Skip to content
AuCRA SecurityHub
Menu

Product class finder

Choose the category for your product's core functionality.

Core functionality and modules

Class follows what the product is for. A product that merely includes a firewall is not therefore Important II.

The Commission's non-binding guidance says a product has only one core functionality when its conformity assessment route is decided. The same guidance classifies a module that is also made available separately by its own core functionality, and a module supplied only as part of a larger product by that product's.

Implementing Regulation (EU) 2025/2392 gives the official technical description of each category.

Important I: Annex III, 19 categories

  • Identity management systems and privileged access management software and hardware, including authentication and access control readers, including biometric readers

  • Standalone and embedded browsers

  • Software that searches for, removes, or quarantines malicious software

  • Products with digital elements with the function of virtual private network (VPN)

  • Security information and event management (SIEM) systems

  • Public key infrastructure and digital certificate issuance software

  • Physical and virtual network interfaces

  • Routers, modems intended for the connection to the internet, and switches

  • Microprocessors with security-related functionalities

  • Microcontrollers with security-related functionalities

  • Application specific integrated circuits (ASIC) and field-programmable gate arrays (FPGA) with security-related functionalities

  • Smart home general purpose virtual assistants

  • Smart home products with security functionalities, including smart door locks, security cameras, baby monitoring systems and alarm systems

  • Internet connected toys covered by Directive 2009/48/EC that have social interactive features (e.g. speaking or filming) or that have location tracking features

  • Personal wearable products to be worn or placed on a human body that have a health monitoring (such as tracking) purpose and to which Regulation (EU) 2017/745 or (EU) 2017/746 do not apply, or personal wearable products that are intended for the use by and for children

Important II: Annex III, 4 categories

  • Hypervisors and container runtime systems that support virtualised execution of operating systems and similar environments

  • Firewalls, intrusion detection and prevention systems

Critical: Annex IV, 3 categories

  • Hardware Devices with Security Boxes

  • Smart meter gateways within smart metering systems as defined in Article 2, point (23) of Directive (EU) 2019/944, and other devices for advanced security purposes, including for secure cryptoprocessing

  • Smartcards or similar devices, including secure elements

Default: not listed in Annex III or IV

  • My product's core functionality is not one of the 26 named categories.

Your resultNo category chosen yetDefaultYou can assess it yourselfImportant ISelf-assessment only with standardsImportant IIA third party, alwaysCriticalEU certification or a third party

Your result

No category chosen yet

Likely class: Default

You can assess it yourself

You can check the product yourself under internal control (module A). You may also choose a third-party procedure, or a European cybersecurity certification scheme where one is available and applicable.

Compliance matrixDeclaration of conformity drafter

Likely class: Important I

Self-assessment only with standards

You can still assess it yourself, but only if you apply harmonised standards, common specifications or an EU cybersecurity certification scheme in full. Otherwise a third party has to be involved.

Free and open-source software

If your product is free and open-source software, you may also use internal control (module A), provided you make the technical documentation public when you place it on the market.

Compliance matrixDeclaration of conformity drafter

Likely class: Important II

A third party, always

A third party is required even if you conform to the standards completely.

Free and open-source software

If your product is free and open-source software, you may also use internal control (module A), provided you make the technical documentation public when you place it on the market.

Compliance matrixDeclaration of conformity drafter

Likely class: Critical

EU certification or a third party

Where the conditions in Article 8(1) are met, you use a European cybersecurity certification scheme. Otherwise you use one of the procedures for Important II products, so a critical product never has a lighter route than Important II.

Compliance matrixDeclaration of conformity drafter

Sources: CRA Art. 32; Annexes III and IV; Implementing Regulation (EU) 2025/2392

Not sure the CRA applies to your product? Start with the scope check.

Compass, our free guided assessment for SMEs, also checks organisational maturity and reporting readiness. Try Compass free