EU CRA for telecom and network equipment
A documented classification for your network products, and patches for as long as you support them.
For router, modem, switch and firewall makers: where your product lines are likely to sit in Annex III of the Cyber Resilience Act. That placement decides whether self-assessment is an option.
Last reviewed:
- Applies in full
- 11 December 2027
- Early warning
- 24 hours · Art. 14(2)(a)
- Support period
- at least 5 years · Art. 13(8)
- Most common class here
- Default product
Which conformity assessment route applies to routers, switches and firewalls?
Under the Cyber Resilience Act, firewalls and intrusion detection or prevention systems are Class II important products (Annex III, Class II, point 2 EU CRA) and always involve a third party: module B with C, module H, or a European cybersecurity certificate at assurance level substantial or higher (Art. 32(3)). Routers, internet modems and switches sit in Class I, point 12. Their manufacturer can self-assess under module A only by fully applying harmonised standards, common specifications or such a certificate; otherwise module B with C or module H applies (Art. 32(2) EU CRA).
Product classes
Which network products are class I under Annex III of the Cyber Resilience Act, and which are default class?
Annex III of the Cyber Resilience Act lists much of a typical network portfolio, because these products protect other networks or run central functions such as network management (Art. 7(2) EU CRA). Classification follows core functionality (Art. 7(1)), and Implementing Regulation (EU) 2025/2392 describes the categories technically. Not every network device is listed: unmanaged switches, VoIP phones, set-top boxes and test equipment stay in the default class.
Spread in this sector
Pick a product
Unmanaged switch
Why this class
Implementing Regulation (EU) 2025/2392 describes item 12 switches as having a management plane; without one, no Annex III category applies.
Conformity route
- 1Risk assessment
- 2Self-assessment (module A)
- EU declaration of conformity + CE
Self-assessment by the manufacturer, Art. 32(1) EU CRA.
An assessment based on typical core functions. Your product's intended purpose and design decide.
All product examples as a table+
| Product | EU CRA class | Why |
|---|---|---|
| Unmanaged switch | Default product | Implementing Regulation (EU) 2025/2392 describes item 12 switches as having a management plane; without one, no Annex III category applies. |
| VoIP or conference phone | Default product | No category in Annex III or IV; self-assessment under module A (Art. 32(1) EU CRA). |
| TV receiver or set-top box | Default product | No category in Annex III or IV. |
| Smartphone or tablet | Default product | The built-in operating system does not make the device an item 11 product (EU Commission guidance, chapter 6, example 58). |
| Network-attached storage (NAS) for office and home | Default product | No category in Annex III or IV. |
| Network test instrument or cable tester with firmware | Default product | In our assessment no category in Annex III or IV; self-assessment under module A then applies (Art. 32(1) EU CRA). |
| Router or DSL, cable or fibre modem for internet access | Important product, class I (Annex III) | Annex III, class I, point 12 EU CRA. |
| Managed switch or wireless access point | Important product, class I (Annex III) | Annex III, class I, point 12; Implementing Regulation (EU) 2025/2392 counts wireless access points as bridges. |
| VPN gateway or VPN client as a product in its own right | Important product, class I (Annex III) | Annex III, class I, point 5 EU CRA (VPN). |
| Network management system for router and switch fleets | Important product, class I (Annex III) | Annex III, class I, point 6 EU CRA. |
| Network interface card or virtual network interface sold separately | Important product, class I (Annex III) | Annex III, class I, point 10 EU CRA (physical and virtual network interfaces). |
| Network firewall, IDS or IPS | Important product, class II (Annex III) | Annex III, class II, point 2 EU CRA. |
Your product isn't listed? The maturity assessment gives a first classification for your own product. Start the EU CRA assessment →
Annex IV, the list of critical products, names no routers, switches or firewalls, only smartcards and secure elements sold as products (point 3). Outside the regulation: equipment built exclusively for national security or defence (Art. 2(7) EU CRA) and identical spare parts (Art. 2(6)).
Obligations
What network equipment manufacturers owe under the Cyber Resilience Act
- 01
A named manufacturer for carrier and white-label devices
Art. 3(13) and Art. 21 EU CRA
Whoever markets a router under its own name or trademark is its manufacturer, even when an ODM builds it (Art. 3(13) EU CRA). An importer or distributor selling a device under its own brand takes on Articles 13 and 14 (Art. 21); for carrier-branded equipment, that is the brand owner.
- 02
Locked down from the factory
A router or switch ships with a secure default configuration and a reset to its original state (Annex I, Part I, point 2(b) EU CRA). Management access requires authentication, suspected unauthorised access is reported (point 2(d)), and attack surfaces stay limited, external interfaces included (point 2(j)).
- 03
Staying available under attack
Annex I, Part I, point 2(h), (i) and (l) EU CRA
Essential functions stay available after an incident, with mitigation against denial-of-service attacks (point 2(h)). The device limits its impact on services of other networks (point 2(i)) and records access to data, services and functions, with a user opt-out (point 2(l)).
- 04
Knowing what your firmware contains
A product comes with a machine-readable software bill of materials covering at least its top-level dependencies (Annex I, Part II, point 1 EU CRA). A flaw found in an integrated component, a chipset driver say, goes to its maintainer along with any fix the manufacturer wrote (Art. 13(6)).
- 05
Updates for the installed base
Annex I, Part I, point 2(c) and Part II, points 2 and 4–8 EU CRA
Where applicable, security updates install automatically by default, with an opt-out (Part I, point 2(c)), and ship apart from feature updates where feasible, securely and free of charge (Part II, points 2, 7 and 8). A disclosure policy names a contact address for researchers, and fixed issues are published once a patch is out (points 4 to 6).
Related regulation
What changes for radio equipment when Delegated Regulation (EU) 2022/30 is repealed?
Once the Commission repeals or amends Delegated Regulation (EU) 2022/30 so that it no longer covers a product, the cybersecurity requirements for Wi-Fi routers, cellular modems and other radio equipment come from the Cyber Resilience Act alone (Recital 30 EU CRA). Until then, both apply.
Delegated Regulation (EU) 2022/30
Delegated Regulation (EU) 2022/30 activates three requirements of the Radio Equipment Directive 2014/53/EU for certain radio equipment: no network harm (Art. 3(3)(d)), protection of personal data and privacy (point (e)) and protection from fraud (point (f)).
Annex I of the Cyber Resilience Act
Annex I includes all elements of those three requirements, so radio evidence carries into the Annex I assessment, with the vulnerability handling of Part II on top.
Existing certificates
EU type-examination certificates on cybersecurity issued under other harmonisation legislation stay valid for a transitional period unless they expire earlier (Art. 69(1) EU CRA).
Standardisation request C(2022) 5637
Standards from this request are to inform the harmonised standards for the Cyber Resilience Act; presumption of conformity starts once a reference is published in the Official Journal (Art. 27(1) EU CRA).
In practice
Where network equipment makers get stuck
Shared firmware across SKUs
Routers and switches often start from a chipset vendor's reference design and ship in variants by region, radio band, ports or customer brand. A kernel or TLS library flaw hits them all, and the manufacturer has to know which firmware runs on which variant.
Chipset SDKs on someone else's schedule
Drivers, bootloader and parts of the kernel often arrive as the chipset vendor's SDK. That vendor's release cycle decides how fast a fix arrives, and the SDK can drop out of maintenance before your support period ends.
Datasheet language and the Class II question
A router whose datasheet calls it a security gateway with firewall features invites the Class II question. Promotional material, instructions and technical documentation are read together; inconsistencies between them cannot be used to escape the stricter procedure (EU Commission guidance, chapter 6).
Evidence requests in operator tenders
Operators must manage supply chain security under Art. 21(2)(d) NIS2, so their tenders ask equipment makers for security evidence, often in their own format.
With Kunnus
How Kunnus supports network equipment manufacturers
Kunnus keeps classification, components, vulnerabilities and reports under the Cyber Resilience Act per device and variant. Radio Equipment Directive evidence stays in your CE process.
Worked example
Worked example: a TLS flaw across a DSL and fibre router range
A DSL and a fibre router family share a chipset platform, both sold wired only, with Wi-Fi, or with Wi-Fi plus cellular backup, in two colours. Differing components make separate products (EU Commission guidance, chapter 2); colours share documentation (chapter 7).
- 1Portfolio2 families × 3 radio configurations × 2 colours = 12 SKUs, but 6 products, with 6 risk assessments and declarations of conformity
- 2Radio equipment4 of the 6 have Wi-Fi or cellular and also fall under Delegated Regulation (EU) 2022/30 until its repeal
- 3Componentsone firmware tree: Linux kernel, a TLS library, a Wi-Fi driver from the chipset SDK
- 4Actively exploited vulnerabilityin the TLS library, so all 6 are affected; the early warning lists, per product, the member states where it is available (Art. 14(2)(a) EU CRA)
- 5Per yeara Wi-Fi 7 model joins as product 7, and the six older products stay in support alongside it
Illustrative assumptions, not industry statistics.
Frequently asked questions
Is a wireless access point an important product under the Cyber Resilience Act?+
The Cyber Resilience Act does not name wireless access points in Annex III, whose Class I, point 12 lists routers, internet modems and switches. In our reading, Implementing Regulation (EU) 2025/2392 places bridges such as access points under switches, which would make an access point a Class I product on the route of Art. 32(2) EU CRA.
Does a network interface card fall under Annex III, point 10?+
A network interface card sold as a product of its own falls under Annex III, Class I, point 10 of the Cyber Resilience Act. A device that merely contains an Ethernet or Wi-Fi port does not: integrating such a product does not by itself subject the host to Art. 32(2) and (3) (Art. 7(1), second sentence).
Can a router manufacturer self-assess under the Cyber Resilience Act?+
Self-assessment for a router under the Cyber Resilience Act depends on the harmonised standard: it has to cover at least the risks of the core functionality, with documented measures for extra functions (EU Commission guidance, chapter 6). Router software released as free and open-source software may use any procedure in Art. 32(1), module A included, if its technical documentation is public at placing on the market (Art. 32(5) EU CRA).
Are firewalls Class II products that require a notified body?+
Since Chapter IV of the Cyber Resilience Act took effect on 11 June 2026, conformity assessment bodies can be notified for the third-party assessment that Class II firewalls require. For micro, small and medium-sized enterprises, its fees are to be reduced in proportion to their needs (Art. 32(6) EU CRA).
Does Article 14 reporting apply to routers already on the market?+
Article 14 of the Cyber Resilience Act also covers routers, switches and firewalls placed on the market before 11 December 2027 (Art. 69(3) EU CRA). Since 11 September 2026, manufacturers have owed an early warning within 24 hours of becoming aware of an actively exploited vulnerability, a notification within 72 hours and a final report within 14 days of a fix (Art. 14(2)). All three go to the coordinating CSIRT and ENISA via the single reporting platform (Art. 14(1)).
How long must network equipment receive security updates?+
Network equipment receives security updates for a support period matching its expected time in use, at least five years unless use is expected to be shorter (Art. 13(8) of the Cyber Resilience Act). Support periods of bought-in components with core functions, such as a chipset platform, may be weighed in. Buyers see the end date, at least month and year, at purchase (Art. 13(19)).
Which class do your network products fall into?
The EU CRA assessment gives a first estimate of your product class in a few minutes, plus next steps.
Further reading
Other sectors
EU CRA compliance in other industries
Source: Regulation (EU) 2024/2847 (Cyber Resilience Act), Official Journal of the EU. https://eur-lex.europa.eu/eli/reg/2024/2847/oj
This page is an orientation on the Cyber Resilience Act for this sector, not legal advice. Whether and how the regulation applies to a specific product depends on its intended purpose and design.