Which products are critical under the CRA?

Critical products are products with digital elements whose cybersecurity risk sits at the highest tier under the EU Cyber Resilience Act. Annex IV lists these products across 3 categories. The CRA classification structure has four tiers. Default class products form the baseline. Important Class I and Important Class II products sit in Annex III. Critical products sit in Annex IV above all other tiers.

Article 8 and Article 32 govern critical products. The classification determines the conformity assessment route. Commission Implementing Regulation (EU) 2025/2392 provides the technical descriptions for the categories. The Commission may amend Annex IV by delegated act under Article 8.

Annex IV lists 3 categories.

• Hardware Devices with Security Boxes.
• Smart meter gateways within smart metering systems as defined in Article 2, point (23) of Directive (EU) 2019/944 and other devices for advanced security purposes, including for secure cryptoprocessing.
• Smartcards or similar devices, including secure elements.

These categories cover dedicated security hardware and critical infrastructure interfaces. Products in these categories store sensitive credentials, process cryptographic operations, or control critical data flows.

Module A self-assessment is unavailable for critical products in every case. Article 32(4) and Article 8(1) establish the mandatory conformity assessment routes.

Where the European Commission adopts a delegated act under Article 8(1), manufacturers must demonstrate conformity through a European cybersecurity certification scheme. The required assurance level is at least substantial.

Where no Article 8(1) delegated act applies, Article 32(4) directs manufacturers to the assessment procedures specified for Important Class II products. These routes include EU-type examination plus conformity to type (Module B and Module C), full quality assurance (Module H), or an applicable European cybersecurity certification scheme at assurance level at least substantial. A notified body or accredited certification body must evaluate the product.

Classification depends on the core functionality of the product. The technical descriptions in Commission Implementing Regulation (EU) 2025/2392 govern the scope.

• Physical envelope. Hardware devices with security boxes require physical envelopes that provide tamper detection, tamper resistance, or tamper response.
• Gateways versus meters. The smart meter gateway category covers the communication gateway rather than the basic meter itself. Classifying a standard utility meter as a critical product is an expensive error.
• Secure elements versus host devices. The smartcard and secure element category covers the secure controller or chip. A host product that merely contains a secure element needs its own classification assessment.