Are Firewalls Class II Under the CRA? Firewalls, IDS, IPS and WAFs

Short answer: firewalls, intrusion detection systems (IDS) and intrusion prevention systems (IPS) are important products of Class II under the Cyber Resilience Act (Regulation (EU) 2024/2847, Annex III, Class II, point 2). That rules out self-assessment: a notified body has to be involved before the product can carry the CE marking.

What counts as a firewall under the CRA

Since 21 December 2025 the categories in Annexes III and IV have an official technical description, set out in Commission Implementing Regulation (EU) 2025/2392. For this category it says:

• Firewalls protect a connected network or system from unauthorised access by monitoring and restricting traffic to and from it. The category includes network firewalls and application firewalls, naming web application firewalls, filters and anti-spam gateways.
• Intrusion detection systems monitor traffic that has entered the network for suspicious activity and detect that an intrusion has been attempted, is occurring or has occurred. Both network-based and host-based IDS are included.
• Intrusion prevention systems are an IDS that actively responds to the intrusion, again network-based or host-based.

The examples are illustrative, not exhaustive. Hardware appliances, virtual appliances and software firewalls are all products with digital elements, so the form factor does not change the answer.

What does not make a product Class II

The CRA classifies a product by its core functionality (Article 7(1)), and the implementing regulation is explicit about where that leaves products that merely contain a firewall:

• A router with a built-in firewall is a router. Recital 4 uses this exact example. Routers, internet modems and managed switches are Class I (Annex III, Class I, point 12).
• A device that filters its own traffic is not a firewall product. An IoT gateway, a PLC or a camera with a host firewall is classified by what it is for. Integrating a component that matches a category does not move the whole product into it (recital 3).
• Antivirus is a different category. Software whose core function is to search for, remove or quarantine malicious software is Class I (point 4). Host-based intrusion detection or prevention is Class II. Endpoint suites that do both need a reasoned decision on which function is core, and that reasoning belongs in the technical documentation.

The industrial and non-industrial split is gone

The Commission proposal of 2022 put "firewalls intended for industrial use" in Class II and all other firewalls in Class I. The adopted text dropped the distinction: every firewall, IDS and IPS is Class II. Some classification tools and older guides still apply the proposal, and they place consumer firewalls in Class I. That is no longer correct.

What Class II means for conformity assessment

For Class II products, Article 32(3) leaves three routes, all of them involving a third party:

• EU-type examination (module B) by a notified body, followed by conformity to type based on internal production control (module C).
• Full quality assurance (module H), assessed by a notified body.
• A European cybersecurity certificate at assurance level at least "substantial", where a scheme applicable to the product is available.

Applying harmonised standards does not open the self-assessment route here. That option exists only for Class I (Article 32(2)).

Dates that matter for firewall manufacturers

• 11 June 2026: the rules on notified bodies started to apply, so designations are under way.
• 11 September 2026: the reporting obligations of Article 14 apply, including to firewalls already on the market. An actively exploited vulnerability has to be notified within 24 hours.
• 11 December 2027: the essential requirements and the conformity assessment apply to every product placed on the market from that day.

Notified body capacity is expected to be the bottleneck for Class II products. A complete technical file, with the risk assessment and the evidence for each essential requirement, shortens the examination and is what the notified body will ask for first.

Frequently asked questions

Is a next-generation firewall or UTM appliance Class II under the CRA?

Yes, when firewalling is its core function. Additional features such as VPN, antivirus or web filtering do not take it out of the category; Implementing Regulation (EU) 2025/2392 says that performing additional functions does not change the core functionality.

Is a router with a built-in firewall Class II?

No. Recital 4 of Implementing Regulation (EU) 2025/2392 uses exactly this example: a router integrating firewall functionality still has the core functionality of a router. Routers are Class I (Annex III, Class I, point 12).

Is a web application firewall (WAF) covered?

Yes. The technical description of firewalls in Implementing Regulation (EU) 2025/2392 names application firewalls such as web application firewalls, as well as filters and anti-spam gateways.

Are industrial firewalls treated differently?

No. The Commission proposal of 2022 split firewalls into industrial (Class II) and other (Class I). The adopted text dropped that split: all firewalls, IDS and IPS are Class II.

Can I self-assess a firewall if I apply harmonised standards?

No. Self-assessment with harmonised standards is only available for Class I products (Article 32(2)). Class II products need EU-type examination by a notified body followed by conformity to type, full quality assurance, or a European cybersecurity certificate at assurance level substantial where a scheme is available (Article 32(3)).

Does a device with a host firewall, such as iptables on an IoT gateway, become Class II?

No. A product is classified by its core functionality, not by the components it integrates (Article 7(1) and recital 3 of Implementing Regulation (EU) 2025/2392). An IoT device that filters its own traffic is not a firewall product.