Are Routers Class I Under the CRA? Routers, Modems and Switches

Short answer: routers, modems intended for the connection to the internet, and switches are important products of Class I under the Cyber Resilience Act (Regulation (EU) 2024/2847, Annex III, Class I, point 12). Self-assessment is possible only if you apply harmonised standards, common specifications or a European cybersecurity certificate in full. Otherwise a notified body has to be involved.

What counts as a router, modem or switch under the CRA

Since 21 December 2025 the category has an official technical description in Commission Implementing Regulation (EU) 2025/2392. It covers three kinds of product:

• Routers establish and control the flow of data between different networks by selecting paths using routing protocol mechanisms and algorithms, typically at the network layer. Wired and wireless routers, virtual routers, and routers with or without a modem are all included.
• Modems intended for the connection to the internet are hardware that converts analogue signals to and from digital signals for IP-based communication: fibre, DSL, cable (DOCSIS), satellite and cellular modems.
• Switches connect networked devices by forwarding packets and have a management plane. The description names managed, smart and multilayer switches, virtual security switches, programmable switches for software-defined networking, and bridges such as wireless access points.

The examples are illustrative, not exhaustive (recital 7). The internet condition attaches to modems only: the description of routers does not require an internet connection, so a router on a closed industrial network is still a router. There is no industrial or consumer split either.

What stays out of the category

The CRA classifies a product by its core functionality (Article 7(1)), and several products that look like network equipment do not match the description:

• Unmanaged switches. The description of switches requires a management plane. A plug-and-play switch without one is a default product, unless another category applies.
• Protocol gateways. A gateway that translates Modbus, BACnet or BLE to MQTT and forwards data to a cloud does not select routes with routing protocols. It is usually a default product. Our IoT gateway classification guide goes through the cases.
• Products with a modem inside. A meter, a vehicle tracker or an alarm panel with a cellular module is not a modem. Integrating a component that matches a category does not move the whole product into it (Article 7(1) and recital 3 of the implementing regulation).
• Network cards and Wi-Fi, Bluetooth or Zigbee modules sold on their own. These are a separate category, physical and virtual network interfaces (point 10), which is also Class I.

A router with a firewall is still a router

Most routers filter traffic, terminate VPNs or run a management app. None of that changes the class. Recital 4 of the implementing regulation uses this exact case: a router integrating firewall functionality still has the core functionality of a router, so it stays in Class I.

The opposite also holds. A security appliance whose core function is protecting a network by monitoring and restricting traffic is a firewall, which is Class II, even if it also routes. When a product sits on the line, the technical documentation should name the core function and explain why.

What Class I means for conformity assessment

Under Article 32(2), a Class I product can follow internal control (module A) only where the manufacturer applies in full harmonised standards, common specifications or a European cybersecurity certification scheme at assurance level at least "substantial". If they are not applied, are applied only in part, or do not exist, the manufacturer needs a notified body:

• EU-type examination (module B) followed by conformity to type based on internal production control (module C), or
• Full quality assurance (module H).

Before planning on self-assessment, check whether the harmonised standards you intend to use have been cited in the Official Journal. The essential requirements of Annex I are the same for every class; the class only changes who checks them. Our guide to Class I and Class II and the overview of conformity assessment go into the modules.

Two more things router manufacturers should know

• The support period will usually be longer than five years. Article 13(8) sets five years as the minimum, and recital 60 names routers, modems and switches among the products often in use for longer than that, for which manufacturers should ensure longer support periods. See our guide to the support period.
• Wireless products are also radio equipment. Delegated Regulation (EU) 2022/30 has applied cybersecurity requirements to them under the Radio Equipment Directive since 1 August 2025. Recital 30 of the CRA anticipates that the Commission will repeal or amend that act for products covered by the CRA. More in CRA vs RED.

Dates that matter for router manufacturers

• 11 June 2026: the rules on notified bodies started to apply.
• 11 September 2026: the reporting obligations of Article 14 apply, including to routers already on the market. An actively exploited vulnerability has to be notified within 24 hours.
• 11 December 2027: the essential requirements and the conformity assessment apply to every product placed on the market from that day.

Whatever the route, write the classification down: the core function, the technical description it meets, and why a built-in firewall or VPN does not change it.

Frequently asked questions

Is an unmanaged switch Class I under the CRA?

No. Implementing Regulation (EU) 2025/2392 describes switches as products that forward packets and have a management plane. A plug-and-play switch with no management interface does not meet that description and is a default product, unless another category applies.

Is a Wi-Fi access point a router or switch under the CRA?

It falls in the same Class I category. The technical description of switches in Implementing Regulation (EU) 2025/2392 names bridges such as wireless access points.

Does a router with a built-in firewall become Class II?

No. Recital 4 of Implementing Regulation (EU) 2025/2392 uses this exact example: a router integrating firewall functionality still has the core functionality of a router, which is Class I (Annex III, Class I, point 12).

Are industrial routers treated differently from consumer routers?

No. The category does not distinguish industrial from consumer products, and the technical description of routers does not require an internet connection. An industrial cellular router and a home Wi-Fi router are both Class I.

Can I self-assess a router under the CRA?

Only if you apply in full harmonised standards, common specifications or a European cybersecurity certification scheme at assurance level at least substantial that cover the essential requirements. Otherwise a notified body is needed, through EU-type examination (module B and C) or full quality assurance (module H) (Article 32(2)).