EU Cyber Resilience Act by product
Most products are default class.
The EU Cyber Resilience Act (CRA) names important products in classes I and II and critical products; every other product with digital elements is in the default class. A product is important or critical only if its core functionality is listed in Annex III or IV. Each product here has a page with obligations, exceptions and an example.
Last reviewed:
Which class does my product have under the Cyber Resilience Act?
Most connected products are default class, such as machine tools, wallboxes, heat pumps and app-controlled washing machines. A product is important (class I or II, Annex III) or critical (Annex IV) only if its core functionality is listed there, such as a router or firewall (Art. 7(1), 8(1)). The class sets the conformity route, not the Annex I requirements.
Products
Which products have their own page?
Every page starts with the default case: whether the product is in scope, what the default class requires and which obligations apply in practice. Then come related products that are class I or II, such as a separately sold remote access gateway.
The four classes
How do the classes differ in conformity assessment?
| Class | Legal reference | Examples | Conformity assessment |
|---|---|---|---|
| Default | not listed in Annex III or IV | machine tool, PLC, wallbox, heat pump, app-connected washing machine, thermostat | Self-assessment under module A possible; alternatively modules B and C, module H or certification (Art. 32(1) EU CRA) |
| Important, class I | Annex III class I, items 1 to 19 | routers, managed switches, operating systems, network interface cards, smart locks and security cameras | Module A only with a harmonised standard, common specification or certification at assurance level 'substantial' or higher applied in full; otherwise modules B and C or module H (Art. 32(2)) |
| Important, class II | Annex III class II, items 1 to 4 | firewalls, hypervisors, tamper-resistant microcontrollers | Modules B and C, module H or European cybersecurity certification (Art. 32(3)) |
| Critical | Annex IV, items 1 to 3 | smart meter gateways, secure elements, hardware devices with security boxes | European cybersecurity certification where a delegated act requires it; otherwise as for class II (Art. 32(4)) |
Product finder
Your product isn't listed?
The finder shows the Cyber Resilience Act class of typical products in nine sectors and takes you to the page with obligations and reasoning.
By sector
Prefer to start from your sector?
The sector pages classify products from machinery to smart home, with the obligations that weigh most there.
Go to the sectors- CNCDefault productIndustrial Machinery
- machine toolDefault productIndustrial Machinery
- packaging machineDefault productIndustrial Machinery
- robot cellDefault productIndustrial Machinery
- injection mouldingDefault productIndustrial Machinery
- PLCDefault productIndustrial Components
- HMIDefault productIndustrial Components
- operator panelDefault productIndustrial Components
- frequency inverterDefault productIndustrial Components
- servo driveDefault productIndustrial Components
- tractorDefault productSmart Farming
- agricultural machineryDefault productSmart Farming
- sprayerDefault productSmart Farming
- combineDefault productSmart Farming
- thermostatDefault productSmart Home & Consumer
- smart bulbDefault productSmart Home & Consumer
- smart plugDefault productSmart Home & Consumer
- blindsDefault productSmart Home & Consumer
- inverterDefault productEnergy & Building Tech
- battery storageDefault productEnergy & Building Tech
- hybrid inverterDefault productEnergy & Building Tech
- wallboxDefault productEnergy & Building Tech
- EV chargerDefault productEnergy & Building Tech
- charging stationDefault productEnergy & Building Tech
- charge pointDefault productEnergy & Building Tech
- heat pumpDefault productEnergy & Building Tech
- heating controllerDefault productEnergy & Building Tech
- air conditionerDefault productEnergy & Building Tech
- washing machineDefault productIoT & Consumer Products
- ovenDefault productIoT & Consumer Products
- coffee machineDefault productIoT & Consumer Products
- fridgeDefault productIoT & Consumer Products
- dishwasherDefault productIoT & Consumer Products
- robot vacuumDefault productIoT & Consumer Products
- CNC machining centre or machine toolDefault productIndustrial Machinery
- Packaging or filling machine with remote maintenanceDefault productIndustrial Machinery
- Robot cell or assembly line with a built-in PLCDefault productIndustrial Machinery
- Industrial robot with robot controllerDefault productIndustrial Machinery
- PLC or HMI panel sold on its ownDefault productIndustrial Machinery
- Frequency inverter or servo drive sold on its ownDefault productIndustrial Machinery
- Remote-access gateway with VPN function, sold separatelyImportant product, class IIndustrial Machinery
- Industrial router or managed switchImportant product, class IIndustrial Machinery
- Operator login reader sold separatelyImportant product, class IIndustrial Machinery
- Control-platform operating system placed on the market separatelyImportant product, class IIndustrial Machinery
- Industrial firewall for cell protection, intrusion detection systemImportant product, class IIIndustrial Machinery
- Washing machine, oven, coffee machine or fridge with an appDefault productIoT & Consumer Products
- Robot vacuum or kitchen scale with an appDefault productIoT & Consumer Products
- Pet tracker, bike computer, headphones with an app, without health features and not made for childrenDefault productIoT & Consumer Products
- E-bike display or pedelec drive with an appDefault productIoT & Consumer Products
- Power tool with Bluetooth and an appDefault productIoT & Consumer Products
- Notification-only smartwatch for adultsDefault productIoT & Consumer Products
- Bluetooth toy car without voice, camera or location featuresDefault productIoT & Consumer Products
- Fitness tracker or smartwatch with heart rate or sleep trackingImportant product, class IIoT & Consumer Products
- Kids' smartwatch, GPS watch and other wearables for childrenImportant product, class IIoT & Consumer Products
- Talking doll, learning robot with camera, toy with location trackingImportant product, class IIoT & Consumer Products
- Solar or hybrid inverterDefault productEnergy & Building Tech
- Battery storage with storage controllerDefault productEnergy & Building Tech
- Wallbox and charging station, AC and DCDefault productEnergy & Building Tech
- Heat pump, heating and ventilation controller, room thermostatDefault productEnergy & Building Tech
- KNX, BACnet and Modbus devices without a security functionDefault productEnergy & Building Tech
- Lighting and blind control for buildingsDefault productEnergy & Building Tech
- Electronic electricity meter without a gatewayDefault productEnergy & Building Tech
- Building management system, EMS and HEMS with the manufacturer's cloudDefault productEnergy & Building Tech
- Remote maintenance gateway with VPN as core functionalityImportant product, class IEnergy & Building Tech
- LTE routers, internet modems and managed switches for site networksImportant product, class IEnergy & Building Tech
- Access control reader, including biometricImportant product, class IEnergy & Building Tech
- Firewall, IDS or IPS for building and control networksImportant product, class IIEnergy & Building Tech
- Smart meter gateway in a smart metering systemCritical productEnergy & Building Tech
- Frequency inverter or servo drive with fieldbusDefault productIndustrial Components
- PLC, I/O module or HMI panelDefault productIndustrial Components
- IO-Link sensor, encoder or light barrierDefault productIndustrial Components
- Industrial machine vision cameraDefault productIndustrial Components
- Transducer or power meter with ModbusDefault productIndustrial Components
- Microcontroller without security-related functionalitiesDefault productIndustrial Components
- Microcontroller, microprocessor, FPGA or ASIC with security-related functionalitiesImportant product, class IIndustrial Components
- Network interface card, fieldbus or radio module sold separatelyImportant product, class IIndustrial Components
- Managed industrial switch or routerImportant product, class IIndustrial Components
- Industrial firewall or intrusion prevention systemImportant product, class IIIndustrial Components
- Tamper-resistant microcontroller or microprocessorImportant product, class IIIndustrial Components
- Secure elementCritical productIndustrial Components
- Tractor with networked control units and a telematics moduleDefault productSmart Farming
- Implement with its own control unit, such as a sprayer or seed drillDefault productSmart Farming
- Autonomous field robotDefault productSmart Farming
- Livestock collar or ear-tag sensorDefault productSmart Farming
- Soil moisture sensor or weather station on LoRa or NB-IoTDefault productSmart Farming
- Farm gateway marketed as a router or modem for internet accessImportant product, class ISmart Farming
- Unmanaged switchDefault productTelecom & Networking
- VoIP or conference phoneDefault productTelecom & Networking
- TV receiver or set-top boxDefault productTelecom & Networking
- Smartphone or tabletDefault productTelecom & Networking
- Network-attached storage (NAS) for office and homeDefault productTelecom & Networking
- Network test instrument or cable tester with firmwareDefault productTelecom & Networking
- Router or DSL, cable or fibre modem for internet accessImportant product, class ITelecom & Networking
- Managed switch or wireless access pointImportant product, class ITelecom & Networking
- VPN gateway or VPN client as a product in its own rightImportant product, class ITelecom & Networking
- Network management system for router and switch fleetsImportant product, class ITelecom & Networking
- Network interface card or virtual network interface sold separatelyImportant product, class ITelecom & Networking
- Network firewall, IDS or IPSImportant product, class IITelecom & Networking
- Desktop client for Windows, macOS or Linux, including Electron appsDefault productSoftware & SaaS
- Mobile app, browser extension or command-line toolDefault productSoftware & SaaS
- Commercially licensed SDK or libraryDefault productSoftware & SaaS
- Source code licensed to customers who compile it themselvesDefault productSoftware & SaaS
- Engineering software for programming controllers and devicesDefault productSoftware & SaaS
- Office, graphics or CAD software, computer gameDefault productSoftware & SaaS
- Identity or privileged access management softwareImportant product, class ISoftware & SaaS
- Password manager, including open source sold with paid supportImportant product, class ISoftware & SaaS
- VPN client, anti-malware softwareImportant product, class ISoftware & SaaS
- SIEM or network management systemImportant product, class ISoftware & SaaS
- Operating system, standalone or embedded browserImportant product, class ISoftware & SaaS
- Hypervisor, container runtime, software firewall or IDS/IPSImportant product, class IISoftware & SaaS
- Sensor or actuator firmware without a security functionDefault productEmbedded Systems
- Motor controller or HMI panel with an Ethernet or USB portDefault productEmbedded Systems
- Data logger or edge device without a routing core functionDefault productEmbedded Systems
- Battery management system with CAN or Bluetooth interfaceDefault productEmbedded Systems
- Single-board computer or embedded PCDefault productEmbedded Systems
- Microcontroller without security-related functionalitiesDefault productEmbedded Systems
- Boot manager, RTOS or embedded Linux distribution sold on its ownImportant product, class IEmbedded Systems
- Microcontrollers, microprocessors, ASICs and FPGAs with security-related functionalitiesImportant product, class IEmbedded Systems
- Embedded gateway with a routing core function, network or radio moduleImportant product, class IEmbedded Systems
- Tamper-resistant microcontrollers and microprocessorsImportant product, class IIEmbedded Systems
- Embedded hypervisor, firewall or IDS applianceImportant product, class IIEmbedded Systems
- Secure element, smartcard controller or hardware security module (HSM)Critical productEmbedded Systems
- Radiator or room thermostat with appDefault productSmart Home & Consumer
- Smart bulb, smart plug or blind actuatorDefault productSmart Home & Consumer
- KNX, Zigbee or Matter actuator and switchDefault productSmart Home & Consumer
- Smart home hub for lighting, heating and shadingDefault productSmart Home & Consumer
- Smart TV, streaming stick or soundbarDefault productSmart Home & Consumer
- Wi-Fi or Bluetooth speaker without a voice assistantDefault productSmart Home & Consumer
- Heating controller or heat pump with appDefault productSmart Home & Consumer
- General-purpose home voice assistant, speaker or displayImportant product, class ISmart Home & Consumer
- Smart door lockImportant product, class ISmart Home & Consumer
- Indoor or outdoor security cameraImportant product, class ISmart Home & Consumer
- Baby monitor with video or appImportant product, class ISmart Home & Consumer
- Alarm system with hub, sensors and appImportant product, class ISmart Home & Consumer
- Wi-Fi router, mesh system or cable modemImportant product, class ISmart Home & Consumer
Frequently asked questions
Does an interface such as USB or Bluetooth decide the product class?+
A data or wireless interface decides whether a product falls under the Cyber Resilience Act (Art. 2(1) and Art. 3(9)). It does not decide the class: a Bluetooth sensor stays default class unless its core functionality is an Annex III or IV category. A radio module sold on its own is class I (Annex III item 10).
Does a class I component make my product class I?+
Building in a class I component, such as a router module or a microcontroller with security-related functionalities, does not make the end product an important product. Art. 7(1), second sentence, of the Cyber Resilience Act states that integration alone does not trigger the stricter procedures. The end product's own core functionality decides.
Does the Cyber Resilience Act apply to medical devices?+
Medical devices and in-vitro diagnostics covered by Regulations (EU) 2017/745 or 2017/746 are excluded from the Cyber Resilience Act by Art. 2(2); those regulations govern their cybersecurity. A fitness tracker that is not a medical device is in scope, though, and with a health-monitoring purpose it is class I (Annex III item 19).
Does the Cyber Resilience Act apply to vehicles?+
Motor vehicles and trailers, and the systems and components type-approved for them, to which Regulation (EU) 2019/2144 applies are excluded from the Cyber Resilience Act by Art. 2(2). That exclusion does not extend to accessories such as a wallbox or an aftermarket app, nor to tractors and agricultural machinery, whose type approval under Regulation (EU) No 167/2013 is not named in Art. 2.
Where are the Annex III and IV categories described in detail?+
Implementing Regulation (EU) 2025/2392 lays down the technical descriptions of the Annex III and IV categories of the Cyber Resilience Act. The EU Commission guidance (C(2026) 5252, section 6) adds how to determine a product's core functionality.
What if my product fits no category?+
A product with digital elements whose core functionality is not listed in Annex III or IV belongs in the default class of the Cyber Resilience Act. The manufacturer may self-assess it under module A (Art. 32(1)). According to the EU Commission guidance (section 6.1), the core functionality and its reasoning belong in the technical documentation.
When does conformity assessment have to be complete?+
Products placed on the EU market from 11 December 2027 need a completed conformity assessment under Art. 32 of the Cyber Resilience Act, an EU declaration of conformity and the CE marking. Reporting under Art. 14, for actively exploited vulnerabilities and severe incidents, has applied since 11 September 2026, including for products already sold.
Which class do your products fall into?
The EU CRA assessment gives you a first estimate of class, obligations and next steps in a few minutes.
This page is an orientation on the Cyber Resilience Act, not legal advice. Whether and how the regulation applies to a specific product depends on its intended purpose and design.