The Cyber Resilience Act (Regulation (EU) 2024/2847, "CRA") sorts products into three groups. Most software and devices are in the default category and can be self-assessed. A short list of "important" products (Annex III) and "critical" products (Annex IV) needs a stricter conformity assessment - and for some of them, in practice, a notified body that does not yet exist. This guide shows the lists, the rule that decides whether you are on them, and what it means for your plan to December 2027.
Three categories, three routes
| Category | Where listed | How you show conformity (from 11 December 2027) | Basis |
|---|---|---|---|
| Default | Not in Annex III or IV | Self-assessment (internal control, module A), or modules B+C, H, or a certification scheme | Art. 32(1) |
| Important, Class I | Annex III, Class I | Self-assessment only if you applied harmonised standards, common specifications or a European cybersecurity certification scheme (at least "substantial") in full; otherwise a notified body: EU-type examination (B+C) or full quality assurance (H) | Art. 32(2) |
| Important, Class II | Annex III, Class II | Always third party: B+C, H, or a certification scheme at least "substantial" | Art. 32(3) |
| Critical | Annex IV | A European cybersecurity certificate where the Commission requires one by delegated act; until then, as Class II | Art. 8(1), Art. 32(4) |
All other duties - essential requirements, SBOM, vulnerability handling, support period, technical documentation, reporting - are the same in every category. The category only changes who checks your work.
Annex III, Class I (19 categories)
- Identity management systems and privileged access management software and hardware, including authentication and access control readers, including biometric readers
- Standalone and embedded browsers
- Password managers
- Software that searches for, removes, or quarantines malicious software
- Products with digital elements with the function of virtual private network (VPN)
- Network management systems
- Security information and event management (SIEM) systems
- Boot managers
- Public key infrastructure and digital certificate issuance software
- Physical and virtual network interfaces
- Operating systems
- Routers, modems intended for the connection to the internet, and switches
- Microprocessors with security-related functionalities
- Microcontrollers with security-related functionalities
- Application specific integrated circuits (ASIC) and field-programmable gate arrays (FPGA) with security-related functionalities
- Smart home general purpose virtual assistants
- Smart home products with security functionalities, including smart door locks, security cameras, baby monitoring systems and alarm systems
- Internet connected toys with social interactive features or location tracking features
- Personal wearable products for health monitoring or children's use
Annex III, Class II (4 categories)
- Hypervisors and container runtime systems that support virtualised execution of operating systems and similar environments
- Firewalls, intrusion detection and prevention systems
- Tamper-resistant microprocessors
- Tamper-resistant microcontrollers
Annex IV, critical products (3 categories)
- Hardware devices with security boxes
- Smart meter gateways within smart metering systems, and other devices for advanced security purposes, including secure cryptoprocessing
- Smartcards or similar devices, including secure elements
Critical products are rare in a micro company's portfolio. If you make one, you probably already work with certification labs.
The rule that decides: core functionality
The lists are short, but the words on them are broad. "Identity management", "network interfaces" or "operating systems" could describe parts of many products. Two rules keep the lists narrow.
Integration does not count. Article 7(1): integrating an important product "shall not in itself render the product in which it is integrated subject to" the stricter procedures. Your app that ships an embedded browser view is not a browser. Your device that runs Linux is not an operating system product.
Core functionality decides. The Commission's Implementing Regulation (EU) 2025/2392 of 28 November 2025 gives a technical description of every category in Annexes III and IV, as Article 7(4) required. It explains that a product belongs to a category when its core functionality is that of the category. Its example: a smartphone integrates an operating system and a password manager, but its core functionality is neither, so it is not classified as either. An operating system with a built-in browser remains an operating system, not a browser.
Even so, the risk assessment for your product must cover all its components, including the ones from the lists.
Where small products usually land
The table is our reading of Annex III and the core functionality rule, not a ruling. Check the technical description of the category in Implementing Regulation (EU) 2025/2392 before you decide.
| Product | Likely category | Why |
|---|---|---|
| Paid desktop or mobile app, SDK, game | Default | Core function is not on the lists |
| WordPress plugin for forms, SEO, shop features | Default | Same |
| WordPress or browser security plugin that scans for and quarantines malware | Possibly Class I (point 4) | Its core function is anti-malware |
| Password manager app or browser extension | Class I (point 3) | Core function is storing and filling credentials |
| VPN app | Class I (point 5) | Core function is VPN |
| Login or 2FA plugin that only protects your own product | Default | Integrated function, not the product's core |
| Single sign-on or access management product sold to others | Possibly Class I (point 1) | Check the technical description |
| Home router, LTE modem, managed switch | Class I (point 12) | Listed |
| Smart lock, security camera, baby monitor, alarm | Class I (point 17) | Listed |
| Smart thermostat, smart plug, weather station | Default | Smart home, but without a security function |
| Firewall or intrusion detection appliance | Class II (point 2) | Listed |
If your product is in the default category, the next step is self-assessment: see CE marking and the EU declaration of conformity. If it runs on a device, see also CRA for connected devices and firmware.
Class I in 2027: the harmonised standards problem
For Class I, self-assessment is possible only if you applied harmonised standards, common specifications or a suitable certification scheme in full (Art. 32(2)). As of 17 October 2026, no CRA harmonised standard had been cited in the Official Journal. The first horizontal standards (EN 40000-1-1 and 1-2) were due for ratification on 2 November 2026, with no citation in the Official Journal expected for either. The Commission can adopt common specifications if standards are missing (Art. 27), but had not confirmed a timetable.
Notified bodies are the other bottleneck. The CRA rules on notified bodies have applied since 11 June 2026, but as of 11 September 2026 no body was listed in the Commission's NANDO database under the CRA. Member States are to "strive" to have enough of them by 11 December 2026 (Art. 35(2)).
What that means for a Class I product placed on the market from 11 December 2027:
- Do not plan on self-assessment. Plan on a notified body unless a standard you can apply in full is cited in time.
- Book early. When bodies appear, every Class I manufacturer in the EU will be looking for one.
- Fees must be reduced for micro, small and medium-sized enterprises, in proportion to their specific interests and needs (Art. 32(6)). Actual prices: no data yet.
- Open source exception: free and open-source Class I products can self-assess if the technical documentation is made public (Art. 32(5)).
- Write the technical documentation now. A notified body checks it; you cannot outsource writing it.
Not sure which category you are in?
Take the free "Does the CRA apply to me and what must I do by December 2027" check: 8 questions, about 3 minutes, result on screen and checklist by e-mail. Take the free check
Whatever the category, Earlybell does the recurring part: an SBOM with every release, a daily check of your dependencies, ready-to-send drafts of the 24-hour and 72-hour reports, and an up-to-date disclosure policy and security.txt. That is also the evidence a notified body will ask for. 49 EUR per product per month.
This article is based on Regulation (EU) 2024/2847 (Cyber Resilience Act), Implementing Regulation (EU) 2025/2392 and public status information on standards and notified bodies as of October 2026. It is not legal advice. Article numbers refer to Regulation (EU) 2024/2847.