Which CRA product class is my product in?

Article 7(1) is the operative rule for important products. Products with digital elements which have the core functionality of a product category set out in Annex III are important products and are subject to the conformity assessment procedures in Article 32(2) and (3).^[1] Article 8(1) does the equivalent job for the Annex IV critical categories.^[2]

Core functionality means the main features and technical capabilities without which the product could not meet its intended purpose. A product has one core functionality for classification purposes, and Commission guidance C(2026) 5252 expects it to be identified in the technical documentation.^[5]

This is why the product name decides nothing. A general-purpose microcontroller is a default product. The same part shipped with security-related functionality is Annex III class I. A tamper-resistant version of it is class II. The marketing name can stay identical across all three.

This is settled in the Regulation itself rather than only in guidance, and it is the single most useful sentence in Article 7 for a manufacturer building on components. The second sentence of Article 7(1) states that the integration of a product with digital elements which has the core functionality of an Annex III category shall not in itself render the product in which it is integrated subject to the Article 32(2) and (3) procedures.^[1]

A smartphone containing an operating system does not thereby acquire the core functionality of an operating system. A machine containing a firewall module does not become a class II product because of it.

The qualification is worth reading closely. Where a manufacturer also offers modules of an integrated product separately, for separate purchase, licensing or subscription, guidance treats each module as assessed on its own.^[5] Selling the component as a product puts the component in its own category, whatever the host product is.

Article 32 sets four routes: internal control based on module A, EU-type examination based on module B followed by conformity to type based on module C, full quality assurance based on module H, and where available and applicable a European cybersecurity certification scheme under Article 27(9).^[3]

A default product may use any of them, which in practice means module A.

For an Annex III class I product, Article 32(2) is conditional rather than absolute. Where the manufacturer has not applied, or has applied only in part, harmonised standards, common specifications or European cybersecurity certification schemes at assurance level at least substantial, or where those do not exist, the product must go to module B plus C or to module H. Complete coverage keeps module A available.^[3]

For an Annex III class II product, Article 32(3) removes module A in every case. The routes are B plus C, H, or a certification scheme at assurance level at least substantial.^[3]

For an Annex IV critical product, Article 32(4) requires a European cybersecurity certification scheme in accordance with Article 8(1), and where the Article 8(1) conditions are not met, any of the Article 32(3) procedures.^[3][2]

Conformity is due when the Regulation applies in full on 11 December 2027.^[4] For a default product that date is a deadline for finishing your own documentation. For a class II or critical product it is a deadline for finishing a notified body's queue, and third-party assessment schedules are measured in quarters rather than weeks.

That asymmetry is why classification comes first in any sensible sequence. Every other stage can proceed in parallel once it is settled, and none of them can be scheduled sensibly before it.

One timing detail supports early engagement. Under Article 71(2) the notified body provisions in Chapter IV, Articles 35 to 51, applied from 11 June 2026, well ahead of the rest of the Regulation, precisely so that the assessment infrastructure exists before manufacturers need it.^[4]