Is a PLC Class II Under the CRA? PLCs, SCADA and HMIs

Short answer: programmable logic controllers (PLCs), SCADA systems, HMIs and other industrial automation and control systems are not listed in Annex III or Annex IV of the Cyber Resilience Act (Regulation (EU) 2024/2847). They are default products, which the manufacturer can self-assess, unless their core function is one of the listed categories. They are still fully in scope, with the same requirements as any other product.

The proposal said Class II. The final text does not

The Commission proposal of 2022 put industrial automation and control systems, including PLCs and SCADA systems, in Class II, and split firewalls into "industrial" and other. Neither survived the negotiation. The adopted Annex III has 19 Class I and 4 Class II categories, and none of them is defined by the industrial sector. Annex IV has three critical categories, and industrial control is not one of them either.

Some classification tools and guides were built on the proposal and still answer "Class II, notified body required" for a PLC, sending manufacturers to a third-party assessment the regulation does not ask for. The Commission can add or move categories by delegated act (Article 7(3)), but until it does, the annexes as adopted are what count.

How to classify industrial products by core function

The categories are defined in Commission Implementing Regulation (EU) 2025/2392, in force since 21 December 2025. Several of its descriptions name operational technology explicitly, so industrial products can land in a listed category when that is what they are for:

If the core function of the product is…	Category	Class
Controlling a process or machine: PLCs, motion and DCS controllers, remote I/O, safety controllers	None	Default
Supervising and operating a process: HMI panels, SCADA software, historians, engineering and programming tools	None	Default
Routing between networks, connecting a site to the internet as a modem, or forwarding traffic as a managed switch	Routers, modems and switches (Annex III, Class I, point 12)	Class I
Providing VPN connections, such as a remote access gateway for machine service	VPN products (Class I, point 5)	Class I
Connecting a device to a network as a separate interface card or adapter, Fieldbus included	Physical and virtual network interfaces (Class I, point 10)	Class I
Controlling and monitoring privileged access to IT or OT systems	Identity and privileged access management (Class I, point 1)	Class I
Restricting traffic to protect a network, or detecting intrusions in OT traffic	Firewalls, IDS and IPS (Annex III, Class II, point 2)	Class II

The industrial label changes nothing: an industrial firewall is Class II like any firewall. For protocol and edge gateways, see how to classify an IoT gateway.

What if the PLC has a firewall or VPN built in

It stays a default product. Integrating a product that has the core functionality of an Annex III category does not in itself subject the host product to the stricter procedures (Article 7(1)). The implementing regulation adds that a product able to perform the functions of a category, but whose core functionality is different, does not meet that category's description (recitals 3 and 5).

Two limits apply. The integrated firewall or VPN is part of the product, so it has to meet the essential requirements and appear in the cybersecurity risk assessment. And a security module sold as a separate product, whose core function is firewalling or VPN, is classified on its own: Class II or Class I respectively.

IEC 62443 is evidence, not a presumption of conformity

Many industrial manufacturers already work with IEC 62443, usually 62443-4-1 for the development process and 62443-4-2 for component requirements. That is valuable evidence for many essential requirements, but IEC 62443 is not a harmonised standard under the CRA: presumption of conformity comes only from harmonised standards whose references are published in the Official Journal (Article 27(1)).

For a default product this matters less than it seems, because internal control (module A) does not require harmonised standards. What it needs is technical documentation that maps each essential requirement to the evidence, plus what the CRA adds on its own: Article 14 reporting, the SBOM, the declared support period and the EU declaration of conformity.

What the CRA recognises about industrial products

• Long support periods. The support period is at least five years (Article 13(8)), and recital 60 notes that industrial control systems are often in use for significantly longer.
• No forced automatic updates. Automatic security updates are required only "where applicable" (Annex I, Part I, point (2)(c)), and recital 56 says they do not apply where users would not reasonably expect them, especially in critical and industrial environments. Security updates still have to be made available without delay.

Railway, machinery and other sectors

• Railway is not excluded. Article 2 excludes medical devices, type-approved vehicles, certified civil aviation products, marine equipment and defence products, not rail. And an exclusion covers the regulated product itself, not every controller sold to that sector.
• Machinery adds, it does not replace. When a product also falls under the Machinery Regulation (EU) 2023/1230, the manufacturer complies with both and follows both conformity assessment procedures (recital 53). Meeting the CRA can help with the machinery requirements on protection against corruption and on control systems.

Since 11 September 2026 the reporting obligations of Article 14 apply, including to controllers already installed. The essential requirements and conformity assessment apply from 11 December 2027. Write the classification down now, naming the core function and explaining why integrated security functions do not change the result.

Frequently asked questions

Is a PLC a Class II product under the CRA?

No. Programmable logic controllers are not listed in Annex III or Annex IV of Regulation (EU) 2024/2847. The Commission proposal of 2022 placed industrial automation and control systems in Class II, but the adopted text did not keep them. A PLC is a default product unless its core function is a listed category, such as a router, a VPN or a firewall.

Does a PLC with a built-in firewall or VPN become Class I or Class II?

No. A product is classified by its core functionality (Article 7(1)), and integrating a component that meets a category description does not move the whole product into that category (recitals 3 to 5 of Implementing Regulation (EU) 2025/2392). The built-in firewall or VPN still has to meet the essential requirements as part of the product. A module sold separately whose core function is firewalling or VPN is classified on its own.

Do I need a notified body for a PLC, an HMI or SCADA software?

Not for the CRA, if the product is in the default category. The manufacturer can use internal control (module A, Article 32(1)(a)). The Machinery Regulation may impose its own procedure when the PLC is part of a machine or a safety component; the two are applied side by side.

Does IEC 62443 certification make my product CRA compliant?

Not by itself. Presumption of conformity comes only from harmonised standards whose references are published in the Official Journal (Article 27(1)). IEC 62443-4-1 and 62443-4-2 work is good evidence for many essential requirements, but the CRA adds obligations of its own, such as vulnerability reporting, the SBOM, the declared support period and CE marking.

Is an industrial managed switch or router Class I?

Yes. Routers, modems intended for the connection to the internet and switches with a management plane are Class I (Annex III, Class I, point 12), whether they are built for an office or a factory floor. An unmanaged switch does not meet the technical description.