CRA product classification
Is a Identity / access management, access-control or biometric reader covered by the EU Cyber Resilience Act?
A Identity / access management, access-control or biometric reader may be covered by the CRA when it is a product with digital elements placed on the EU market and no exclusion applies. The preliminary category is Important — Class I (Annex III, Class I, point 1). Applicable obligations and assessment routes depend on the full product context; reporting begins 11 September 2026 and general application begins 11 December 2027.
Why this category?
Identity management, privileged access management and authentication/access-control readers are listed in Annex III, Class I.
Identity management systems and privileged access management software and hardware, including authentication and access-control readers (including biometric readers) (Annex III, Class I, point 1)
Borderline cases
This starter classification has no additional product-specific follow-up configured. Exclusions and intended purpose still affect the final outcome.
What you may need to do
Module A is available only where harmonised standards, common specifications or an EU cybersecurity certification scheme are applied in full. TODO(owner): verify current OJEU citations and guidance before launch. (Art. 32(2)–(4))
- Module A (only when qualifying requirements are met)
- Module B+C
- Module H
Top Annex I items to assess
- Vulnerability handling and no known exploitable vulnerabilities at placing on the market (Annex I)
- Secure-by-default configuration and updates (Annex I)
- Access control, confidentiality and integrity (Annex I)
- Attack-surface management and security logging (Annex I)
- SBOM, coordinated disclosure and secure update distribution (Annex I, Part II)
What applies today?
CRA Article 14 reporting obligations apply from 11 September 2026 to in-scope products already on the market as well as new products. See the Article 14 reporting tool.
Frequently asked questions
Is a Identity / access management, access-control or biometric reader covered by the EU Cyber Resilience Act?
The CRA may apply to a Identity / access management, access-control or biometric reader placed on the EU market as a product with digital elements, subject to the scope and exclusions. This preliminary page associates it with Annex III, Class I, point 1; confirm its intended purpose and technical characteristics.
What conformity route applies to a Identity / access management, access-control or biometric reader?
The route depends on the final CRA category and applicable conformity-assessment requirements. Important and critical categories can require third-party assessment or an EU cybersecurity certification scheme.
When do the CRA requirements apply?
Reporting obligations apply from 11 September 2026. The CRA's general application date is 11 December 2027. Transitional treatment for products already placed on the market depends on the facts and substantial modification.