CRA GUIDE

Is your product in scope of the CRA? Product classes explained

By The Lapwing · Last updated

Probably yes, if you sell it in the EU and it can exchange data with another device or a network, directly or indirectly. Most such products fall into the default class and need only a manufacturer self-assessment. A short list of security-critical product types (Annex III and IV) needs stricter assessment by a third party or certification.

Not sure it applies to you? Take the free 2-minute scope check →

How do I decide if my product is in scope?

  1. Does it have digital elements and a data connection?Hardware or software that can connect to a device or network, logically or physically. No → outside the CRA.
  2. Is it excluded?Medical devices, motor vehicles, civil aviation, marine equipment, defence → covered by their own rules.
  3. Is it on the Annex III or IV list?No → default class. Yes → Important I, Important II or Critical.
  4. Which assessment route follows?Self-assessment, third-party assessment or certification, then CE marking.

The test comes from Art. 2 of the Regulation: the intended or reasonably foreseeable use includes a direct or indirect logical or physical data connection. It is about ability to connect, not about whether you call the product “IoT”.

What are the product classes?

Class Typical embedded examples Assessment
Default (most products) Sensors, controllers, appliances, gateways without security function Self-assessment
Important I (Annex III) Routers, switches, smart locks, cameras, alarm systems, wearables, microcontrollers with security functions Self-assessment only with harmonised standards, common specifications or a certification scheme; otherwise third party
Important II (Annex III) Firewalls, IDS/IPS, hypervisors, tamper-resistant microcontrollers Third-party assessment
Critical (Annex IV) Hardware security boxes, smart-meter gateways, smartcards and secure elements Certification, where required by the Commission

A class is not a quality rating — it describes how strictly the product’s conformity must be checked. The Commission can amend the lists over time, so verify the current version for your product.

Which five traps catch embedded makers?

  1. “No network” is not an exit. A physical data connection such as USB or a serial port can already put a product in scope.
  2. Parts do not set your class. Classification follows your product’s core functionality. A listed microcontroller is Class I when sold as a product; it does not automatically make the appliance around it Class I.
  3. “Sold before 2027” is not a free pass. Reporting applies today, and a substantial modification, such as a firmware change that alters the risk, can pull a product into the full regime (Art. 69).
  4. Self-assessment is still work. Default products still need a risk assessment, technical documentation, an SBOM and an EU declaration of conformity — you just sign them off yourself.
  5. Radio products have two regimes. Radio equipment also falls under the RED cybersecurity rules (EN 18031). How the two interact is still being clarified, so check both.

What should I do next?

Run the free scope check: it estimates your scope, likely class and first steps from your answers. For the broader picture, read what the CRA requires of manufacturers.

Frequently asked questions

Is my cloud backend or app covered?

Remote data processing solutions that are part of your product's functionality are covered with the product. Standalone software-as-a-service with no connection to a product is not covered by the CRA, but may fall under NIS2.

Do I need a notified body?

Only for important Class II products, and for Class I products that do not apply harmonised standards, common specifications or a certification scheme. Default products use self-assessment. Critical products may be required to use European cybersecurity certification.

Is open-source software in scope?

Commercial open-source software is in scope; software developed and supplied non-commercially is not. If you ship open-source components in your product, you remain responsible for due diligence on them.

What if I only integrate modules from suppliers?

You are still the manufacturer if the product carries your name. You must be able to show that components, including firmware from suppliers, meet the requirements, and request the evidence from your suppliers.

Find out where your product stands

Two minutes, answers stay in your browser. You get a likely scope, product class and first steps — then decide if you want a deeper look.

Start the scope check →Request a Pilot

Read next: What is the Cyber Resilience Act? A guide for device makers →

General information based on Regulation (EU) 2024/2847, not legal advice. It does not certify or guarantee compliance of any product.