CRA Product Classification: Default, Important, and Critical Categories Explained

Not all products face the same CRA requirements. The regulation establishes a tiered classification system based on cybersecurity risk. Understanding where your products fall is the first step toward compliance.

Default Category (~90% of Products)

Most products with digital elements fall into the default category. These products can undergo self-assessment — the manufacturer evaluates conformity internally, documents it, and applies the CE marking.

Examples: smart toys, photo editing software, smart speakers, connected appliances.

Important Products — Class I

Products whose cybersecurity vulnerabilities could have significant impact. Conformity assessment requires either:

• Application of harmonized standards (when available), OR
• Third-party assessment by a notified body

ETSI TC Cyber WG EUSR is developing 18 vertical standards (EN 304 617–642) covering Class I and II products specifically.

Examples: browsers (EN 304 617), password managers (EN 304 618), VPNs (EN 304 620), network management systems (EN 304 621), antivirus software (EN 304 619), operating systems (EN 304 626).

Important Products — Class II

Higher-risk products requiring mandatory third-party assessment. No self-assessment path available.

Examples: hypervisors and container runtimes (EN 304 635), firewalls and IDS/IPS (EN 304 636), public key infrastructure (EN 304 624), SIEM systems (EN 304 622).

Critical Products

The highest tier. Requires European cybersecurity certification under an EU scheme (when available).

Examples: hardware security modules, smart meter gateways, network functions of telecommunications systems (EN 304 642).

How to Classify Your Product

Start by mapping your product's functionality against Annex III and IV of the CRA. Consider: Does it handle authentication? Does it process network traffic? Does it manage other devices? The more security-critical the function, the higher the classification.