Under the CRA, which category do these products fall into: a password manager, a smart door lock, a hypervisor, a firewall, a hardware security module, a smart refrigerator?

Password manager and smart door lock: Important class I. Hypervisor and firewall: Important class II. HSM: Critical. Smart refrigerator: Default.

• Default: a connected fridge or toaster, a consumer game, educational software. Nothing in them is a security function, so self-assessment is enough.
• Important class I: the product's job touches security, but it is mainly consumer or general purpose. Password managers, browsers, VPNs, antivirus, identity and access management including biometric readers, and smart home security products (door locks, cameras), plus health-tracking wearables.
• Important class II: the product enforces security for other systems, often in professional use. Hypervisors and container runtimes, firewalls, intrusion detection and prevention, tamper-resistant microprocessors.
• Critical: the product guards secrets whose compromise hits infrastructure or finance. HSMs, smartcards and secure elements, smart meter gateways, and devices in tamper-responsive enclosures such as secure payment terminals.

Tip: ask what breaks if the product fails. The user's convenience (Default), the user's own security (class I), many systems behind it (class II), or a grid or a bank (Critical).

Go deeper:

• CRA Annex III — important products, class I and II — the full legal list to check a product against
• CRA Annex IV — critical products — the short list of critical product types