FOSSA: CRA Product Classification Explained

What it is

A FOSSA blog post explaining how to classify a "product with digital elements" under the EU Cyber Resilience Act (CRA) into one of four compliance tiers, and what conformity path each tier forces. The page states CRA requirements begin September 2026 with full compliance mandated December 2027. It names the specific product categories the regulation lists in Annex III (Important, Class I and II) and Annex IV (Critical).

How it works

Classification is the gate that determines your conformity assessment route, and getting it wrong means either over-engineering or — worse — self-assessing a product that legally required an independent audit. The tiers:

• Default — self-assessment (internal control) against Annex I. Covers most products: business software, web apps, games, most smart appliances.
• Important Class I (Annex III) — self-assessment only if you fully apply harmonised standards, common specifications, or a European cybersecurity certification; otherwise third-party assessment. Includes browsers, password managers, VPNs, operating systems, routers/modems/switches, SIEMs, identity/PAM systems, boot managers, PKI software, smart door locks/cameras/baby monitors, internet-connected toys with social or location features.
• Important Class II (Annex III) — always requires third-party assessment by a notified body; harmonised standards do not unlock self-assessment. Four categories: hypervisors/container runtimes, firewalls/IDS/IPS, tamper-resistant microprocessors, tamper-resistant microcontrollers.
• Critical (Annex IV) — systemic-importance products (page truncated: hardware devices with security boxes, smart meter gateways).

Preconditions / Affected

Applies to hardware or software made available on the EU market commercially. Out of scope: pure SaaS/cloud (regulated under NIS2 instead — but a manufacturer's remote data processing back-end is in scope), medical devices (MDR/IVDR), civil aviation, motor vehicles, marine equipment, national-security/defence products, spare parts, and non-commercial open source. Note: integrating OSS into a commercial product makes SBOM and due-diligence obligations yours as manufacturer.

What to do

Confirm scope first, then classify against the Annex III / IV lists above. The actionable catch: the harmonised-standards self-assessment path for Class I is not currently available — as of the post's writing, final CRA harmonised standards had not been published in the EU Official Journal (drafts are open for comment). So a Class I product cannot presently self-assess via that route and must plan for third-party assessment lead time ahead of December 2027.

flowchart TD
  A[Product with digital elements on EU market] --> B{In scope?}
  B -->|SaaS/MDR/vehicles/defence/non-commercial OSS| X[Out of scope]
  B -->|Yes| C{Core function in Annex III/IV?}
  C -->|No| D[Default: self-assess]
  C -->|Class I| E{Harmonised standards applied?}
  E -->|Yes, but not yet published| F[Third-party required for now]
  E -->|No| F
  C -->|Class II| G[Third-party notified body — always]
  C -->|Critical Annex IV| G

Caveats

The page text is truncated mid-list in the Critical/Annex IV section, so that category's full contents are incomplete here. Dates and the standards-availability status are as stated in the post.