CRA product classes: default, important I/II, critical — with examples

Not every product with digital elements is assessed with the same rigour. The Cyber Resilience Act sorts them into four levels by risk, and yours determines whether you assess conformity yourself or need a third party. Good news for most small companies: you're probably in the mildest one. Let's walk through it.

Default — most products

If your product is not in any of the special categories (Annex III or IV), it belongs to the default class. That's most ordinary software and devices: an accounting app, an e-shop plugin, a mobile app, the firmware of a common appliance. For the default class, self-assessment under Module A applies — you declare conformity yourself on the basis of your own technical documentation, with no notified body. What belongs in that documentation is covered in the self-assessment and Annex VII article.

Important class I (Annex III)

"Important" products perform a more sensitive security function, so the bar is higher. Class I includes, for example:

1. password managers and tools for identity and privileged-access management,
2. standalone and embedded browsers,
3. antimalware, VPNs, network management systems (NMS) and SIEM,
4. operating systems, boot managers, PKI and certificate issuance,
5. routers, modems intended for the connection to the internet, and switches, physical and virtual network interfaces,
6. microprocessors and microcontrollers with security functions,
7. smart home devices with a security function (locks, cameras, alarms, baby monitors), voice assistants, connected toys with social/location features, and health-monitoring wearables,
8. ASICs and FPGAs with a security function.

For class I, self-assessment is possible only with full application of harmonised standards or common specifications — or if the product holds a certificate under a European cybersecurity certification scheme at assurance level at least "substantial" (Art. 32(2)). The harmonised standards aren't out yet (more in the article on late standards), so until then a notified-body assessment is generally expected for class I.

Important class II (Annex III)

Class II is more sensitive still, and self-assessment is not enough — a notified-body assessment is required (Module B+C or H). It includes, for example:

1. hypervisors and container runtimes (virtualisation technologies),
2. firewalls, intrusion detection and prevention systems (IDS/IPS),
3. tamper-resistant microprocessors and microcontrollers.

Critical (Annex IV)

The top level. A delegated act (Art. 8) may make Critical products subject to a mandatory European cybersecurity certification scheme adopted under Regulation (EU) 2019/881 (the Cybersecurity Act), at assurance level at least "substantial"; until then a third-party assessment is expected. It's a narrow group:

1. hardware devices with a security box,
2. smart meter gateways,
3. smartcards and secure elements.

Classification examples

To make it tangible, a few typical products:

1. An invoicing desktop app → not in Annex III or IV → default, self-assessment.
2. A password manager → Annex III class I → important I (self-assessment only with full application of standards, otherwise a notified body).
3. A firewall or IDS/IPS → Annex III class II → important II, notified-body assessment.
4. A smartcard / secure element → Annex IV → critical, European certification once the delegated act (Art. 8) is issued.

What happens when categories combine

If a product falls into several categories at once, a simple rule applies: the stricter one wins. Examples:

1. A product matches both class I and class II → treated as class II (stricter).
2. A product is in class II and in Annex IV → treated as critical.

The logic is obvious: you can't "hide" in a milder regime just because the product also fits a less strict category.

How to find where you belong

The order is simple: if you can't find your product in Annex III or IV, you're default. If it matches a category in Annex III, you're important I or II; if Annex IV, you're critical. When several categories combine, the stricter one wins. This is exactly the logic in our scope-checker — you select the categories and it tells you the class and what follows for conformity assessment.

FAQ

1. How do I know if I'm "important"? Compare your product against the category list in Annex III. If you're not there or in Annex IV, you're default.
2. Is an operating system really important? Yes, an OS is in Annex III class I — along with browsers, VPNs, password managers and others.
3. Does the class change anything about Article 14 reporting? No. Reporting from 11 September 2026 applies regardless of class; the class changes how conformity is assessed.
4. We're on the edge of two categories — which applies? The stricter one (I + II → II; II + critical → critical).

Why it's good to know your class early

The class determines how much "paperwork" and whose help you'll need — and that's worth knowing sooner rather than later. Most small companies end up in the default class, where the whole process is in their hands (self-assessment). But if you find you're important or critical, plan for a notified body or certification and a longer timeline — and note that for important I, when the harmonised standards appear will matter.

Bottom line

The CRA sorts products into four risk levels, and yours determines whether you self-assess or need a third party. Default (most ordinary software): self-assessment under Module A. Important class I (Annex III — e.g. OS, browsers, VPNs, password managers): self-assessment only with full application of harmonised standards, otherwise a notified body. Important class II (e.g. firewalls, hypervisors): a notified body always. Critical (Annex IV — e.g. smartcards, secure elements): European certification. The classification is simple: if your product isn't in Annex III or IV, you're default; when categories combine, the stricter wins. The good news for small companies is that the vast majority land in the default class, where the whole process is in their hands. Knowing your class early pays off — it sets how much paperwork and whose signature you'll need, and with how much lead time.

Key point

The CRA sorts products into four levels by risk, and yours decides whether you assess conformity yourself or need a third party. Default (most ordinary software): self-assessment under Module A. Important class I (Annex III — e.g. OS, browsers, VPNs, password managers): self-assessment only with full application of harmonised standards (or a certificate under a scheme at level at least "substantial", Art. 32(2)), otherwise a notified body. Important class II (e.g. firewalls, hypervisors): a notified body always. Critical (Annex IV — e.g. smartcards, secure elements): European certification. The routing is simple: if you don't find your product in Annex III or IV, you're default; when categories combine, the stricter one governs. The good news for small firms is that the vast majority land in the default class, where the whole process is in their hands. Knowing your class early pays off — it determines how much paperwork and whose signature you'll need, and how far in advance.

How CRAguard helps

CRAguard's scope-checker determines your class and links it to the next steps — from an SBOM through a reporting channel to the inputs for conformity assessment. Most small companies end up in the default class, where the whole process is in their hands and we can simplify it as much as possible. Find out whether the CRA applies to you, or join the waitlist.

This article is informational and not legal advice. It is based on Regulation (EU) 2024/2847 (Annex III and IV, conformity assessment modules) and the European Commission's guidance of 27 July 2026. Consult a professional on the exact classification of borderline products.