CRA product classes: default, important and critical

The Cyber Resilience Act (CRA) sorts products into four groups: default, important class I, important class II and critical. Your group decides how you prove the product meets the rules. Most connected products are default and you assess them yourselves; class II and critical products always need an outside body or a certification (Article 32). The lists are in Annex III (important) and Annex IV (critical).

How a product lands in a class

What counts is the product's core functionality. A product whose core functionality matches a category in Annex III is an important product (Article 7(1)).

Integrating such a part doesn't move your product up by itself. The same article says that putting, say, a component with the core functionality of an Annex III category inside your product doesn't make your whole product subject to the stricter procedures. The Commission's Implementing Regulation (EU) 2025/2392 gives an example: a news app with an embedded browser isn't treated as a browser. You still have to show the whole product is secure, embedded parts included.

That implementing regulation, adopted on 28 November 2025, holds the technical description of every category. When a category name is vague, read its description there.

Important products, class I (Annex III)

Point	Category
1	Identity management and privileged access management software and hardware, including authentication and access control readers, biometric readers included
2	Standalone and embedded browsers
3	Password managers
4	Software that searches for, removes or quarantines malicious software
5	Products with a VPN function
6	Network management systems
7	Security information and event management (SIEM) systems
8	Boot managers
9	Public key infrastructure and digital certificate issuance software
10	Physical and virtual network interfaces
11	Operating systems
12	Routers, modems intended for connecting to the internet, and switches
13	Microprocessors with security-related functions
14	Microcontrollers with security-related functions
15	ASICs and FPGAs with security-related functions
16	Smart home general purpose virtual assistants
17	Smart home products with security functions, including smart door locks, security cameras, baby monitors and alarm systems
18	Internet-connected toys with social interactive features (such as speaking or filming) or location tracking
19	Personal wearables with a health monitoring purpose that aren't medical devices, and wearables for children

For device makers, points 12, 17, 18 and 19 are the ones that come up most. The implementing regulation narrows some of them. A toy that only senses how close the user or another toy is doesn't count as having location tracking, for example, and "for children" in point 19 means under 14.

Important products, class II (Annex III)

Point	Category
1	Hypervisors and container runtime systems that support virtualised execution of operating systems
2	Firewalls, and intrusion detection and prevention systems
3	Tamper-resistant microprocessors
4	Tamper-resistant microcontrollers

Critical products (Annex IV)

Point	Category
1	Hardware devices with security boxes
2	Smart meter gateways within smart metering systems, and other devices for advanced security purposes, including secure cryptoprocessing
3	Smartcards or similar devices, including secure elements

What each class means for you

Class	How you show conformity	Source
Default	Internal control (module A): you assess the product yourselves	Article 32(1)
Important, class I	Module A only if you apply harmonised standards, common specifications or a certification scheme at level "substantial" in full; otherwise a notified body through module B with C, or module H	Article 32(2)
Important, class II	Always a notified body (module B with C, or module H), or a European certification scheme at level "substantial"	Article 32(3)
Critical	A European cybersecurity certification where a delegated act requires it; otherwise as class II	Article 32(4), Article 8(1)

A notified body is an independent organisation approved to check products under EU law. Modules are the standard EU assessment procedures, set out in Annex VIII: B is a type examination by the body, C is your production matching that type, and H is the body auditing your whole quality system.

One catch for class I: when we checked on 31 October 2026, no harmonised CRA standard had been cited in the Official Journal. Until one is, the standards route to self-assessment is closed, so ask a notified body early whether any route other than module B with C, or module H, is open to your class I product.

The lists can change

The Commission can add, move or remove categories in Annex III by delegated act. Where a category is added, or moved from class I to class II, the law expects a transition of at least 12 months before the stricter procedure applies, unless urgency justifies less (Article 7(3)). Annex IV can change too (Article 8(2)). Check the lists again before each new product.

Find your likely class

Our free product-class check asks a few yes-or-no questions based on Annex III, Annex IV and Implementing Regulation (EU) 2025/2392. It tells you the class your product is likely in. It can't decide for you. If the answer is class II or critical, plan for a notified body and talk to one early.

What Proofsheet does here

The class check is free. Once you know your likely class, upload one file and the app generates the parts list, known CVEs for exact versions, and a map of the evidence to the 22 Annex I points as evidenced, partial or open. That evidence goes into your technical file whichever route you take. For class II and critical products, a notified body still has to do its own assessment; the generated report is technical evidence, not a legal certificate.

Read next: the declaration of conformity and technical documentation guides.