CRA important and critical products

Important products are Annex III, class I and class II. Critical products are Annex IV

Direct answer. In Regulation (EU) 2024/2847 (OJ L, 2024/2847, 20.11.2024, ELI http://data.europa.eu/eli/reg/2024/2847/oj), Article 7 is titled “Important products with digital elements” and Article 8 is titled “Critical products with digital elements.” Article 7(1) says products with digital elements which have the core functionality of a product category set out in Annex III shall be considered important products with digital elements and shall be subject to the conformity assessment procedures referred to in Article 32(2) and (3). The integration of such a product shall not in itself render the product in which it is integrated subject to those procedures. Annex III is “IMPORTANT PRODUCTS WITH DIGITAL ELEMENTS”, divided into Class I and Class II. Annex IV is “CRITICAL PRODUCTS WITH DIGITAL ELEMENTS.” The lists below are copied from the English Official Journal text of that regulation. They are not a paraphrase, and this page does not add a category. Application dates are the CRA timeline. This page is not legal advice.

CRALedger (Shopify App Store · Write a review) tracks CRA product duties, Article 14 incident deadlines, encrypted ENISA SRP draft packs, vulnerability forwarding, and audit records. The listing does not say the app classifies a product as important or critical. Manufacturer duties are Article 13 and Article 14.

Related: EUDR Records Manager — DDS reference numbers on supplier lots.

Free check first: CRA role and scope self-check runs in your browser and sends nothing. Type what the product is and whether you make, import, or resell it. The page lists which articles to read. It does not say whether the Regulation applies.

Checklist before you treat a product as important or critical

Annex III, Class I

The English Official Journal text of Annex III, Class I, reads:

  1. Identity management systems and privileged access management software and hardware, including authentication and access control readers, including biometric readers
  2. Standalone and embedded browsers
  3. Password managers
  4. Software that searches for, removes, or quarantines malicious software
  5. Products with digital elements with the function of virtual private network (VPN)
  6. Network management systems
  7. Security information and event management (SIEM) systems
  8. Boot managers
  9. Public key infrastructure and digital certificate issuance software
  10. Physical and virtual network interfaces
  11. Operating systems
  12. Routers, modems intended for the connection to the internet, and switches
  13. Microprocessors with security-related functionalities
  14. Microcontrollers with security-related functionalities
  15. Application specific integrated circuits (ASIC) and field-programmable gate arrays (FPGA) with security-related functionalities
  16. Smart home general purpose virtual assistants
  17. Smart home products with security functionalities, including smart door locks, security cameras, baby monitoring systems and alarm systems
  18. Internet connected toys covered by Directive 2009/48/EC of the European Parliament and of the Council (1) that have social interactive features (e.g. speaking or filming) or that have location tracking features
  19. Personal wearable products to be worn or placed on a human body that have a health monitoring (such as tracking) purpose and to which Regulation (EU) 2017/745 or (EU) No 2017/746 do not apply, or personal wearable products that are intended for the use by and for children

Footnote (1) to that annex: Directive 2009/48/EC of the European Parliament and of the Council of 18 June 2009 on the safety of toys (OJ L 170, 30.6.2009, p. 1).

Annex III, Class II

The English Official Journal text of Annex III, Class II, reads:

  1. Hypervisors and container runtime systems that support virtualised execution of operating systems and similar environments
  2. Firewalls, intrusion detection and prevention systems
  3. Tamper-resistant microprocessors
  4. Tamper-resistant microcontrollers

Annex IV

The English Official Journal text of Annex IV, “CRITICAL PRODUCTS WITH DIGITAL ELEMENTS”, reads:

  1. Hardware Devices with Security Boxes
  2. Smart meter gateways within smart metering systems as defined in Article 2, point (23) of Directive (EU) 2019/944 of the European Parliament and of the Council (1) and other devices for advanced security purposes, including for secure cryptoprocessing
  3. Smartcards or similar devices, including secure elements

Footnote (1) to Annex IV: Directive (EU) 2019/944 of the European Parliament and of the Council of 5 June 2019 on common rules for the internal market for electricity and amending Directive 2012/27/EU (OJ L 158, 14.6.2019, p. 125).

Technical descriptions, not a second list

Article 7(4) says: “By 11 December 2025, the Commission shall adopt an implementing act specifying the technical description of the categories of products with digital elements under classes I and II as set out in Annex III and the technical description of the categories of products with digital elements as set out in Annex IV.” Commission Implementing Regulation (EU) 2025/2392 of 28 November 2025 (OJ L, 2025/2392, 1.12.2025) is that act. Its Article 1 says the technical description of the Annex III categories shall be as set out in Annex I to that implementing regulation, and the technical description of the Annex IV categories shall be as set out in Annex II to that implementing regulation. Those annexes describe the categories. This page does not copy the descriptions, and it does not treat them as extra categories.

What the class means for conformity assessment

Article 32 is titled “Conformity assessment procedures for products with digital elements.” Article 7(1) points important products to the procedures in Article 32(2) and (3). Article 8(1) empowers the Commission to adopt delegated acts requiring a European cybersecurity certificate for products with the core functionality of an Annex IV category, and says that where no such delegated act has been adopted, those products shall be subject to the procedures referred to in Article 32(3). The modules themselves, the CE marking, and the declaration of conformity are the CE marking guide. This page does not repeat that module list. Essential requirements stay on Annex I Part I. The software bill of materials stays on the SBOM guide.

A product that does not have the core functionality of a category in Annex III or Annex IV is not an important product under Article 7(1) and is not a critical product under Article 8. Article 32(1) is the conformity assessment the regulation states for products with digital elements in that general case.

What this page is not

Related pages

Confirm Annex III, Annex IV, Article 7, Article 8, and Article 32 on EUR-Lex before you treat a product as important or critical. CRALedger tracks CRA product duties, Article 14 incident deadlines, encrypted ENISA SRP draft packs, vulnerability forwarding, and audit records. It does not classify products.