Three tiers of risk: default category to critical
The CRA sorts products with digital elements into distinct CRA product categories that decide how conformity is proven. The default category covers products appearing in neither Annex III nor Annex IV and permits internal control (Module A self-assessment). Important products are listed in Annex III and split into Class I (e.g. identity management systems, password managers, routers) and higher-risk Class II. Critical products are listed in Annex IV and require a European cybersecurity certification scheme or third-party assessment. The classification drives the entire compliance path, making accurate classification essential.
Annex III important products and management systems
Annex III Class I holds 19 CRA product categories, among them password managers, network management systems, SIEM systems, operating systems, routers and switches, smart-home security products such as smart locks and cameras, and internet-connected toys. Class II holds four higher-risk categories: hypervisors and container runtimes, firewalls and intrusion detection or prevention systems, and tamper-resistant microprocessors and microcontrollers. Class II always involves third-party assessment bodies, while Class I can self-assess only once cited harmonised standards exist.
Annex IV critical products and devices including secure elements
Annex IV names critical products and devices including secure elements, hardware security modules (HSMs), smart meter gateways, and tamper-resistant microcontrollers for advanced security purposes. These carry the strictest third-party certification route. Classification always follows the product's function rather than its marketing name: a general-purpose microcontroller belongs in the default category, while the same device engineered for security-related functions lands in Annex III Class I or Annex IV. Accredited notified bodies that assess these devices are registered in the European Commission NANDO database.
Classify by what the product does, not what it is called. Function decides the CRA classification tier, and the tier decides the conformity route.