Industries we serve
The CRA does not affect every industry in the same way. Your product's class, the other rules that apply and the evidence your customers will ask for all depend on the industry.
01 · Mostly Annex III Class I
Network and telecom equipment
Typical products: Routers, modems, switches, ONTs, gateways
Routers, modems and switches are important products; until harmonised standards are published, third-party assessment is needed.
Details →
02 · Mostly default; products with security functions Class I
Smart home and appliances
Typical products: Connected appliances, smart locks, cameras, Wi-Fi modules, control boards
Most appliances are default class; suppliers of Wi-Fi modules and boards will have to provide evidence to the brands.
Details →
03 · Mostly default
Industrial automation and electronics
Typical products: PLCs, HMIs, sensors, drives, gateways
Customers under NIS2 ask their suppliers for evidence, and the Machinery Regulation starts to apply in 2027.
Details →
04 · To be assessed per product
Agricultural and construction machinery electronics
Typical products: Control units, telematics modules, displays and terminals
The CRA's exclusion for type-approved motor vehicles (Regulation (EU) 2019/2144) does not cover agricultural tractors; their electronics are most likely in scope.
05 · Mostly default; smart meter gateways Annex IV critical
Energy and meters
Typical products: Smart meters, meter gateways, inverters, chargers
Smart meter gateways are critical products; most other energy devices are default class.
06 · Depends on your role
Design houses and ODMs
Typical products: Boards, modules and firmware designed for customers
Your customers will ask you for CRA evidence: SBOM, vulnerability handling and update commitments. If you sell under your own name, you are the manufacturer.
Let's talk about your product
We run a free CRA pre-scan of a firmware you choose: components, priority vulnerabilities, likely class and the three biggest gaps.
General information, not legal advice. A product's class follows its core functionality; the technical descriptions of the categories are in Implementing Regulation (EU) 2025/2392.