Ordinary, important or critical: which group is your product in?

Why the group matters

Every covered product has to be equally secure. What the group changes is who checks that it is: you, an outside body, or a formal certification scheme.

Default products may self-assess their conformity. Important products (Annex III, class I and class II) and critical products (Annex IV) follow stricter routes — with one condition worth knowing. A class I manufacturer that applies in full the harmonised standards, common specifications or a European cybersecurity certification scheme at assurance level at least substantial covering its product is not pushed off the ordinary routes at all, internal control included; it is where those are absent, or applied only in part, that an approved outside body has to be involved. Class II and critical products have no internal-control route on the ordinary path. One exception runs across the whole of Annex III, class II included: a manufacturer of free and open-source software may use the ordinary routes, internal control included, provided the technical documentation is public at the time the product is placed on the market. That exception does not reach the critical products in Annex IV.[Arts. 7, 8, 32; Annexes III, IV]

It also decides whether we are the right people to help you. We work on ordinary products, which is most of what a small manufacturer makes, and we say so plainly when a product belongs somewhere else.

Ten minutes with the steps below gets most products to a defensible answer. The last step, writing down why, is the one people skip and the one an inspector asks about.

Step 1: is the product covered at all?

The group only matters if the law covers the product. Three questions:

• Does it have software in it, and can it connect to a device or a network, directly or indirectly? A product with digital elements is a software or hardware product and its remote data processing solutions, including software or hardware components placed on the market separately.[Art. 3(1)] The Regulation applies to a product with digital elements whose intended purpose or reasonably foreseeable use includes a direct or indirect data connection — logical or physical — to a device or network. This is the first scoping question, and it is the only test Article 2(1) sets: nothing in it turns on how big the company is or where it is based.[Art. 2(1)] A connection counts as indirect when the product does not reach a device or network by itself, but does so as part of a larger system that is directly connectable. That test settles how a product is connected, not who owes what. A component is a product in its own right when it is placed on the market separately; a part a manufacturer builds into its own product and never supplies on its own is covered through the product around it instead. And building in a component that belongs to one of the important or critical categories does not by itself put the surrounding product into that category.[Art. 3(10); Art. 3(1); Art. 7(1)]
• Do you make it available in the EU in the course of doing business? Making a product available on the market means supplying it for distribution or use on the Union market in the course of a commercial activity, whether it is paid for or free, and placing on the market is the first such supply. Because the test is supply onto the Union market, a seller established outside the EU is caught in the same way as one inside it, and the size of the company makes no difference. The Regulation does not define "commercial activity" itself; the examples usually quoted for it come from the recitals, which guide interpretation rather than bind.[Art. 3(21), Art. 3(22); recitals for the commercial-activity examples]
• Is it already covered by another rulebook that takes over? The sector carve-outs are a short, closed list. Products to which the medical device, the in-vitro diagnostic or the motor vehicle type-approval Regulations apply are outside the Cyber Resilience Act, and so is equipment within the scope of the marine equipment Directive. Civil aviation works differently and more narrowly: what is outside is a product that has actually been certified under the EU civil aviation Regulation, not aviation equipment as a class, so an uncertified product sold into that sector is fully in scope. Outside as well are products developed or modified exclusively for national security or defence purposes — "exclusively" is the whole of that gate, and it asks what the product was developed or modified for rather than who buys it, so neither a product also sold commercially nor a general-market product whose customers today are all defence ones is carved out — and, on a different test, products specifically designed to process classified information. Any wider limitation or exclusion for products covered by other Union rules needs a Commission delegated act; no other rulebook displaces this one by itself. One such act has now been adopted and it takes out a whole sector — the L-category vehicles of Regulation (EU) No 168/2013 — so the closed list above is no longer the whole of the answer, and that sector exclusion has to be read with it.[Art. 2(2), 2(3), 2(4), 2(5), 2(7)]

Yes, yes, no means carry on. If you are unsure about the cloud half of a product, or about open source with money around it, use the scope check or get a scoping memorandum.

Step 2: write down what the product does

Everything it does, not only the headline. The groups are defined by function, and one box can have three of them. A building controller that also terminates a VPN and serves a configuration page has three functions to check, not one.

List them in ordinary words: "moves traffic between two networks", "stores passwords", "manages other devices", "takes payments", "runs other people's code", "controls a physical lock".

Step 3: compare each function with the lists

The law lists the products that count as important or critical.

Important products with digital elements are listed in Annex III in two classes; the Commission may update the list by delegated act.[Art. 7; Annex III] Critical products with digital elements are listed in Annex IV and may be required by delegated act to obtain a European cybersecurity certificate.[Art. 8; Annex IV]

Compare each function with them, and then ask the question the law actually asks: is that function the core of what the product is? If none of them is, the product is ordinary.

Two traps sit exactly here. A product that merely contains a listed component is not automatically in that class; what counts is whether the listed function is what the product is. A machine running embedded Linux that happens to include a firewall package is not a firewall. And "general purpose" does not mean ordinary: an operating system, or a general-purpose chip with security functions, is on the list.

Where a product genuinely looks like it belongs in two different classes, we take the stricter one. That is our rule for getting to a single answer, not a tie-break the law writes down.

Important, class I:

Annex III class I includes, among others, identity and privileged access management software and hardware — including the readers and devices that check a badge, a card, a code or a fingerprint, for access to systems or to buildings — browsers, password managers, anti-malware software, VPN products, network management systems, SIEM systems, boot managers, public-key infrastructure and digital certificate issuance software, network interfaces, operating systems, routers, internet modems and switches, microprocessors, microcontrollers, ASICs and FPGAs with security-related functions, smart home general-purpose virtual assistants, smart home products with security functions such as locks, cameras, baby monitors and alarms, connected toys that come under EU toy safety law and that talk, film or track location, and personal wearables that track health outside medical device law or that are meant to be used by and for children.[Annex III, Class I]

Important, class II:

Annex III class II covers hypervisors and container runtimes that run operating systems, or similar environments, in virtualised form; firewalls and intrusion detection or prevention systems; and tamper-resistant microprocessors and microcontrollers. The binding technical description of those last two categories is narrower than the heading, so a chip on that boundary has to be read against the description before either conclusion is drawn.[Annex III, Class II]

Critical:

Annex IV (critical products) covers hardware devices built around a protected enclosure that resists physical attack, such as payment terminals, hardware security modules and tachographs; smart meter gateways inside smart metering systems, and other devices built for advanced security purposes, including devices that carry out cryptographic processing securely; and smartcards or similar devices, including secure elements such as identity and travel documents, payment and access cards, SIM and eSIM chips, trusted platform modules, qualified signature cards and digital tachograph cards. The binding technical description of the secure-element category is narrower than the heading, so a part on that boundary has to be read against the description before either conclusion is drawn.[Annex IV]

A worked example

An industrial gateway: embedded Linux, the vendor's own firmware, a web page for configuration, a data feed to the customer's system, and a VPN client used only to fetch updates.

Its functions: collect sensor data, forward it, serve a configuration page, run a VPN client, update itself. For each one, ask whether the gateway is that kind of product or merely uses that kind of part. A gateway forwarding its own sensor data is not a router as a product category. The VPN client is where a ten-minute check stops and a written opinion starts: the class I list is worded there by function rather than by product type, and our own scope check treats a product that provides a VPN as being on it. Record it as a line you had to interpret and get it looked at, rather than settling it in your own favour. A gateway sold to route traffic between a customer's networks would be a different conversation again.

The scoping memorandum records which of those it is, why, and how confident you are. That is the difference between a defensible answer and a guess.

Step 4: read off who checks your work

Conformity assessment uses the modules in Annex VIII. A default product may use internal control (module A), or, if the manufacturer prefers, EU-type examination with production control (modules B and C), full quality assurance (module H), or a European cybersecurity certification scheme where one is available and applicable. An important class I product must go to a notified body under modules B and C or under module H whenever the manufacturer has not applied, or has applied only in part, harmonised standards, common specifications or a European cybersecurity certification scheme at assurance level at least substantial — and also where no such standard, specification or scheme exists at all. An important class II product must use modules B and C, module H, or such a certification scheme; there is no internal-control route for it.[Art. 32(1), 32(2), 32(3); Annex VIII]

In practice:

• Ordinary: you check your own work. You do the risk assessment, write the paperwork, keep the evidence and sign the declaration.
• Important, class I: you can still check your own work, but only if you apply in full the European standards, or the equivalent rules written for that kind of product. Apply them only in part, or find that none exist, and an outside body does the assessment. There are three routes to a presumption of conformity, not one. A product that conforms to a harmonised standard whose reference has been published in the Official Journal is presumed to conform to the essential requirements that standard covers; so is one that conforms to common specifications laid down in a Commission implementing act; and so is one for which an EU statement of conformity or a certificate has been issued under a European cybersecurity certification scheme, so far as it covers those requirements. Where the Commission has specified a scheme for this purpose, a certificate under it at assurance level at least substantial also removes the need for a third-party conformity assessment for the requirements that certificate covers — not for conformity assessment at large.[Art. 27(1), 27(5), 27(8), 27(9)] As at 10 September 2026, no harmonised standard for the Cyber Resilience Act had had its reference published in the Official Journal, so the presumption of conformity that comes with a harmonised standard was not available and our controls are versioned against the drafts. This is a point-in-time check: it must be re-read and re-dated before it is quoted anywhere, because the day a reference is published the sentence stops being true.[Regulation (EU) 2024/2847 Art. 27(1) — the presumption attaches on publication of the reference in the Official Journal by the Commission, not on adoption by CEN-CENELEC, so the page in source_url cannot evidence an absence from the Official Journal and is the wrong source for this row. The value is the date we last checked, not a figure from the provision.] As at 10 September 2026 no harmonised standard had been published for the Cyber Resilience Act, so a class I manufacturer could not reach the internal-control route by that road. That is a point-in-time check and not a permanent state: the day a reference is published, the sentence stops being true. Whether a common specification or a European cybersecurity certification scheme at assurance level at least substantial covers a given category is a separate question we have not established, so check those two before concluding that a notified body is unavoidable.[Art. 32(2)]
• Important, class II: an outside body checks it — unless the product is free and open-source software and you publish its full technical paperwork when you place it on the market, in which case you can use the ordinary routes and check your own work. A manufacturer of free and open-source software whose product falls in an Annex III category may still use the ordinary routes, internal control included, provided the technical documentation is made public at the time the product is placed on the market. This does not reach the critical products in Annex IV.[Art. 32(5); Art. 31]
• Critical: a formal European certificate applies only where the EU has singled that kind of product out for one. Where it has not, this group takes the class II route instead. A critical product listed in Annex IV needs a European cybersecurity certificate at assurance level at least substantial, and then only where the Commission has adopted a delegated act saying so for that category, and it can only do that where a certification scheme covering the category has already been adopted and is available to manufacturers; any such act must normally allow at least six months to change over, and may allow less only where urgency justifies it. Where no such delegated act has been adopted, the product follows the class II route instead. We have not established which delegated acts exist today.[Art. 8(1); Art. 32(4)]

Step 5: the dates do not change

Your group does not move the deadlines.

Manufacturers' reporting obligations for actively exploited vulnerabilities and severe incidents apply from 11 September 2026.[Art. 71(2); Art. 14] The main obligations of the Cyber Resilience Act (essential requirements, technical documentation, conformity assessment, CE marking, importer and distributor duties) apply from 11 December 2027.[Art. 71(2)]

What it changes is how long the route takes. An outside body needs capacity in its diary and a finished folder of paperwork well before the second date.

Step 6: write down why

This is the step that turns ten minutes into evidence. Record:

• the products and versions the decision covers;
• each function you identified, and the group you compared it with;
• the group you concluded, with the reference, or "not listed" for ordinary;
• how confident you are and why: a clear match, a clear miss, or a line you had to interpret;
• who decided, and when.

Put it with your paperwork. When the European standards are published, or the lists change, review it and record the review. A group with no written reasoning is the first thing an inspector pulls on.

What changes if you are not ordinary

Budget, lead time and reader. The paperwork has to be finished earlier because somebody else will read it, and the standards you apply become a contractual matter with them. We do not run those checks and we are not a certification body. If your product lands there, we say so in the memo and tell you what the route involves, rather than quietly carrying on. The engineering work that comes first is the same either way.

The checklist

• The product is confirmed as covered, with the reason.
• Every function of the product is listed in ordinary words.
• Each function has been compared with the important and critical lists, and the result written down.
• The group and its reference are recorded, or "not listed".
• Who checks your work is recorded.
• Confidence and reasoning are recorded, with a name and a date.
• A reminder is set for when the European standards are published or the lists change.

If you want help

This post is written so you can do it yourself, and most of the work is reading your own product honestly. If you would rather have an engineer do it and put a name on the result, that is our scoping and classification memo: covered or not, the group, who checks your work, how long to support the product, the dates and three next steps, for each product line. You send the product details when it suits you and the signed memo comes back in writing.

Where this sits in the rest of the law: which group is your product in?, in our plain-English explainer.

Run the free check