CRA product classification — default, important and critical
Classification follows scope and the product's core functionality. Annex III contains important Class I and Class II products; Annex IV covers critical products.
Start with the whole product
Compare the product's core functionality with the legal category descriptions, including Implementing Regulation (EU) 2025/2392. An embedded security component does not automatically determine the classification of the final product.
Examples and routes
Browsers, password managers, VPN products and specified smart-home security products appear in Class I categories. Firewalls and intrusion detection/prevention systems appear in Class II. Secure-element and smartcard categories require examination of Annex IV. These are category examples, not a classification of your product.
Keep the decision trace
Retain the product boundary, functional mapping, category interpretation and reviewer. Default products generally have Module A available; Class I self-assessment is conditional, and stricter categories need the applicable third-party or qualifying certification route.
Next steps
Official sources and review context
Regulation (EU) 2024/2847 · European Commission · ENISA SRP
CRA-I18N-2026-10-14-DRAFT-4
Operational tools and retained records. No legal opinion, conformity assessment, certification or confirmation of CRA compliance is generated.