Default Class Product (CRA)
Default Class products are the baseline category under the EU Cyber Resilience Act — products with digital elements that do not fall into the Important Class I or Class II elevated risk classifications. The vast majority of consumer and commercial connected products are Default Class. Manufacturers may self-certify conformity through an internal control procedure.
Default Class products are the baseline category under the EU Cyber Resilience Act — products with digital elements that do not fall into the Important Class I or Class II elevated risk classifications. The vast majority of consumer and commercial connected products are Default Class. Manufacturers may self-certify conformity through an internal control procedure.
CRA Legal TermsWhat Is a Default Class Product?
Under the EU Cyber Resilience Act's three-tier classification system, Default Class is the baseline category applied to all products with digital elements that are not explicitly listed in Annex III as Important Class I or Class II. Default Class covers the widest range of connected products — consumer smart home devices, general-purpose IoT sensors, connected toys, wearables, smart appliances, and a broad range of commercial software products. Despite the 'default' label suggesting a low-risk designation, these products must still comply with all of the CRA's essential cybersecurity requirements in Annex I; the classification only affects the conformity assessment pathway.
Conformity Assessment for Default Class Products
Manufacturers of Default Class products may use the internal control procedure (Module A under Annex VI) to self-certify conformity with the CRA's essential requirements. This means the manufacturer conducts its own assessment against Annex I requirements, produces technical documentation, issues a Declaration of Conformity, and affixes the CE marking — all without mandatory third-party notified body involvement. However, self-certification does not mean self-exemption: the manufacturer must still perform a genuine assessment, maintain documentation, and be able to demonstrate compliance to market surveillance authorities if challenged. The internal control route requires intellectual honesty, not a rubber-stamp exercise.
Substantive Obligations That Apply to All Default Class Products
Regardless of the simplified conformity pathway, Default Class manufacturers must: conduct and document a cybersecurity risk assessment; implement all Annex I essential cybersecurity requirements (including unique default passwords, attack surface minimisation, secure update mechanisms, and vulnerability handling); establish a coordinated vulnerability disclosure process with a published contact and policy; provide security updates for the full support period (minimum five years); generate and maintain an SBOM; and issue a Declaration of Conformity with complete and accurate information. Failure to meet any of these obligations exposes the manufacturer to enforcement action regardless of class, as market surveillance authorities are empowered to investigate all CE-marked products.
Common Mistakes
The most common Default Class error is conflating 'I can self-certify' with 'compliance is simple'. Self-certification means the manufacturer accepts full responsibility for the conformity assessment — it does not reduce the substantive requirements. Manufacturers who produce a cursory self-assessment and affix the CE marking without genuine compliance are committing the same violations as any non-compliant manufacturer, with the added problem that they have formally declared conformity. A second error is failing to review the Annex III list carefully: products that include security-critical functions (e.g. identity management features embedded in a consumer device) may qualify as Important Class I even if the overall product category seems generic.
CVD Portal makes Default Class Product (CRA) compliance straightforward.
Public CVD submission portal, acknowledgment tracking, Article 14 deadline alerts, and CSAF advisory generation. Free forever for EU manufacturers.
Start your free portalFrequently asked
Do Default Class products need to meet the same security requirements as Important Class products?+
Yes. The classification system affects the conformity assessment pathway — how a manufacturer proves compliance — not the substantive security requirements. All products with digital elements covered by the CRA must comply with the full set of essential cybersecurity requirements in Annex I, regardless of class. Default Class products have a simpler self-certification route, but must still implement all required security controls.
How does a manufacturer determine if their product is Default Class?+
Default Class is a residual category — a product is Default Class if and only if it is not listed in Annex III Part I (Important Class I) or Part II (Important Class II). Manufacturers should carefully review both parts of Annex III, paying attention to the product descriptions rather than just the category headings. If a product incorporates components or functions that appear in Annex III (e.g. identity management functionality), the entire product or the relevant component may need to be assessed at the Important Class level.
Can a Default Class manufacturer choose to use a notified body even when it is not required?+
Yes. Manufacturers may voluntarily engage a notified body for a third-party assessment of their Default Class product, even when only internal control is required. This is a reasonable commercial decision for manufacturers selling into regulated sectors where customers demand independent certification, or where the product's impact warrants higher assurance. Voluntary third-party assessment can also reduce regulatory risk if a market surveillance authority later investigates the manufacturer's conformity claims.
Related terms
CRA articles using this term
Browse the full CRA Compliance Checklist
See how Default Class Product (CRA) fits into your complete CRA compliance programme.