CRA Product Classification: Default vs Class I vs Class II

Why Classification Matters

Your classification determines which conformity assessment you must follow.

Default (Most Products)

Self-assessment using Module A. Evaluate, document, issue DoC, apply CE mark.

Class I (Important)

Annex III, Class I: identity management, browsers, password managers, VPNs, SIEM, operating systems, routers. Third-party notified body assessment required in practice — Module A self-assessment only available once harmonised CRA standards are published (Article 32). No harmonised standards published as of 2026.

Class II (Important)

Annex III, Class II: hypervisors and container runtime systems, firewalls and intrusion detection/prevention systems, tamper-resistant microprocessors and microcontrollers. Mandatory third-party assessment (Module B + C or H) or a certification scheme at assurance level at least "substantial".

Critical

Annex IV: hardware devices with security boxes, smart meter gateways and other devices for advanced security purposes, smartcards and secure elements. A European cybersecurity certification scheme under Article 8(1), otherwise the Class II procedures (Article 32(4)).