Guides · Updated 27 July 2026
Default, Important Class I, Class II or Critical: which are you?
The classification decides whether you can sign your own conformity paperwork or must pay a notified body. Here is the actual test, from Annex III, Annex IV and Article 32.
A default product can be self-assessed under module A. An Annex III Class I important product can be self-assessed only if harmonised standards, common specifications or an EU cybersecurity certification scheme at assurance level at least substantial are applied in full; otherwise module B+C or module H applies and a notified body is required. An Annex III Class II important product cannot be self-assessed at all. An Annex IV critical product uses a European cybersecurity certification scheme under Article 8(1), or the Class II routes where those conditions are not met.
Most products are default products
Annex III and Annex IV are lists of specific categories. If your product is on neither list, it is a default product, and default is the most common answer. A default product is self-assessed under module A. You write the technical documentation, you draw up the EU declaration of conformity, you apply the CE marking. No third party is involved.
Class I is the expensive edge case
Annex III Class I has nineteen categories, and several catch ordinary hardware. Routers, modems intended for connection to the internet, and switches are item 12. Operating systems are item 11. Smart home products with security functionalities, which explicitly includes smart door locks, security cameras, baby monitors and alarm systems, are item 17. Microcontrollers with security-related functionalities are item 14.
Article 32(2) is what makes this expensive. Class I stays on self-assessment only where harmonised standards, common specifications, or an EU cybersecurity certification scheme at assurance level at least substantial have been applied in full. Applied in part is not applied in full. Where they have not been applied, or do not yet exist, the product goes to module B+C or module H. Both involve a notified body.
The CRA harmonised standards are still being published. If you are Class I and cannot yet point to a harmonised standard you apply in full, plan on the notified body route and budget accordingly. Application fees average around EUR 1,540 and technical file review runs around EUR 317 an hour.
Class II removes the choice
Annex III Class II is four categories: hypervisors and container runtimes, firewalls and intrusion detection and prevention systems, tamper-resistant microprocessors, and tamper-resistant microcontrollers. Article 32(3) gives three routes, and module A is not among them. No level of standards adoption puts a Class II product back on self-assessment.
Critical is a certification scheme
Annex IV has three entries: hardware devices with security boxes, smart meter gateways and other devices for advanced security purposes including secure cryptoprocessing, and smartcards or similar devices including secure elements. Article 32(4) routes these to a European cybersecurity certification scheme under Article 8(1), falling back to the Class II routes where the Article 8(1) conditions are not met.
When several categories match, the highest wins
A product that is both a router (Class I item 12) and a firewall (Class II item 2) is a Class II product. Classification takes the highest applicable tier, not the first one you find. That quietly removes self-assessment from a product whose team stopped at the first box that fit.
Questions people actually ask
Is a router an important product under the CRA?
Yes. Annex III Class I item 12 covers routers, modems intended for connection to the internet, and switches. That makes self-assessment conditional on applying harmonised standards in full under Article 32(2).
Can a Class II product ever be self-assessed?
No. Article 32(3) offers module B+C, module H, or a European cybersecurity certification scheme at assurance level at least substantial. The internal control procedure under module A is not available.
What if my product falls in more than one Annex III category?
The highest applicable classification applies. A product matching both a Class I and a Class II category is treated as Class II.