normakte / Important and critical products
The classification decides whether the manufacturer may assess conformity itself or needs a notified body. Internal control applies to the vast majority of products.
| Category | Examples | Procedure |
|---|---|---|
| Default | most connected devices and programs | internal control (module A) |
| Important, class I | e.g. routers, operating systems, password managers, smart home products with security functions | module A only with full application of harmonised standards or common specifications; otherwise B+C or H |
| Important, class II | e.g. firewalls, hypervisors, tamper-resistant microprocessors | B+C or H, or European cybersecurity certification |
| Critical | e.g. smart meter gateways, smart cards and secure elements | European cybersecurity certification where required; otherwise as class II |
The complete lists are in Annexes III and IV; the Commission sets out the technical descriptions. Check the classification before development is finished: a notified body needs lead time.
Register with all CRA requirements, classification, SBOM, reports with deadlines, support period and a target page for user information – one trial file free until 20.01.2027.
Source. Regulation (EU) 2024/2847, OJ L, 2024/2847 of 20.11.2024. Summarised; only the official text is authoritative. normakte is not legal advice.