Does your product fall under the EU Cyber Resilience Act (CRA)? If so, which category does it belong to? This article explains the CRA’s scope, exclusions, product classifications, and conformity assessment routes, along with the product information manufacturers need to make an informed assessment.
.avif)
When preparing for the EU Cyber Resilience Act (CRA), companies usually need to answer two questions first: Does the CRA apply to their product? If so, which category does it fall into?
The first determines whether the product needs to comply with the CRA. The second affects the conformity assessment procedure, including whether the manufacturer can conduct a self-assessment or must involve a third party.
.avif)
The assessment can start with three questions about the product, its market, and its connectivity:
If the answer to all three questions is yes, the next step is to check the CRA’s exclusions.
Certain medical devices, motor vehicle-related products, and marine equipment covered by specific EU legislation may fall outside the CRA’s scope. The same applies to certain aviation products that meet the relevant conditions. Products developed exclusively for national security or defence purposes are also excluded.
The conclusion depends on the specific product and applicable legislation. It cannot be determined solely by the industry to which the product belongs.
Several situations are easy to overlook.
.avif)
Once a product falls within the CRA’s scope, its classification depends primarily on the core functionality of the complete product, rather than its name or the components it contains.
For example, two products may both be called gateways, but an ordinary home gateway and a gateway primarily designed for network isolation and intrusion prevention may fall into different categories.
Similarly, a router does not automatically become a Class II firewall simply because it includes a firewall component. The classification still depends on the product’s primary function.
Annex III and Annex IV of the CRA list the categories of important and critical products. Implementing Regulation (EU) 2025/2392 provides further technical descriptions. Manufacturers should assess the product’s functionality against the relevant descriptions when determining its classification.
Class I products require particular attention to the conditions for self-assessment.
For the relevant essential cybersecurity requirements, manufacturers must apply applicable harmonised standards, common specifications, or European cybersecurity certification schemes that meet the conditions set out in the CRA.
If these have not been applied, have only been partially applied, or the relevant standards, specifications, or schemes are not yet available, the corresponding requirements must undergo third-party conformity assessment as prescribed.
After determining the product category, manufacturers therefore need to confirm whether the standards or schemes they intend to rely on are available and applicable. Being classified as Class I does not automatically mean that self-assessment is permitted.
Product classification also affects project planning.
Incorrectly classifying a product that qualifies for self-assessment as requiring third-party assessment may increase costs. Conversely, preparing a product that requires third-party assessment solely for self-assessment may result in additional testing and assessment work later.
Determining both CRA applicability and product classification requires a clear understanding of how the product actually works.
Manufacturers should collect at least the following information:
Only with a complete and accurate understanding of the product’s technical and commercial characteristics can the appropriate compliance route be determined based on reliable facts rather than assumptions or comparisons with other products.
