.
- A built-in component from Annex III does not in itself subject the overall product to the conformity assessment procedures for important products (Article 7(1), second sentence). A machine with an embedded operating system is not an operating system.
- Default category: module A on the manufacturer's own responsibility. Class I: module A only where harmonised standards are applied in full, otherwise a notified body. Class II and critical: always a notified body (Article 32).
- As of 7 October 2026: no CRA standard in the Official Journal, no notified body in NANDO. For class I this means a notified body in practice; for the default category, self-assessment with your own justification.
- The class makes no difference to the reporting obligation: Article 14 has applied to all three classes since 11 September 2026.
How is the class determined?
Under Article 7(1), a product that has the core functionality of a category listed in Annex III is an important product and is subject to the procedures in Article 32(2) and (3). The second sentence of the same paragraph is the most important rule for mid-sized manufacturers: integrating such a product into another does not in itself subject the product it is integrated into to those procedures. Recital 3 of the implementing regulation gives the example of an embedded browser in a messaging app; the app does not become a class I product as a result. The manufacturer does, however, have to take the component into account as part of its due diligence under Article 13(5).
The criteria for the lists are set out in Article 7(2): either the product primarily performs security functions for other products or networks, or its function carries a significant risk of adverse effects, for example as a central system function, network management or virtualisation. The Commission can amend the lists by delegated act (Article 7(3), Article 8(2)). It adopted the technical descriptions in Implementing Regulation (EU) 2025/2392 of 28 November 2025 (Article 7(4)); the examples in the tables are taken from it.
Which products are important products in class I?
Annex III, class I, comprises 19 categories. The examples show what the implementing regulation understands by each of them.
| No. | Category | Examples from the implementing regulation |
|---|---|---|
| 1 | Identity management systems, privileged access management software and hardware, readers including biometric readers | Access management systems, single sign-on, federated identity management, one-time password software, TAN generators, multi-factor authentication software |
| 2 | Standalone and embedded browsers | Including embedded browsers for integration and browsers with integrated AI agents |
| 3 | Password managers | Local, as a browser extension, for enterprises, hardware-based |
| 4 | Software that searches for, removes or quarantines malicious software | Antivirus, anti-malware, rootkit detection, rescue disk software |
| 5 | Products with a VPN function | VPN clients, VPN servers, VPN gateways |
| 6 | Network management systems | End-to-end management, configuration management, SDN controllers |
| 7 | SIEM systems | Security information and event management systems |
| 8 | Boot managers | UEFI firmware, single-stage and multi-stage bootloaders |
| 9 | Public key infrastructure and digital certificate issuance software | Key management, certificate management, OCSP responders, complete PKI solutions |
| 10 | Physical and virtual network interfaces | Network cards, controllers and adapters for Wi-Fi, Ethernet, USB, Bluetooth, Zigbee, fieldbus; virtual network cards, container network interfaces, VPN interfaces |
| 11 | Operating systems | Real-time, general-purpose and specialised operating systems |
| 12 | Routers, internet modems, switches | Wired, wireless and virtual routers; DSL, cable, fibre, satellite and mobile modems; managed, smart and multilayer switches, SDN switches, Wi-Fi access points |
| 13 | Microprocessors with security-related functionalities | Encryption, authentication, secure key storage, random number generation, trusted execution environment, secure boot |
| 14 | Microcontrollers with security-related functionalities | As for No. 13, with integrated memory |
| 15 | ASICs and FPGAs with security-related functionalities | Application-specific integrated circuits and field-programmable gate arrays with security functions |
| 16 | Smart home general purpose virtual assistants | Smart speakers, standalone assistants |
| 17 | Smart home products with security functionalities | Door locks, baby monitors, alarm systems, home security cameras and their central controllers |
| 18 | Internet-connected toys with social interactive or location tracking features | Toys under Directive 2009/48/EC; mere proximity detection does not count as location tracking |
| 19 | Wearables for health monitoring outside the medical device rules, and wearables for children under 14 | Fitness trackers, smartwatches, smart jewellery, smart clothing |
Which products are class II or critical?
Class II (Annex III) comprises four categories, critical products (Annex IV) three. For both, conformity assessment always involves a notified body or a certification scheme.
| Class | Category | Examples from the implementing regulation |
|---|---|---|
| II, No. 1 | Hypervisors and container runtime systems | Type 1, type 2 and hybrid hypervisors; container runtime environments |
| II, No. 2 | Firewalls, intrusion detection and prevention systems | Network and web application firewalls, filters, anti-spam gateways, network-based and host-based IDS and IPS |
| II, No. 3 | Tamper-resistant microprocessors | Class I, No. 13 products with protection at AVA_VAN level 2 or 3 under the Common Criteria |
| II, No. 4 | Tamper-resistant microcontrollers | As for No. 3, AVA_VAN level 2 or 3 |
| Critical, No. 1 | Hardware devices with security boxes | Physical payment terminals, hardware security modules, tachographs |
| Critical, No. 2 | Smart meter gateways and other devices for advanced security purposes, including secure cryptoprocessing | Gateways under Directive (EU) 2019/944, including gateways for gas and heat where they match the description |
| Critical, No. 3 | Smartcards and similar devices, including secure elements (AVA_VAN at least 4) | TPMs, eUICCs, identity and travel documents, signature cards, UICCs, payment and access cards, tachograph cards, payment wristbands |
Which procedure applies to which class?
Article 32(1) sets out four procedures. The modules come from general EU product legislation and are adapted for the CRA in Annex VIII:
- Module A, internal control (Annex VIII, Part I): the manufacturer draws up the technical documentation, carries out the assessment itself, issues the declaration of conformity and affixes the CE marking. No notified body is involved.
- Module B plus C, EU-type examination (Annex VIII, Parts II and III): a notified body examines the type and the vulnerability handling processes, issues a certificate and audits vulnerability handling regularly. The manufacturer then ensures that series production conforms to the type.
- Module H, full quality assurance (Annex VIII, Part IV): a notified body assesses and monitors the quality system for design, production and vulnerability handling, instead of examining each type individually.
- European cybersecurity certification scheme under the Cybersecurity Act, where one is available for the product.
| Class | Procedure | Notified body required? |
|---|---|---|
| Default | Module A (Article 32(1)(a)); voluntarily also B plus C, H or a scheme | No |
| Important, class I | Module A only if harmonised standards, common specifications or a certification scheme at assurance level at least "substantial" are applied in full; otherwise B plus C or H (Article 32(2)) | In October 2026 yes in practice, because no standard has been published in the Official Journal |
| Important, class II | B plus C, H or a certification scheme at assurance level at least "substantial" (Article 32(3)) | Yes |
| Critical | Certification scheme, if the Commission requires one by delegated act (Article 8(1)); otherwise as for class II (Article 32(4)) | Yes |
Two concessions: free and open-source software in an Annex III category may use any procedure if the technical documentation is made public (Article 32(5)); fees are to be reduced proportionately for microenterprises and small and medium-sized enterprises, including start-ups (Article 32(6)).
What do missing standards and notified bodies mean?
The Regulation assumes that harmonised standards will be published in the Official Journal and notified bodies will be operating by December 2027. On 7 October 2026, neither is the case.
No standard in the Official Journal
A harmonised standard cited in the Official Journal of the EU gives rise to the presumption of conformity under Article 27(1): if you apply it, you are presumed to conform to the extent it covers. According to secondary sources, the first CRA standards, EN 40000-1-1 (vocabulary) and EN 40000-1-2 (principles), passed the formal vote in early October 2026; EN 40000-1-3 (vulnerability handling) is in the approval phase and EN 40000-1-4 is in development. None of them has been cited. Common specifications from the Commission (Article 27(2)) are only permitted if standardisation fails; no such act is known.
The consequences: manufacturers of products in the default category can use module A, but have to describe and justify their solutions themselves (Annex VII, point (5)). BSI TR-03183-1 or the IEC 62443 series can serve as guidance, without any presumption of conformity. Manufacturers of class I products cannot use module A at present and need a notified body.
No notified body in NANDO
No notified body for the CRA is listed in the EU's NANDO database (last documented check 8 September 2026). Notification has been possible since 11 June 2026. Germany has a two-stage procedure: since 28 July 2026, the national accreditation body DAkkS has been accrediting for module B under ISO/IEC 17065 and module H under ISO/IEC 17021-1, after which the BSI notifies the body. The names of applicants are not known. Bitkom, the German digital industry association, warns of bottlenecks at conformity assessment bodies. For manufacturers in classes I and II this means: contact bodies that are going through accreditation early, and do not postpone the assessment to 2027.
Existing certificates
EU-type examination certificates covering cybersecurity requirements under other legislation, such as the Radio Equipment Directive, remain valid until 11 June 2028 (Article 69(1)). According to the Commission guidance (as reported by secondary sources), this only covers the risks assessed under that legislation.
What manufacturers can do now
- Determine the class by core functionalityCheck each product against Annexes III and IV and the implementing regulation. The Applicability Check gives you a first classification; for important and critical products, have the classification checked by a lawyer or a conformity assessment body.
- Choose the procedureDefault category: module A with your own justification for each requirement in Annex I. Class I: plan for a notified body until standards are cited. Class II and critical: a notified body or a scheme in every case.
- Start the risk assessment and documentationThe manufacturer needs both whatever the procedure (Article 13(2) to (4), Annex VII). Without standards, describing the chosen solutions is the core of the documentation.
- Approach a notified bodyFor class I and II: contact bodies that are in the DAkkS procedure and secure capacity for 2027.
- Do not forget the reporting obligationIt has applied since 11 September 2026, regardless of class. The reporting address, the call chain and access to the ENISA platform come before conformity assessment, not after it.
For that last point, CRA Response Center keeps you ready, whatever the class: it monitors the security mailbox, recognises important reports, alerts the people responsible and records awareness and deadlines in the history. Submission to ENISA remains with the manufacturer.
Common mistakes
- Classifying by the components a product contains. An industrial PC with a real-time operating system is in the default category; the operating system, sold separately, is class I, No. 11. A machine with a VPN client is not class I for that reason.
- Assuming module A is always available for class I. Not without a harmonised standard in the Official Journal (Article 32(2)).
- Expecting free assessment capacity at the end of 2027. As of October 2026 there is no notified body; if you need one, make contact now.
- Overlooking own-brand products. Anyone who sells a third-party firewall under their own brand is the manufacturer of a class II product (Article 21) and needs their own conformity assessment involving a notified body.
Frequently asked questions
How do I find out which class my product is in?
From Annexes III and IV of the Regulation and the technical descriptions in Implementing Regulation (EU) 2025/2392. What decides is the product's core functionality (Article 7(1)). If the core functionality is not on either list, the product is in the default category.
My product contains a VPN client. Is it class I?
Not for that reason alone. Only if VPN is the product's core functionality (Article 7(1), second sentence, recital 3 of the implementing regulation). The component is, however, covered by the due diligence obligation under Article 13(5).
Do I need a notified body as the manufacturer of a product in the default category?
No. Module A is sufficient (Article 32(1)(a)). You may choose a stricter procedure voluntarily.
What does "no harmonised standards" mean for me?
Default category: self-assessment with your own justification of the chosen solutions under Annex VII, point (5). Class I: a notified body is mandatory as long as no standard has been published in the Official Journal (Article 32(2)).
Are there any notified bodies for the CRA yet?
No, none is listed in NANDO (as of the last documented check on 8 September 2026). In Germany, DAkkS accreditation and BSI notification are under way; the names of applicants are not known.
Can the Commission change the lists?
Yes, by delegated act, with a transitional period of at least twelve months for Annex III (Article 7(3)) and six months for Annex IV (Article 8(2)). No change has been made so far.
Does the class change anything about the reporting obligation?
No. Article 14 has applied since 11 September 2026 to all products within scope, regardless of class.
Further reading
- Manufacturer obligations under Article 13Risk assessment, Annex I, documentation and CE marking at a glance.
- The CRA timelineWhat has applied since September 2026 and what follows from December 2027.
- The CRA in machinery and plant engineeringWhy the machine is usually in the default category and what applies to the controller.
- Glossary: notified bodyThe term in two sentences.
- EN 40000-1-1 and EN 40000-1-2 have passed the formal vote, but no standard is in the Official Journal yetAccording to secondary sources, the first two CRA standards have been adopted. There is no presumption of conformity yet.
Sources
- Regulation (EU) 2024/2847, Articles 7, 8, 13, 21, 27, 32, 69, Annexes III, IV, VII, VIII, EUR-Lex, accessed 7 October 2026.
- Implementing Regulation (EU) 2025/2392, Annexes I and II, recital 3, EUR-Lex, Official Journal of 1 December 2025.
- CRA notified bodies rules apply 11 June 2026, cyberresilienceact.eu, 11 September 2026.
- DAkkS starts accreditation for the Cyber Resilience Act (in German), DAkkS, 28 July 2026.
- CRA conformity: BSI and DAkkS build assessment capacity (in German), BSI, 25 September 2026.
- Harmonised Standards Status, craevidence.com, 2 October 2026.
- EN 40000 CRA Harmonised Standards Guide, cvdportal.com, October 2026.
- Position paper on CRA implementation (in German), Bitkom, March 2026.