Short answer: a general-purpose microcontroller or microprocessor is a default product under the Cyber Resilience Act (Regulation (EU) 2024/2847). It becomes Class I when it provides security functions that protect something beyond the chip (Annex III, Class I, points 13 and 14), Class II when it is also tamper-resistant and designed for AVA_VAN level 2 or 3 (Class II, points 3 and 4), and critical when it is a secure element designed for AVA_VAN.4 or higher (Annex IV, point 3).
The four steps, from general-purpose chip to secure element
Since 21 December 2025 each category has an official technical description in Commission Implementing Regulation (EU) 2025/2392. For chips it builds a ladder:
| If the chip… | Category | Class |
|---|---|---|
| Has no security-related functionality, or none that aims to protect anything beyond the chip itself | None | Default |
| Provides security functions such as encryption, authentication, secure key storage, random number generation or a trusted execution environment, to secure other products, networks or services | Microprocessors and microcontrollers with security-related functionalities (Annex III, Class I, points 13 and 14) | Class I |
| Is an ASIC or FPGA that provides the same kind of security functions | ASIC and FPGA with security-related functionalities (Class I, point 15) | Class I |
| Adds tamper evidence, resistance or response and is designed for AVA_VAN level 2 or 3 | Tamper-resistant microprocessors and microcontrollers (Annex III, Class II, points 3 and 4) | Class II |
| Is a secure element designed for at least AVA_VAN.4, such as a TPM or an embedded UICC, or a smartcard built on one | Smartcards or similar devices, including secure elements (Annex IV, point 3) | Critical |
The difference between a microprocessor (relying on external memory and peripherals) and a microcontroller (integrating programmable memory) does not change the class. Both descriptions include microcode and other low-level firmware, so the firmware shipped with the chip is part of the product.
What "beyond the chip itself" means
The Class I descriptions do not catch a chip just because it contains a crypto block. They catch security functions that "aim to secure other products, networks or services beyond" the chip, and give three examples: a secure boot chain, virtualisation and secure communication interfaces.
Read literally, that covers a large share of current MCUs and application processors: parts marketed with secure boot, hardware isolation for a trusted execution environment, or crypto acceleration for the device's encrypted connections. The default step is left for chips without that kind of functionality. Where a part sits near the line, the reasoning should be written down and tied to what the datasheet promises to the integrator.
Is your product Class I, Class II or default?
Classify it in Regulus by its core function, with the exact Annex III or IV reference. The requirements, risk assessment and technical file follow from the answer. Free for manufacturers.
Class II and critical: the AVA_VAN line
Recital 8 of the implementing regulation separates tamper-resistant chips from secure elements by the level of resistance they are designed for, expressed as an AVA_VAN level of the Common Criteria and the Common Evaluation Methodology. Either the latest version of those standards or an older one can be used to express it.
- Class II: a Class I microprocessor or microcontroller that also offers tamper evidence, resistance or response and is designed for AVA_VAN level 2 or 3.
- Critical: a secure element designed for at least AVA_VAN.4. It can be discrete silicon or integrated into a system on chip, and can run its own operating system and applications. The description names Trusted Platform Modules and embedded UICCs. Smartcards are secure elements in a carrier: identity and travel documents, qualified signature cards, replaceable SIM cards, payment and access cards, tachograph cards and payment wristbands.
ASICs and FPGAs have no tamper-resistant step in Annex III: Class II names only microprocessors and microcontrollers.
What the device maker inherits, and what it does not
The class of the chip does not travel up to the device. Article 7(1) says that integrating an Annex III product does not in itself subject the final product to the stricter procedures, and recital 3 of the implementing regulation applies the same logic to critical products. A smart lock is classified as a smart lock, and a gateway by its own core function (see how to classify an IoT gateway).
What does travel is responsibility. The device maker has to assess the security of the whole product, including the chip, and exercise due diligence on third-party components (Article 13(5)). Recital 34 lists what that can look like: checking whether the component bears the CE marking, its security update history and known vulnerabilities. The chip maker, in turn, has to give integrators the information they need to meet the essential requirements and build their technical documentation (Annex II, point 8(f)). In practice that is the first thing device makers will ask their silicon suppliers for.
What the class changes
- Default: self-assessment under internal control (module A).
- Class I: self-assessment only if harmonised standards, common specifications or a European cybersecurity certificate cover the essential requirements in full; otherwise a notified body (Article 32(2)).
- Class II: always a notified body or a European cybersecurity certificate at assurance level at least "substantial" (Article 32(3)).
- Critical: a European cybersecurity certificate where the Commission requires one, otherwise the Class II procedures (Article 32(4)). Recital 46 of the CRA notes that these categories already make wide use of certification under the EUCC scheme.
More on each route in CRA conformity assessment, and on the two lists in Annex III Class I vs Class II and the Annex IV critical products list. Whatever the step, the reporting obligations of Article 14 have applied since 11 September 2026 to chips already on the market, and the full requirements apply from 11 December 2027.
Frequently asked questions
Does secure boot support make my microcontroller Class I?
Read literally, yes. Implementing Regulation (EU) 2025/2392 describes Class I microcontrollers as chips whose security functions aim to secure other products, networks or services beyond the chip itself, and names the secure boot chain as an example, alongside virtualisation and secure communication interfaces. Record the reasoning in the technical documentation.
Does a device built on a Class I microcontroller become Class I?
No. Integrating a product that meets an Annex III category does not in itself make the final product subject to the procedures for that category (Article 7(1) and recital 3 of Implementing Regulation (EU) 2025/2392). The device is classified by its own core function, but its manufacturer still has to assess the security of the whole product, including the chip.
Does a product with a TPM or an eSIM become a critical product?
No. TPMs and embedded UICCs are secure elements in Annex IV, point 3, but recital 3 of Implementing Regulation (EU) 2025/2392 says a product follows the procedures for important or critical products only if the product as a whole meets the description. A laptop with a TPM or a tracker with an eSIM is classified by what it is for.
Do I need a Common Criteria certificate to know whether my chip is Class II?
No. The test is the AVA_VAN level the chip is designed to provide: level 2 or 3 for Class II, at least AVA_VAN.4 for a secure element. A certificate is strong evidence of that level, but the category follows the design target (Implementing Regulation (EU) 2025/2392, Annex I, Class II, points 3 and 4, and Annex II, point 3).
Is a chip with no security features in scope at all?
Generally yes. Hardware components placed on the market separately are products with digital elements (Article 3(1)). A microcontroller with no security-related functionality is a default product: self-assessment under internal control, with all the essential requirements, vulnerability handling and reporting obligations still applying.
Is your product Class I, Class II or default?
Classify it in Regulus by its core function, with the exact Annex III or IV reference. The requirements, risk assessment and technical file follow from the answer. Free for manufacturers.
