CRA Product Classes and CE Marking: Assessment Routes

Can your product self-declare conformity with the CRA, or does it need a third-party assessment?

The EU Cyber Resilience Act (CRA) will apply in full from 11 December 2027. Taiwanese manufacturers selling on the EU market need to prepare SBOMs, vulnerability management and cybersecurity test data. More importantly, they first need to confirm:

👉 Which CRA category does your product fall into, and which conformity assessment procedure applies?

📌 The four CRA product categories

🔹 Default products | Self-assessment as a general rule
Products that are not on the CRA lists of important or critical products can, as a general rule, be self-assessed by the manufacturer using the internal control procedure (Module A).
🔹 Important Class I | Self-assessment under conditions
Examples: routers, modems intended for connection to the internet, switches (with a management plane, including managed and smart switches, and bridges such as wireless access points), operating systems.
Where applicable harmonised standards, common specifications or a European cybersecurity certification at assurance level of at least "substantial" have been fully applied, the internal control procedure (Module A) may be used; otherwise a third-party procedure (Module B+C or Module H) is required. No harmonised standards have been published in the Official Journal of the EU yet, so this needs to be monitored in practice.
🔹 Important Class II | Mainly third-party assessment
Examples: firewalls, intrusion detection and prevention systems (IDS/IPS), hypervisors and container runtime systems.
Self-declaration is not possible. A notified body must take part in the assessment (Module B+C or Module H), or a European cybersecurity certification at assurance level of at least "substantial" must be obtained. Open-source software products whose technical documentation is made public are subject to an exception.
🔹 Critical products | Stricter assessment requirements
Examples: smartcards, secure elements, smart meter gateways.
For now they follow the same assessment procedures as Important Class II. If the Commission later adopts a delegated act, certain products may be required to obtain a European cybersecurity certification.
⚠️ Key concept: a product's category depends on its core functionality, not on how many functions it has built in.
・An industrial PC running an operating system is not automatically moved up to Important Class I as a whole device.
・A router with a built-in firewall is not necessarily classified as Important Class II.

👉 Which category does your product fall into?

🏭 Industrial PCs (IPC): General-purpose industrial PCs may often fall into the default category, but their main intended use and core functionality still need to be confirmed.
🌐 Networking equipment: Devices whose core functionality is routing, internet-connecting modem or managed switching are Important Class I. Devices that merely contain a routing or switching module but have a different core functionality are not automatically included. Devices whose core functionality is a firewall or IDS/IPS are Important Class II.
🔋 Energy storage systems (ESS): Communication gateways, energy management systems (EMS) and control equipment should each be assessed individually, based on their own core functionality and scope.

📄 Whatever the product category, you need evidence of conformity

Manufacturers must prepare:
✔️ Technical documentation
✔️ Conformity assessment
✔️ EU declaration of conformity (DoC)
✔️ CE marking
⚠️ The technical documentation and the EU DoC must be kept for at least 10 years after the product is placed on the market, or until the end of the support period, whichever is longer, and be available to market surveillance authorities at any time.

📋 Four tasks companies can start on now

1️⃣ Product cybersecurity risk assessment
2️⃣ Security requirements and traceability
3️⃣ Security verification and test evidence
4️⃣ Software bill of materials (SBOM)
This information is not only needed to pass the CE conformity assessment. It is also an important foundation for future product vulnerability management, version traceability and customer audits.

📢 The technical descriptions of the CRA’s important and critical product categories have been published in Implementing Regulation (EU) 2025/2392 (published in the Official Journal of the EU on 1 December 2025). Companies should confirm their product category early and keep track of the latest information on harmonised standards, certification schemes and notified bodies.

👉 Need help assessing your CRA product category and technical documentation?

Anselm (安盛資訊) helps companies set up product security requirements management, SBOM, vulnerability management and end-to-end requirements traceability, making CRA compliance preparation more systematic.

📩 Contact Anselm: sales@anselm.com.tw

Further reading: EU CRA series | Previous article: EU CRA: Three Key Dates, and Why Existing Models Matter Too | Next article: EU CRA Essential Cybersecurity Requirements: From Default Passwords to Security Updates

This article is for general information only and does not constitute legal advice.