Short answer: physical and virtual network interfaces are important products of Class I under the Cyber Resilience Act (Regulation (EU) 2024/2847, Annex III, Class I, point 10). That covers Wi-Fi, Bluetooth, Ethernet, Zigbee and fieldbus modules, cards and adapters placed on the market on their own. A device with one of them inside is classified by its own core function, and in most cases that is not a network interface.
What counts as a network interface under the CRA
The category has an official technical description in Commission Implementing Regulation (EU) 2025/2392, with two halves:
- Physical network interfaces connect a device directly to a network through the API of their drivers, typically at the data link layer, and have a hardware adapter to the transmission medium with its own firmware.
- Virtual network interfaces connect a device to a network through an API that emulates the drivers of a physical interface.
The examples named are wired and wireless network interface cards, controllers and adapters for Wi-Fi, Ethernet, IrDA, USB, Bluetooth, NearLink, Zigbee and fieldbus, and purely virtual standalone products such as virtual network interface cards, container network interfaces and VPN interfaces. The list is illustrative, not exhaustive.
The device with a module inside is a different product
This is where most manufacturers get it wrong, in both directions. The CRA classifies a product by its core functionality as a whole (Article 7(1)), and recital 3 of the implementing regulation states that integrating a component which meets a category does not in itself bring the whole product into that category.
- A sensor, a pump, a meter or a thermostat with a Wi-Fi or Bluetooth module is not a network interface. It is classified by what it does, which usually makes it a default product unless another category applies.
- The module maker sells a product of its own: the CRA covers hardware components placed on the market separately (Article 3(1)). That module is Class I.
- You still answer for the module. Article 13(5) requires due diligence when integrating third-party components, and recital 3 of the implementing regulation says the manufacturer has to evaluate the security of the whole product, including what it integrates. A module that carries its own CRA conformity makes that much easier to show.
Wireless chips that combine a radio with a general-purpose microcontroller sit on the line between this category and microcontrollers. The core function decides, and the technical documentation should say which one it is and why.
Is your product Class I, Class II or default?
Classify it in Regulus by its core function, with the exact Annex III or IV reference. The requirements, risk assessment and technical file follow from the answer. Free for manufacturers.
What stays out of the category
- Routers, modems and switches. They select routes, modulate signals or forward packets with a management plane. They have their own category, also Class I: see routers and switches.
- Protocol gateways. A box that translates fieldbus or BLE traffic to MQTT and sends it to a cloud is not an interface card. Our IoT gateway guide goes through the cases.
- Interfaces built into your own device and never sold separately. They are part of your product, not a product of their own.
What Class I means for conformity assessment
Under Article 32(2), a Class I product can follow internal control (module A) only where the manufacturer applies in full harmonised standards, common specifications or a European cybersecurity certification scheme at assurance level at least "substantial". Otherwise it needs a notified body, through EU-type examination (module B) followed by module C, or full quality assurance (module H). Check first whether the harmonised standards you plan to use are cited in the Official Journal. More in Class I and Class II.
Wireless interfaces are also radio equipment
Wi-Fi, Bluetooth, Zigbee and NearLink modules are radio equipment, and Delegated Regulation (EU) 2022/30 has applied cybersecurity requirements to them under the Radio Equipment Directive since 1 August 2025. That obligation is already in force, before the CRA. Recital 30 of the CRA anticipates that the Commission will repeal or amend that act for products covered by the CRA. More in CRA vs RED.
Dates that matter for interface manufacturers
- 11 September 2026: the reporting obligations of Article 14 apply, including to modules already on the market. An actively exploited vulnerability in firmware has to be notified within 24 hours.
- 11 December 2027: the essential requirements and the conformity assessment apply to every product placed on the market from that day.
If you build devices rather than modules, write down why your product is not a network interface, and keep the module supplier's conformity evidence in your technical file.
Frequently asked questions
Is a Wi-Fi module Class I under the CRA?
Yes, when it is placed on the market on its own. Implementing Regulation (EU) 2025/2392 lists wired and wireless network interface cards, controllers and adapters, naming Wi-Fi, Ethernet, IrDA, USB, Bluetooth, NearLink, Zigbee and fieldbus, under Annex III, Class I, point 10.
Does my product become Class I because it has a Wi-Fi or Bluetooth module inside?
No. A product is classified by its core functionality as a whole (Article 7(1)). Recital 3 of Implementing Regulation (EU) 2025/2392 states that integrating a component that meets a category does not in itself bring the whole product into that category. You still have to assess the security of the module as part of your product.
Are virtual network interfaces covered?
Yes. The technical description includes purely virtual standalone products, such as virtual network interface cards, container network interfaces and VPN interfaces.
Is a fieldbus card for a PLC a network interface under the CRA?
A fieldbus interface card or adapter sold as a product of its own falls in the category: the technical description names fieldbus explicitly. The PLC that uses it is classified separately, by its own core function.
Can a network interface manufacturer self-assess?
Only by applying in full harmonised standards, common specifications or a European cybersecurity certification scheme at assurance level at least substantial (Article 32(2)). Otherwise a notified body is needed, through module B and C or module H.
Is your product Class I, Class II or default?
Classify it in Regulus by its core function, with the exact Annex III or IV reference. The requirements, risk assessment and technical file follow from the answer. Free for manufacturers.
