Classify your product by its core function.
The class decides whether you can self-assess or need a notified body. Regulus classifies by what the product is for, using the official technical descriptions of Implementing Regulation (EU) 2025/2392, and gives you the exact point of Annex III or IV.
Three steps, no calls.
- 01
Pick the core function
Not every component the product contains: a router with a built-in firewall is still a router, and a device with a secure microcontroller is not a microcontroller.
- 02
Get the class and the reference
Default, Class I, Class II or critical, with the annex point and the conformity assessment route that follows from it.
- 03
Keep the reasoning
The decision and why integrated components do not change it go into the scope and classification document.
Classification in Regulus.
Every category in the adopted text
19 points in Class I, 4 in Class II and 3 in Annex IV, from the regulation as adopted, not the 2022 proposal.
Official technical descriptions
Each category matched against Implementing Regulation (EU) 2025/2392, in force since 21 December 2025.
The traps, shown
PLCs and industrial gateways are not Class II; payment terminals and tachographs are critical; children's wearables mean under 14.
Conformity route
Module A, harmonised standards, modules B+C or H, or a European cybersecurity certificate, depending on the class.
Read more about it.
Our guides on the Cyber Resilience Act, written against the adopted text.
Questions about classification.
What decides the class of a product under the CRA?
Its core functionality (Article 7(1)). Implementing Regulation (EU) 2025/2392 adds that integrating a component that meets a category description does not in itself bring the whole product into that category.
Can a Class I product be self-assessed?
Only if harmonised standards, common specifications or a European cybersecurity certificate at assurance level substantial cover the essential requirements in full. Otherwise a notified body is involved (Article 32(2)).
Are PLCs and SCADA systems Class II?
No. The 2022 Commission proposal placed industrial control systems in Class II, but the adopted text does not list them. They are default products unless their core function is a listed category.
One file, start to finish.
Scope. Check whether the Cyber Resilience Act applies to your product.
Annex I requirements. Track every Cyber Resilience Act essential requirement of Annex I.
Risk assessment. Build the cybersecurity risk assessment the Cyber Resilience Act requires.
Technical file. Generate the Cyber Resilience Act technical file in editable Word.
Article 14 reporting. Meet the Cyber Resilience Act reporting obligations of Article 14.
Start with your own product.
Free for manufacturers. An expert is one click away when you want one.