Is an IoT Gateway Class I, Class II or Default Under the CRA?

Short answer: the Cyber Resilience Act (Regulation (EU) 2024/2847) has no category called "IoT gateway". A gateway is classified by its core functionality (Article 7(1)). Most protocol and edge gateways are default products that can be self-assessed. A gateway whose core function is routing, internet access, VPN, firewalling or smart metering falls into the category for that function.

How to classify a gateway, function by function

The categories of Annexes III and IV are defined in Commission Implementing Regulation (EU) 2025/2392, in force since 21 December 2025. Read against those descriptions, a gateway lands in one of these places:

If the core function of the gateway is…	Category	Class
Translating field or sensor protocols (Modbus, BACnet, CAN, BLE) and forwarding data to a cloud or a local system	None	Default
Routing traffic between networks using routing protocols, or connecting a network to the internet as a modem (DSL, cable, fibre, cellular)	Routers, modems and switches (Annex III, Class I, point 12)	Class I
Forwarding traffic as a managed switch or a wireless access point	Routers, modems and switches (point 12)	Class I
Providing VPN connections	VPN products (Annex III, Class I, point 5)	Class I
Centrally controlling home security products such as alarms, locks or cameras	Smart home products with security functionalities (point 17)	Class I
Protecting a network by monitoring and restricting traffic	Firewalls, IDS and IPS (Annex III, Class II, point 2)	Class II
Controlling communication in a smart metering system	Smart meter gateways (Annex IV, point 2)	Critical

Containing a function is not the same as being it

Gateways usually contain several things that appear in the annexes: an embedded operating system, a cellular modem, a VPN client, a host firewall, a microcontroller with secure boot. None of these decides the class on its own. Recital 3 of the implementing regulation says that integrating a component that meets a category description does not make the whole product subject to that category's procedure, and recital 4 adds that a router integrating a firewall is still a router.

The opposite also holds: a gateway whose core function is routing does not stop being a router because it also translates protocols or runs applications. Additional functions do not change the core functionality.

Why classification tools disagree about gateways

The Commission proposal of 2022 placed industrial automation and control systems, and "industrial" firewalls, in Class II. The adopted text did not keep either. PLCs, SCADA systems and industrial gateways are not listed in Annex III or IV. Tools and guides built on the proposal still put industrial gateways in Class II and send their manufacturers to a notified body they do not need.

What the class changes

• Default: self-assessment under internal control (module A).
• Class I: self-assessment only if harmonised standards, common specifications or a European cybersecurity certificate cover the essential requirements in full; otherwise a notified body (Article 32(2)).
• Class II: always a notified body or a European cybersecurity certificate (Article 32(3)).
• Critical: a European cybersecurity certificate where the Commission requires one, otherwise the Class II procedures (Article 32(4)).

Whatever the class, the manufacturer has to write down the reasoning. The technical documentation should name the core function, quote the technical description it does or does not meet, and explain why integrated components do not change the result. That page is the first thing a market surveillance authority will read if it questions the classification.

Frequently asked questions

Are industrial IoT gateways Class II under the CRA?

Not as such. The Commission proposal of 2022 listed industrial control systems and related gateways in Class II, but the adopted text did not keep them. An industrial gateway is Class II only if its core function is a Class II category, such as a firewall.

Is an LTE or 5G gateway a router or modem under the CRA?

If its core function is to connect devices or a local network to the internet over the cellular network, it matches routers and modems intended for the connection to the internet, which are Class I (Annex III, Class I, point 12). Integrating a cellular module into a product with a different core function does not make that product a modem.

Is a gateway that translates Modbus or other fieldbus protocols to MQTT a router?

Generally not. Implementing Regulation (EU) 2025/2392 describes routers as products that select paths between networks using routing protocols. Translating protocols and forwarding data to a cloud service is a different core function, so such a gateway is usually a default product, unless another category applies.

Is a smart meter gateway an IoT gateway under the CRA?

A smart meter gateway within a smart metering system is a critical product (Annex IV, point 2). Implementing Regulation (EU) 2025/2392 describes it and extends it to gas and heat metering gateways that meet the description.

Does a gateway with a VPN client become Class I?

Not automatically. Products whose function is to provide a VPN are Class I (point 5), but a VPN used only as the internal transport to the manufacturer's own cloud is a component, not the core function. Record the reasoning in the technical documentation.

Who decides the class of my gateway?

The manufacturer does, and documents it. Market surveillance authorities can challenge the decision, so the reasoning should cite the core function and the relevant technical description of Implementing Regulation (EU) 2025/2392.