EU Cyber Resilience Act
EU CRA product classifications and scope guidance
The Cyber Resilience Act applies to products with digital elements, subject to its scope and exclusions. A product's classification depends on its intended purpose and technical characteristics; these pages are preliminary guidance, not legal advice.
Run the full CRA scope check →Default (non-important)
CRA Art. 32(1)- Smart thermostat →
If it performs a listed smart-home security function, the category may differ. TODO(owner): verify technical descriptions.
- Smart TV / streaming device →
TODO(owner): verify product-specific technical descriptions and any security functionality.
- Smart appliance (fridge, washer, oven) →
TODO(owner): verify product-specific technical descriptions and any listed security function.
- EV charger →
TODO(owner): review interaction with type-approval and product technical descriptions.
- PLC / industrial controller →
If it has a listed firewall/IDS/IPS function, further classification review is needed.
- HMI / SCADA software →
TODO(owner): verify technical descriptions and product-boundary treatment.
- Industrial IoT gateway →
If it functions as a router or switch, it may match Annex III, Class I. TODO(owner): verify technical descriptions.
- Battery management system (BMS) →
If yes, the motor-vehicle exclusion needs review. TODO(owner): review OEM-fit, aftermarket and spare-part boundary.
- Automotive ECU / telematics unit →
OEM-fit products may fall under the vehicle exclusion; aftermarket products require separate analysis. TODO(owner): review interaction with UN R155/R156.
- Mobile app (general) →
A listed function such as password management, VPN or browser may change the category.
- Desktop / business software (general) →
A listed functionality may change the category. TODO(owner): verify product-boundary treatment.
- Firmware or software component sold separately →
TODO(owner): verify product-boundary and placing-on-market treatment.
Important — Class I
CRA Art. 7(1), Annex III Class I- Home / SOHO router, modem or switch →
Routers, internet modems and switches are listed in Annex III, Class I.
Annex III-12
- VPN client or appliance →
Products with the function of a VPN are listed in Annex III, Class I.
Annex III-5
- Password manager →
Password managers are listed in Annex III, Class I.
Annex III-3
- Antivirus / EDR agent →
Software that searches for, removes or quarantines malicious software is listed in Annex III, Class I.
Annex III-4
- SIEM →
SIEM systems are listed in Annex III, Class I.
Annex III-7
- Network management system →
Network management systems are listed in Annex III, Class I.
Annex III-6
- PKI / certificate issuance software →
PKI and digital certificate issuance software are listed in Annex III, Class I.
Annex III-9
- Operating system (general-purpose or embedded) →
TODO(owner): verify the Commission technical description and borderline product treatment.
Annex III-11
- Web browser (standalone or embedded) →
Standalone and embedded browsers are listed in Annex III, Class I.
Annex III-2
- Boot manager / bootloader sold as a product →
TODO(owner): verify the Commission technical description and borderline product treatment.
Annex III-8
- Identity / access management, access-control or biometric reader →
Identity management, privileged access management and authentication/access-control readers are listed in Annex III, Class I.
Annex III-1
- Microcontroller with security functions →
A tamper-resistant microcontroller is listed in Annex III, Class II; other security-related microcontrollers are listed in Class I.
Annex III-14
- Microprocessor with security functions →
A tamper-resistant microprocessor is listed in Annex III, Class II; other security-related microprocessors are listed in Class I.
Annex III-13
- ASIC / FPGA with security functions →
TODO(owner): verify the Commission technical description for security-related functionality.
Annex III-15
- Smart lock →
Smart door locks are listed as examples of smart home products with security functionalities.
Annex III-17
- Security camera / IP camera (security use) →
TODO(owner): verify the Commission technical description and intended-purpose boundary.
Annex III-17
- Baby monitor →
Baby monitoring systems are listed as examples of smart home products with security functionalities.
Annex III-17
- Alarm system →
Alarm systems are listed as examples of smart home products with security functionalities.
Annex III-17
- Smart speaker / home virtual assistant →
TODO(owner): verify intended-purpose match to the Annex III entry.
Annex III-16
- Connected toy with camera, microphone or location features →
Connected toys with social interactive features or location tracking are listed in Annex III, Class I.
Annex III-18
- Fitness / health-tracking wearable (non-medical) →
If regulated as an MDR/IVDR medical device it may be excluded; otherwise check the Annex III intended-purpose entry.
Annex III-19
- Children's smartwatch →
Wearables intended for use by or for children are listed in Annex III, Class I.
Annex III-19
Important — Class II
CRA Art. 7(1), Annex III Class II- Enterprise firewall / IDS / IPS →
Firewalls and intrusion detection and prevention systems are listed in Annex III, Class II.
Annex III-II-2
- Hypervisor / container runtime →
Hypervisors and container runtime systems supporting virtualised execution are listed in Annex III, Class II.
Annex III-II-1
Critical
CRA Art. 8, Annex IV- Smart meter gateway →
Smart meter gateways are listed in Annex IV.
Annex IV-2
- Hardware security module (HSM) →
TODO(owner): verify whether this product matches the Annex IV technical description of hardware devices with security boxes.
Annex IV-1
- Smartcard / secure element →
Smartcards and similar devices, including secure elements, are listed in Annex IV.
Annex IV-3
Excluded and needs review
- Medical device / IVD →
Medical devices and in-vitro diagnostic devices are excluded as specified in Article 2(2)(a)–(b).
- Pure SaaS / cloud service →
A pure SaaS service may be outside scope; remote data processing for a product may be treated differently.
- Other / not listed →
Provide a short product description and send the result to an expert for review.
Products needing individual review
Products in the default category, borderline product types and potential exclusions depend on intended use and technical descriptions. Use the scope check to identify open questions rather than relying on a guessed outcome.
Check a product not listed here →