Important Products with Digital Elements — Class I and Class II Classification

The CRA classifies products into three risk tiers, each with different conformity assessment requirements:

If your product is listed in Annex III, you cannot self-certify CRA compliance. You must engage an EU notified body to audit your technical documentation and security processes.

Class I covers important products that have significant cybersecurity implications but where existing security standards or market maturity provide some assurance baseline. Class I products include:

• Identity and access management software — Password managers, identity providers, authentication software
• Browsers — Standalone web browsers
• Password managers — Software designed primarily to store and manage credentials
• Malware detection software — Anti-virus and endpoint security products
• VPN products — Virtual private network client and server software
• Network management tools — Products managing network devices and configurations
• SIEM systems — Security information and event management software
• Boot managers — Secure boot and firmware management tools
• Public key infrastructure — Certificate management and PKI software
• Network monitoring tools — Intrusion detection and network traffic analysis products

For Class I, the manufacturer may use a harmonised standard route: demonstrate conformity with an approved European standard (EN/ISO) and the notified body reviews the technical documentation.

Class II covers important products where a compromise would have more severe consequences, often affecting critical infrastructure or large populations. Class II products include:

• Hypervisors and container runtime environments — Products managing virtualised workloads
• Hardware firewalls — Standalone network security appliances
• Tamper-resistant microprocessors — Secure elements, HSMs, TPMs
• Industrial automation and control — Smart meters, SCADA systems (subject to other directives)
• Routers and modems for industrial use — Industrial-grade networking equipment
• General-purpose microprocessors — CPUs used in security-relevant contexts

For Class II, the manufacturer must also submit to a notified body EU type-examination — a more rigorous third-party review of both the product and the conformity assessment process.

Determining Annex III classification requires careful analysis:

1. Read the Annex III text — The classification is based on product function, not product name. A 'router' sold to consumers may be Default class; the same router marketed for industrial SCADA use may be Class II.

1. Check the intended use — The classification often depends on the primary use case and typical deployment environment.

1. Review draft delegated acts — The European Commission may add products to Annex III via delegated regulation. Monitor ENISA and Commission publications for updates.

1. Seek legal counsel — For borderline cases, the product classification has significant commercial implications (mandatory third-party audit costs, delays to market). Professional legal and technical advice is recommended.

• Module B + C: Notified body reviews technical documentation (Module B) + manufacturer declares conformity to assessed type (Module C)
• Module H: Full quality assurance — notified body audits the manufacturer's quality management system

• Module B + C with more detailed notified body examination
• The notified body must perform additional testing or examination of the product itself

In all cases, the CE marking declaration of conformity must reference the Annex III classification and the notified body's involvement.

Notified bodies for CRA conformity assessment are designated by EU member state accreditation bodies and listed in the NANDO database (New Approach Notified and Designated Organisations).

• Ensure they are notified specifically for CRA assessment (designations will expand as September 2026 approaches)
• Check their experience with your product category
• Factor in lead times — notified bodies are expected to face significant demand backlogs before the September 2026 deadline

Early engagement with a notified body is strongly recommended for Annex III manufacturers.