01Four categories
Most products with digital elements are in the default category. Products in Annex III are important (Class I or Class II); products in Annex IV are critical. The class follows the product's core functionality: integrating a component from an important class (for example a microcontroller with security functions) does not by itself put the product in that class (Article 7).
| Category | Examples | Basis |
|---|---|---|
| Default | Products not listed in Annexes III and IV; for example many sensors, appliances and industrial device software | Article 32 |
| Important, Class I | Identity and access management, browsers, password managers, VPNs, operating systems, routers, modems and switches, microprocessors and microcontrollers with security functions, smart home products with security functions (smart locks, security cameras, baby monitors, alarms), connected toys, health-monitoring wearables | Article 7, Annex III Class I |
| Important, Class II | Hypervisors and container runtimes, firewalls, intrusion detection and prevention systems, tamper-resistant microprocessors and microcontrollers | Article 7, Annex III Class II |
| Critical | Hardware devices with security boxes (such as HSMs), smart meter gateways, smartcards and secure elements | Article 8, Annex IV |
The technical descriptions of the Annex III categories are set out in a Commission implementing act (Article 7). Use those descriptions together with your product's core functionality when classifying.
02Which conformity assessment route?
Article 32 sets the routes allowed for each category. The modules are defined in Annex VIII:
- Module A (internal control): the manufacturer assesses and declares conformity itself.
- Module B + C (EU-type examination and conformity to type): a notified body examines the product type; the manufacturer ensures production conforms to it.
- Module H (full quality assurance): a notified body approves and monitors the manufacturer's quality system.
| Category | Allowed routes |
|---|---|
| Default | Module A (or optionally B + C or H) |
| Class I | Module A if harmonised standards, common specifications or a European cybersecurity certificate at assurance level at least "substantial" have been fully applied; otherwise B + C or H |
| Class II | Module B + C, Module H, or a European cybersecurity certificate at least "substantial" where available |
| Critical | A European cybersecurity certificate where required by a delegated act; otherwise the Class II routes |
Free and open-source software whose technical documentation is made public may use Module A in Classes I and II as well (Article 32).
The provisions on notified bodies have applied since 11 June 2026. For Class I products, plan for a notified body until harmonised CRA standards are published.
03Steps to the CE marking
- Scope and class: check whether the product has digital elements, whether a sector exclusion applies, and its category (scope).
- Cybersecurity risk assessment: a documented assessment showing how the Annex I requirements apply to your product (Article 13).
- Meet Annex I: product properties (Part I) and vulnerability handling processes (Part II), including an SBOM.
- Set the support period: reflecting the expected use time, generally at least five years, and stated clearly at the time of purchase (Article 13).
- Conformity assessment: Module A, B + C or H depending on your category.
- Technical documentation (Annex VII) and EU declaration of conformity (Article 28, Annex V): kept for 10 years or the support period, whichever is longer (Article 13).
- Affix the CE marking (Article 30) and supply the user information in Annex II with the product.
04Frequently asked questions
My product contains a microcontroller with security functions. Is it Class I now?
Not by itself. The class follows the product's core functionality; integrating a component from an important class does not put the product in that class (Article 7).
Do I need a notified body for a default-category product?
No. Internal control under Module A is enough. Meeting all essential requirements and preparing the technical documentation remain the manufacturer's responsibility.
What if there is no harmonised standard yet for my Class I product?
Module A cannot be used; a notified body is involved through Module B + C or H.
How long must I keep the technical documentation?
For 10 years after the product is placed on the market or for the support period, whichever is longer.
Sources
Related guides
- CRA Article 14: vulnerability and incident reportingWhen, to whom and how fast to report. 24 hours, 72 hours and the final report, with a free deadline calculator.
- EN 18031 and RED: how they relate to the CRACybersecurity requirements for radio equipment in force since 1 August 2025, and the move to the CRA.
- CRA readiness guideFor every manufacturer selling into the EU: roles, timeline, extra points for non-EU manufacturers and a step-by-step checklist.
- CRA guide: overviewScope, timeline, Annex I essential requirements, product classes, reporting and fines on one page.
Let's talk about this process for your product
Our enterprise pilot generates the SBOM of your firmware, prioritises vulnerabilities and tracks Article 14 deadlines.