Classification is not a general judgement about whether a product appears “risky”. The CRA uses specific lists and technical descriptions. Work through these steps:
- define the product as a whole and its core functionality;
- compare it with CRA Annexes III and IV;
- check the detailed description in Implementing Regulation (EU) 2025/2392;
- record the decision, including boundary cases, intended purpose and reasonably foreseeable use; and
- use the result to select the Article 32 procedure.
An embedded browser inside an application, for example, does not by itself make the whole application an important product. The stricter category applies where the core functionality of the product as a whole matches the technical description of an important or critical product.
Important products — Class I (Annex III)
- identity management and privileged-access management systems, including authentication and access-control readers;
- standalone and embedded browsers;
- password managers;
- software that searches for, removes or quarantines malicious software;
- products with VPN functionality;
- network-management systems;
- SIEM systems;
- boot managers;
- public-key infrastructure and digital-certificate issuance software;
- physical and virtual network interfaces;
- operating systems;
- routers, internet-connection modems and switches;
- microprocessors with security-related functionality;
- microcontrollers with security-related functionality;
- ASICs and FPGAs with security-related functionality;
- smart-home general-purpose virtual assistants;
- smart-home products with security functionality, including smart door locks, security cameras, baby monitors and alarm systems;
- internet-connected toys with social interactive or location-tracking features covered by the applicable toy-safety legislation; and
- personal wearable health-monitoring products outside MDR/IVDR, or personal wearables intended for use by and for children.
Important products — Class II (Annex III)
- hypervisors and container runtime systems supporting virtualised execution of operating systems and similar environments;
- firewalls and intrusion detection/prevention systems;
- tamper-resistant microprocessors; and
- tamper-resistant microcontrollers.
Critical products (Annex IV)
- hardware devices with security boxes;
- smart-meter gateways in smart-metering systems and other devices for advanced security purposes, including secure cryptoprocessing; and
- smartcards or similar devices, including secure elements.
This is a navigation aid, not a substitute for the legal descriptions. For an actual product, use the full annexes and the technical descriptions in Regulation 2025/2392. The Commission may amend the lists through delegated acts.