CRA classification by product type.
The class decides whether you can self-assess or need a notified body. It depends on the core function of your product, as described in Implementing Regulation (EU) 2025/2392, not on the sector or on the components inside it.
Product type, class and legal basis.
| Product type | Class | Where it is listed |
|---|---|---|
| Are Firewalls Class II | Class II | Annex III, Class II, point 2 |
| Are Routers Class I | Class I | Annex III, Class I, point 12 |
| Are Smart Locks and Security Cameras Class I | Class I | Annex III, Class I, point 17 |
| Is a Connected Toy Class I or Default | Class I or default | Annex III, Class I, point 18 |
| Are Smartwatches and Wearables Class I | Class I or default | Annex III, Class I, point 19 |
| Are VPNs, Antivirus and Operating Systems Class I | Class I | Annex III, Class I, points 3, 4, 5 and 11 |
| Is a Microcontroller Class I, II or Critical | Default to critical | Annex III points 13 to 15, Class II 3 and 4, Annex IV 3 |
| Is an IoT Gateway Class I, Class II or Default | Usually default | Depends on core function |
| Is a PLC Class II | Usually default | Not listed in the final text |
| Are Smart Meter Gateways Critical Products | Critical | Annex IV, point 2 |
One page per product type.
Are Firewalls Class II Under the CRA? Firewalls, IDS, IPS and WAFs
Firewalls, intrusion detection and prevention systems are Class II important products under the Cyber Resilience Act. What counts, what does not, and why self-assessment is not an option.
Are Routers Class I Under the CRA? Routers, Modems and Switches
Routers, internet modems and managed switches are Class I important products under the Cyber Resilience Act. What counts, what stays out, and when self-assessment is possible.
Are Smart Locks and Security Cameras Class I Under the CRA?
Smart door locks, home security cameras, baby monitors and alarm systems are Class I important products under the Cyber Resilience Act, and so are the hubs and apps that control them. What counts and what does not.
Is a Connected Toy Class I or Default Under the CRA?
Internet connected toys that talk, film or track location are Class I important products under the Cyber Resilience Act. Which smart toys qualify, which stay default, and where children's wearables fit.
Are Smartwatches and Wearables Class I Under the CRA?
Wearables with a health monitoring purpose and wearables for children under 14 are Class I important products under the Cyber Resilience Act. What counts, where medical devices fall, and the grey areas.
Are VPNs, Antivirus and Operating Systems Class I Under the CRA?
VPN products, password managers, antimalware software and operating systems are Class I important products under the Cyber Resilience Act. What counts, what does not, and how SaaS and open source fit.
Is a Microcontroller Class I, II or Critical Under the CRA?
Microcontrollers and microprocessors can be default, Class I, Class II or critical products under the Cyber Resilience Act. How security functions and AVA_VAN levels decide the class, and what device makers inherit.
Is an IoT Gateway Class I, Class II or Default Under the CRA?
There is no IoT gateway category in the Cyber Resilience Act. How to classify a gateway by its core function, with the official technical descriptions of Regulation (EU) 2025/2392.
Is a PLC Class II Under the CRA? PLCs, SCADA and HMIs
PLCs, SCADA systems and HMIs are not listed in Annex III or IV of the Cyber Resilience Act. Why many tools still say Class II, and when an industrial product does move up a class.
Are Smart Meter Gateways Critical Products Under the CRA?
Smart meter gateways are critical products in Annex IV of the Cyber Resilience Act. What the official description covers, including gas and heat, what it leaves out, and which conformity route applies.
Not on the list?
Classify your own product by its core function in Regulus. Free for manufacturers, with the exact Annex III or IV reference.