What are the four product categories of the EU Cyber Resilience Act (CRA), and how does the conformity assessment for the CE mark differ between them?
Default allows self-assessment. Important class I allows self-assessment only with a harmonised standard, otherwise third-party. Important class II requires a third-party assessment. Critical requires third-party and may require an EU cybersecurity certificate (EUCC).
* The more harm a failure could do, the less the manufacturer may assess itself. *
The CRA (Regulation (EU) 2024/2847) puts cybersecurity requirements on every product with digital elements sold in the EU. How strictly compliance is checked depends on the category:
| Category | What it covers | Conformity assessment |
|---|---|---|
| Default | Everything not listed in Annex III or IV, roughly 90 % of the market (smart fridges, games, educational software) | Manufacturer self-assessment |
| Important class I (Annex III) | Products with a significant security function (browsers, password managers, VPNs, smart locks) | Self-assessment only if a harmonised standard is applied in full; otherwise third-party |
| Important class II (Annex III) | Higher-risk products, often professional (hypervisors, firewalls, IDS) | Mandatory third-party assessment by a notified body |
| Critical (Annex IV) | Products whose failure endangers infrastructure, utilities or finance (HSMs, smartcards, smart meter gateways) | Third-party; may require a European cybersecurity certificate (EUCC) |
The logic is a ladder: the more harm a failure could do, the less the manufacturer is trusted to grade its own work. Implementing Regulation (EU) 2025/2392 describes the listed categories technically, which settles which concrete products fall into them.
Go deeper:
European Commission — Cyber Resilience Act — official overview of scope, categories and conformity assessment- ENISA — EUCC certification scheme — the EU Common Criteria-based scheme that Critical products may need
- Cyber Resilience Act (Wikipedia) — background, timeline and criticism