Manufacturers preparing for the CRA keep asking one question: is our product type A or type B? The regulation does not use those letters, and it has four outcomes, not two. More importantly, the answer is rarely found by reading the list of product categories. It is found with one test that the list depends on, and most of the expensive mistakes happen when teams skip it.
Four outcomes, not two
| Class | Where it is defined | Typical examples | Who checks conformity |
|---|---|---|---|
| Default | Every product not listed in Annex III or IV | Smart thermostat, connected coffee machine, most apps and industrial sensors | You, by self-assessment (Module A) |
| Important, Class I | Annex III, 19 categories | Operating systems, routers and switches, password managers, VPNs, smart locks and home cameras, microcontrollers with security functions | You, but only if harmonised standards or an equivalent are applied in full; otherwise a notified body |
| Important, Class II | Annex III, 4 categories | Hypervisors and container runtimes, firewalls and intrusion detection or prevention systems, tamper-resistant microcontrollers and microprocessors | A notified body, or a European cybersecurity certificate at level "substantial" |
| Critical | Annex IV, 3 categories | Hardware devices with security boxes (payment terminals, HSMs, tachographs), smart meter gateways, smartcards and secure elements | European certification where the Commission requires it; until then the Class II routes |
When it proposed the CRA, the Commission estimated that about nine in ten products would fall into the default class. If your product is in the other tenth, the class decides who checks your work and how early you need to book them.
The test that decides: core functionality
A product is important or critical only if its core functionality matches a category in Annex III or IV (Article 7(1), Article 8(1)). Core functionality means what the product is fundamentally for: the features without which it would not meet its intended purpose. Functions on the side do not change the class, and neither do the components built into it.
The CRA says so itself (Article 7(1)), and both the Commission's Implementing Regulation (EU) 2025/2392, in force since 21 December 2025, and the Commission's non-binding guidance, approved as a draft in July 2026, repeat it: integrating an important or critical component does not, by itself, make the whole product important or critical. A smartphone runs an operating system, but it is not an operating system in the sense of the CRA.
Three examples show how far this goes:
- A dedicated firewall appliance is for firewalling. Class II.
- A home router with a built-in firewall is for routing. The firewall is a feature. Class I, as a router.
- A washing machine whose microcontroller has secure key storage is for washing clothes. Default, even though the chip on its own would be Class I.
The guidance also closes the obvious loophole: you cannot avoid a stricter class by describing the product's capabilities as smaller than they are. What your product page, manual and technical documentation say it is for is the evidence an authority will read.
Four questions, in this order
- Is the product in scope at all? Medical and in vitro diagnostic devices, type-approved vehicles, products certified under EU aviation rules, marine equipment and products developed only for national security or defence are among those outside the CRA (Article 2). Classify only what is in scope.
- What is it for, in one sentence? Write the core functionality the way your intended purpose, marketing and user information describe it. The guidance asks for a single core functionality, identified in the technical documentation.
- Does that sentence match one of the 26 categories? Read Annex III and IV together with the technical descriptions in Implementing Regulation 2025/2392. The descriptions are narrower and more practical than the category names. "Smart home products with security functionalities", for example, means products that protect the physical security of people at home: locks, cameras, baby monitors, alarm systems. A thermostat is not one of them.
- Do you also sell a part of it on its own? A component placed on the market separately is classified on its own core functionality. If you sell your Wi-Fi module to other manufacturers, it is a physical network interface (Class I) in that sale, even though the finished product that uses it may be default.
Borderline cases worth knowing
| Product | Class | Why |
|---|---|---|
| Smart thermostat or heat pump controller | Default | Its purpose is comfort and energy, not the physical security of the home |
| Smart door lock, home security camera, baby monitor | Class I | Named in the description of smart home products with security functionalities |
| Toy that talks or films over the internet | Class I | Internet-connected toy with social interactive features |
| Toy that only senses when another toy is near | Default | The implementing regulation says proximity detection is not location tracking |
| Fitness band that monitors heart rate | Class I | Personal wearable with a health monitoring purpose, unless it is a medical device, which falls outside the CRA |
| Wi-Fi or Bluetooth module sold to other manufacturers | Class I | Physical network interface placed on the market on its own |
| Industrial Ethernet switch with a management interface | Class I | Switch with a management plane |
| Microcontroller with encryption and secure key storage | Class I | Microcontroller with security-related functionalities |
| Tamper-resistant microcontroller | Class II | Listed separately in Class II |
| Secure element or TPM | Critical | Annex IV, designed for protection of at least AVA_VAN.4 |
| Payment terminal or hardware security module | Critical | Hardware device with a security box |
When a case is still unclear after the technical description, write down both readings and why you chose one. An authority can disagree with your conclusion; it should not find that you never asked the question.
The part most teams miss: Class I without standards means a notified body
Many teams relax when they land in Class I, because they have heard that Class I can self-assess. That is only half the rule. Self-assessment (Module A) is allowed for Class I only where you apply, in full, harmonised standards cited in the Official Journal, common specifications, or a European cybersecurity certification scheme at level "substantial" (Article 32(2)). If you apply them only in part, or not at all, you need a notified body: EU-type examination with conformity to type (Modules B and C), or full quality assurance (Module H).
As of October 2026, no CRA harmonised standard has been cited in the Official Journal. The product-specific standards for important and critical products are now expected by 31 December 2026, after the Commission proposed a later deadline in July 2026, and citation in the Official Journal follows only after that. The main obligations apply from 11 December 2027. Notified bodies could be designated from 11 June 2026, and there will not be many of them at first.
So a Class I manufacturer should plan two routes at once: Module A if the standards arrive in time and you can apply them fully, and a notified body if they do not. Booking that notified body is the step that cannot wait until 2027.
For the other classes the rule is simpler. Class II always needs a notified body or a certificate at level "substantial" (Article 32(3)). Critical products need a European certificate where a delegated act requires one; until then they follow the Class II routes (Article 8(1), Article 32(4)). One exception applies to all important products: free and open-source software may use Module A if its technical documentation is public (Article 32(5)).
What the class does not change
The class changes who checks your product. It does not change what you must do. The essential requirements in Annex I, the risk assessment, vulnerability handling for the whole support period, the SBOM and the Article 14 reporting obligations, which have applied since 11 September 2026, are the same for a default smart plug and a Class II firewall. A default classification is not a lighter workload; it is the same workload that you sign off yourself.
Write the decision down
Your classification is part of the technical documentation, and it is often the first page an authority or a notified body reads. Record:
- the core functionality, in one sentence;
- the Annex III or IV category you compared it with, and the description in Implementing Regulation 2025/2392 you checked;
- the result and the conformity route that follows;
- who decided and when;
- what would make you look again: a new main feature, a component you start selling separately, a harmonised standard cited in the Official Journal, or a delegated act that changes Annex III. The Commission can add or move categories, normally with at least 12 months' notice (Article 7(3)).
A short checklist
- Confirm the product is in scope.
- Write its core functionality in one sentence that matches your marketing and manual.
- Compare it with the 26 categories, using the technical descriptions in Implementing Regulation 2025/2392.
- Classify any component you sell on its own separately.
- If the result is Class I, plan both Module A and a notified body route, and contact notified bodies now.
- Record the decision and the reasons in the technical documentation, and set the triggers for a review.
This article explains Regulation (EU) 2024/2847 in plain words. It is not legal advice.