Are VPNs, Antivirus and Operating Systems Class I Under the CRA?

Short answer: password managers, antivirus and antimalware software, VPN products and operating systems are important products of Class I under the Cyber Resilience Act (Regulation (EU) 2024/2847, Annex III, Class I, points 3, 4, 5 and 11). They can be self-assessed only if harmonised standards, common specifications or a European cybersecurity certificate cover the essential requirements in full. A product that merely contains one of these functions is classified by its own core function.

What each category covers

The official technical descriptions are in Commission Implementing Regulation (EU) 2025/2392, in force since 21 December 2025:

• Password managers (point 3) store passwords locally on a device or on a remote server, including generating, sharing and filling them into other applications. The category names local password managers, browser extensions, enterprise password managers and hardware-based password managers.
• Antivirus and antimalware (point 4) detect or search for malicious software on devices, or remove or quarantine it. Real-time and on-demand scanners are included, as are rootkit detection and rescue disks whose core function is searching for, removing or quarantining malware.
• VPN products (point 5) establish an encrypted logical tunnel built from the resources of a physical or virtual network. The category names VPN clients, VPN servers and VPN gateways.
• Operating systems (point 11) provide an abstract interface to the underlying hardware and control the execution of software. The category names real-time, general-purpose and special-purpose operating systems.

The examples are illustrative, not exhaustive (recital 7 of the implementing regulation). Software sold on its own is a product with digital elements, so a downloadable app, a desktop program and an operating system image are all in scope.

Core function, with the official examples

The CRA classifies by core functionality, and integrating a listed product does not make the whole product listed (Article 7(1)). The implementing regulation gives worked examples that settle most of the questions manufacturers ask:

• An operating system with a built-in browser is still an operating system, and ancillary tools such as calculators or simple graphics editors do not change that (recital 4).
• A smartphone is generally neither an operating system nor a password manager, although it contains both (recital 5).
• A SOAR platform is generally not a SIEM, even though it can gather, analyse and present security data (recital 5).
• A news app with an embedded browser is not a browser (recital 3). The app as a whole still has to meet the essential requirements, embedded browser included.

Two cases need care. A VPN used only as the internal transport to the manufacturer's own cloud is normally a component, not the core function, as explained for IoT gateways. And endpoint products that block intrusions may be host-based intrusion prevention, which is Class II, as explained for firewalls, IDS and IPS.

The neighbouring categories

These Class I categories sit next to the four above and are often confused with them:

• Identity and access management (point 1): single sign-on, multi-factor authentication, privileged access management, authentication and biometric readers.
• Browsers (point 2): standalone and embedded, including browsers with AI agent integration.
• SIEM systems (point 7): collect and correlate data from multiple sources for security purposes.
• PKI and certificate issuance software (point 9): certificate and key management systems, OCSP responders.
• Boot managers (point 8): UEFI firmware and boot loaders. Note that hypervisors and container runtimes, often shipped with an OS, are Class II (Annex III, Class II, point 1).

SaaS and open source

Pure SaaS is outside the CRA. Recital 12 leaves cloud services such as software as a service to the NIS2 Directive. But the software users install is a product, and its remote data processing belongs to it: processing at a distance designed by or for the manufacturer, without which the product could not perform one of its functions (Article 3(2)). So the vault sync of a password manager or the cloud lookups of an antivirus, when the product needs them to work, are assessed with the product. More in CRA remote data processing solutions scope.

Non-commercial free and open-source software is outside the CRA. It comes in when it is made available in the course of a commercial activity, which recital 15 links to signs such as charging for the product, charging for support beyond cost recovery or monetising it in other ways. A commercial open-source product in these categories is still Class I, but Article 32(5) lets its manufacturer use internal control if the technical documentation is made public. Foundations and other open-source software stewards have a light-touch regime under Article 24, explained in CRA open-source steward obligations.

What Class I means in practice

Under Article 32(2), a Class I product can be self-assessed only where harmonised standards, common specifications or a European cybersecurity certificate at assurance level at least "substantial" are applied in full. Otherwise it goes through EU-type examination by a notified body (modules B and C) or full quality assurance (module H). See Annex III Class I vs Class II and CRA conformity assessment.

The reporting obligations of Article 14 apply since 11 September 2026, including to software already on the market, and the essential requirements apply from 11 December 2027. For software already in users' hands, that reporting clock is the obligation that is running today.

Frequently asked questions

Is an EDR or XDR platform Class I antimalware or Class II?

It depends on its core function. Software whose core function is to detect, remove or quarantine malicious software is Class I (Annex III, Class I, point 4). Host-based intrusion detection and prevention systems are Class II (Annex III, Class II, point 2). A suite that does both needs a reasoned decision on which function is core, recorded in the technical documentation.

My mobile app has a built-in browser and password autofill. Is it Class I?

No, not for that reason. Recital 3 of Implementing Regulation (EU) 2025/2392 says that integrating an embedded browser into a news app does not make the app a browser, and Article 7(1) of the CRA says the same for any integrated component. The app is classified by its own core function.

Does the embedded Linux in my device make the device Class I?

No. A device running an operating system is classified by what the device is for. The operating system itself is Class I (point 11) when it is placed on the market as a product in its own right, for example a commercial real-time or embedded operating system sold to other manufacturers.

Is a cloud-only password manager in scope of the CRA?

A purely online service with nothing for the user to install is SaaS, which recital 12 of the CRA leaves to the NIS2 Directive. As soon as there is an app, a desktop client or a browser extension, that software is a product with digital elements, and the backend it needs to work is part of it as remote data processing (Article 3(2)).

Is an open-source VPN or password manager covered?

Only if it is made available in the course of a commercial activity, for example sold, monetised in another way, or offered with paid support that goes beyond recovering costs (recital 15 of the CRA). If it is, it is Class I, and Article 32(5) lets it use internal control provided the technical documentation is made public. Foundations and other stewards that support such software without being its manufacturer have the lighter obligations of Article 24.