---
title: "Cyber Resilience Act I: which products are caught, and in…"
description: "How to tell whether hardware or software you sell falls under Regulation (EU) 2024/2847, whether it is a default, important (class I or II) or critical…"
url: https://pitch.law/academy/cyber-resilience-act-products-and-classes
---

[pitch](https://pitch.law/) [Academy](https://pitch.law/academy) [Data](https://pitch.law/academy/topics/information-technology)

# Cyber Resilience Act I: which products are caught, and in which class

How to tell whether hardware or software you sell falls under Regulation (EU) 2024/2847, whether it is a default, important (class I or II) or critical product, and which conformity route follows from that, with the dates up to 11 December 2027.

- - By [Bart Lieben](https://pitch.law/team/bart-lieben), Attorney-at-Law
  - 13 November 2026

- Updated

  13-11-2026

## The legal framework

The Cyber Resilience Act (CRA) is [Regulation (EU) 2024/2847](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R2847) of 23 October 2024. It was published in the Official Journal on 20 November 2024 and entered into force on 10 December 2024. It sets cybersecurity requirements for connected hardware and software before they may be sold in the Union.

The Regulation applies in three steps ([Article 71](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art_71)):

- **11 June 2026:** Chapter IV (Articles 35 to 51), the rules for the bodies that will assess products (notified bodies).
- **11 September 2026:** Article 14, the duty for manufacturers to report actively exploited vulnerabilities and severe incidents. We cover it in [part II of this series](https://pitch.law/academy/cyber-resilience-act-vulnerability-handling-and-reporting).
- **11 December 2027:** everything else, including the product requirements, CE marking and the duties of importers and distributors.

This first part answers two questions: is your product caught, and in which class?

### The scope test (Article 2)

The CRA applies to "products with digital elements made available on the market, the intended purpose or reasonably foreseeable use of which includes a direct or indirect logical or physical data connection to a device or network" ([Article 2(1)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art_2)). Three elements of that test matter.

**A product with digital elements.** This is "a software or hardware product and its remote data processing solutions", including components placed on the market separately ([Article 3, point (1)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art_3)). Standalone software counts. So does a chip sold to other manufacturers.

**Remote data processing.** Cloud functions are in scope only when the manufacturer designs them, or has them designed, and the product cannot perform one of its functions without them (Article 3, point (2)). Recital 12 gives the example of the cloud function that lets you control a smart home device from a distance. A website that does not support the functionality of a product is not in scope, and nor is a cloud service built outside the responsibility of a product manufacturer. The same recital points out that NIS2 covers cloud services such as software as a service.

**Made available on the market.** That means supply "in the course of a commercial activity, whether in return for payment or free of charge" (Article 3, point (22)). Free software can therefore be caught when it is monetised. Recital 15 gives examples of monetisation, such as charging for technical support beyond cost recovery, or requiring personal data as a condition for use for other purposes than security, compatibility or interoperability. The open-source position is set out in [part III](https://pitch.law/academy/cyber-resilience-act-importers-distributors-open-source).

### What is excluded

[Article 2(2) to (7)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art_2) carves out:

- products covered by the Medical Devices [Regulation (EU) 2017/745](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32017R0745), the In Vitro Diagnostic Medical Devices [Regulation (EU) 2017/746](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32017R0746) or the motor vehicle type-approval [Regulation (EU) 2019/2144](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019R2144);
- products certified under the aviation safety [Regulation (EU) 2018/1139](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32018R1139);
- marine equipment under [Directive 2014/90/EU](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32014L0090);
- spare parts that replace identical components and are made to the same specifications;
- products developed or modified exclusively for national security or defence, or designed to process classified information.

The Commission may also limit or exclude the CRA by delegated act where sectoral rules give the same or a higher level of protection (Article 2(5)).

### The four tiers

Every caught product must meet the essential requirements of Annex I ([Article 6](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art_6)). The class decides how you prove it.

**Default products.** Most products are not listed anywhere. The manufacturer may then use internal control (module A) and assess conformity itself ([Article 32(1)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art_32)).

**Important products, class I** ([Article 7](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art_7) and [Annex III](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_III)). The list has 19 categories. Examples: identity management and privileged access software and hardware, standalone and embedded browsers, password managers, anti-malware software, VPN products, network management systems, SIEM systems, boot managers, public key infrastructure software, operating systems, routers, internet modems and switches, microprocessors and microcontrollers with security functions, smart home virtual assistants, smart home products with security functions (smart door locks, security cameras, baby monitors, alarm systems), connected toys with social interaction or location tracking, and health-monitoring wearables that are not medical devices, or wearables for children.

**Important products, class II.** Four categories: hypervisors and container runtime systems, firewalls and intrusion detection and prevention systems, tamper-resistant microprocessors and tamper-resistant microcontrollers.

**Critical products** ([Article 8](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art_8) and [Annex IV](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#anx_IV)). Three categories: hardware devices with security boxes, smart meter gateways and other devices for advanced security purposes, including secure cryptoprocessing, and smartcards or similar devices, including secure elements.

The test is the product's core functionality. Article 7(1) adds a useful rule: integrating an important product does not by itself make the host product important. A smart fridge with an embedded browser is not a class I product just because the browser is.

Article 7(2) gives the criteria for listing: functions critical to the cybersecurity of other products, or a function with a significant risk of disruption or damage, such as network management or virtualisation. The Commission may change the lists by delegated act, normally with a transitional period of at least 12 months for important products (Article 7(3)) and six months for critical products (Article 8(2)). Article 7(4) required the Commission to adopt, by 11 December 2025, an implementing act with the technical descriptions of the categories in Annexes III and IV. Read the annexes together with that act.

### The conformity route per class

- **Default:** module A (internal control), module B plus C, module H or a European certification scheme (Article 32(1)).
- **Class I:** module A is enough only if you fully apply harmonised standards, common specifications or a European cybersecurity certification scheme at assurance level at least "substantial". Otherwise a notified body is involved through module B plus C or module H (Article 32(2)).
- **Class II:** module B plus C, module H, or a European certification scheme at level at least "substantial". Self-assessment is not an option (Article 32(3)).
- **Critical:** a European cybersecurity certificate where a delegated act under Article 8(1) requires it; otherwise one of the class II routes (Article 32(4)).

Free and open-source software in an Annex III category may use the Article 32(1) routes if the technical documentation is made public when the product is placed on the market (Article 32(5)). Microenterprises and small enterprises may use a simplified form of technical documentation (Article 33(5)).

### High-risk AI

A product that is also a high-risk AI system under the AI Act is deemed to meet the AI Act's cybersecurity requirement in Article 15 of that Act if it meets Annex I of the CRA and the EU declaration of conformity shows it ([Article 12](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art_12)). Our [overview of the AI Act](https://pitch.law/academy/eu-ai-act-practical-overview-for-businesses) explains when an AI system is high-risk.

### Products already on the market

Products placed on the market before 11 December 2027 only fall under the CRA if they are substantially modified after that date ([Article 69(2)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art_69)). The reporting duty in Article 14 is the exception: it applies to all products in scope, whenever they were placed on the market (Article 69(3)). A substantial modification is a change that affects compliance with Part I of Annex I or changes the intended purpose that was assessed (Article 3, point (30)).

### Fines

Breaches of Annex I or of Articles 13 and 14 can lead to fines of up to EUR 15 million or 2.5% of worldwide annual turnover, whichever is higher. Other breaches, including those of importers and distributors, go up to EUR 10 million or 2% ([Article 64](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847#art_64)). Member States set the penalty rules.

## In practice

A Belgian company makes a smart thermostat with an app and a cloud back end that lets users change the temperature from their phone. The thermostat, the app and the cloud function are one product with digital elements. Thermostats are not listed in Annex III, so it is a default product and the company may assess conformity itself. If the same company adds a door-lock module, that module is a class I product, and the conformity route depends on whether a harmonised standard is fully applied.

A software house sells a desktop password manager. Password managers are class I. If no harmonised standard is available or the company applies one only in part, a notified body has to be involved, so it should plan that well before 11 December 2027.

A start-up builds firewall appliances. Firewalls are class II, so a notified body is always involved, or a certification scheme at level "substantial" is used.

An online booking platform runs entirely in the browser as a hosted service. It is not a product with digital elements under the CRA. It may well be in scope of NIS2, see our article on [the NIS2 Directive](https://pitch.law/academy/the-nis2-directive-towards-a-firmer-eu-wide-cybersecurity-framework).

A manufacturer has a router model on sale since 2025. If it keeps selling the unchanged model after 11 December 2027, the product requirements do not apply to units placed on the market before that date. A firmware update that changes the security architecture can be a substantial modification, and then the whole regime applies. Reporting under Article 14 already applies since 11 September 2026.

### Practical steps

1. List every product, app, firmware and cloud function you place on the EU market, including components sold to other manufacturers.
2. Apply the Article 2 test and the exclusions, and note each core functionality.
3. Check that functionality against Annexes III and IV and the technical descriptions.
4. Choose a conformity route and plan the notified body where one is needed.
5. Treat old models you will modify after 11 December 2027 as new products.
6. Review supplier and customer contracts (below).

### Contracts

In supply agreements, ask the component maker for the classification it applied, the conformity route, the support period and the software bill of materials it can share. Agree who reports vulnerabilities to whom and how fast, because a manufacturer that finds a vulnerability in a component must report it to the maker of that component (Article 13(6)). In distribution agreements, make the CE marking, the declaration of conformity and the user information a condition of delivery. Our article on [manufacturing and supply agreements](https://pitch.law/academy/manufacturing-supply-agreements) covers the wider clause set.

## Frequently asked questions

### Does the CRA apply to our SaaS product?

Not to a pure hosted service. It does apply to remote data processing that the manufacturer of a product designs and without which the product cannot perform a function, such as the cloud back end of a connected device (Article 3, point (2), and recital 12).

### We only sell to businesses. Are we still caught?

Yes. The scope test does not depend on who buys. A manufacturer and a business user may agree a different default configuration for a tailor-made product (Annex I, Part I, point (2)(b)).

### Is a product with an embedded browser a class I product?

No, not for that reason alone. Integrating an important product does not make the host product important (Article 7(1)). The browser itself, when placed on the market separately, is class I.

### What happens to products we already sell?

Units placed on the market before 11 December 2027 stay outside the product requirements unless they are substantially modified. Reporting under Article 14 applies to them anyway since 11 September 2026.

## How this connects

The CRA lands in your contracts first: with suppliers of components and with customers who ask for proof. Our [commercial contracts and transactions](https://pitch.law/solutions/commercial-contracts-transactions) team drafts the clauses, and [Document Studio](https://pitch.law/technologies/contract-studio), our proprietary document analysis and development system, checks existing supply and distribution contracts for the missing points. The [rights and obligations register](https://pitch.law/technologies/contract-obligations) then follows support periods and reporting commitments after signature. When a vulnerability or incident arrives, our [data breach response](https://pitch.law/solutions/data-breach-response-enforcement) team helps with the parallel GDPR notification.

### At a glance

**Provisions cited:** Regulation (EU) 2024/2847, Articles 2, 3, 6, 7, 8, 12, 13(6), 14, 32, 33(5), 64, 69 and 71; Annexes I, III and IV; recitals 12 and 15.

**Key dates:** entry into force 10 December 2024; notified bodies (Chapter IV) from 11 June 2026; reporting (Article 14) from 11 September 2026; all other provisions from 11 December 2027.

**The series:** [part II, vulnerability handling and reporting](https://pitch.law/academy/cyber-resilience-act-vulnerability-handling-and-reporting) and [part III, importers, distributors, open source and contracts](https://pitch.law/academy/cyber-resilience-act-importers-distributors-open-source). Related: [AI, software and the new Product Liability Directive](https://pitch.law/academy/ai-software-and-the-new-product-liability-directive), [the NIS2 Directive](https://pitch.law/academy/the-nis2-directive-towards-a-firmer-eu-wide-cybersecurity-framework), [the EU AI Act](https://pitch.law/academy/eu-ai-act-practical-overview-for-businesses) and [manufacturing and supply agreements](https://pitch.law/academy/manufacturing-supply-agreements).

## In short

- The scope test of Article 2, with the exclusions
- Default, class I, class II and critical products
- The conformity route that follows from each class
- Products already on the market before 11 December 2027
- What to ask of your suppliers now

## Related solutions

- [Solutions](https://pitch.law/solutions/commercial-contracts-transactions)
  ### [Commercial Contracts & Transactions](https://pitch.law/solutions/commercial-contracts-transactions)
  [Supply, distribution, services, SaaS and procurement contracts, and the deals around them, drafted and reviewed with the IP, data and tax angles in view.](https://pitch.law/solutions/commercial-contracts-transactions)
- [Solutions](https://pitch.law/solutions/data-breach-response-enforcement)
  ### [Data Breach Response](https://pitch.law/solutions/data-breach-response-enforcement)
  [Help from the first hours of a personal data breach: assessment, notification to the authority and individuals, documentation, and action against the source.](https://pitch.law/solutions/data-breach-response-enforcement)

## Our proprietary Legal Tech

- [Technology](https://pitch.law/technologies/contract-studio)
  ### [Document Studio](https://pitch.law/technologies/contract-studio)
  [Our Document Studio drafts and analyses legal documents in a secure, on-premise environment, and keeps the documents behind your matters up to date as new data comes in and procedural steps fall due.](https://pitch.law/technologies/contract-studio)
- [Technology](https://pitch.law/technologies/contract-obligations)
  ### [Contract Management: Rights and Obligations](https://pitch.law/technologies/contract-obligations)
  [Once a contract is final, we pull out each party's duties and rights with the clause they come from, have a person confirm them, and follow them with reminders.](https://pitch.law/technologies/contract-obligations)

## More in Data

- ### [Children Online: the EU KIDS Act Proposal and Age Verification](https://pitch.law/academy/children-online-kids-act-and-age-verification)
  [What the Digital Services Act already requires to protect minors, what the EU KIDS Act proposal of 17 September 2026 would add for social networks, video platforms, games, app stores and chatbots, and how the EU age verification framework fits in.](https://pitch.law/academy/children-online-kids-act-and-age-verification)
- ### [The Cloud and AI Development Act: sovereignty rules for cloud and AI procurement](https://pitch.law/academy/cloud-and-ai-development-act)
  [What the Commission's proposal for a Cloud and AI Development Act would require of cloud providers that sell to the public sector, of contracting authorities, and of bidders for cloud and AI contracts, and how it sits next to the Data Act and the procurement Directive.](https://pitch.law/academy/cloud-and-ai-development-act)
- ### [Cyber Resilience Act III: importers, distributors, open source and contracts](https://pitch.law/academy/cyber-resilience-act-importers-distributors-open-source)
  [The duties of importers, distributors and authorised representatives under Articles 18 to 23 of Regulation (EU) 2024/2847, when a reseller becomes a manufacturer, how free and open-source software and its stewards are treated, and the clauses that follow.](https://pitch.law/academy/cyber-resilience-act-importers-distributors-open-source)
- ### [Cyber Resilience Act II: vulnerability handling and reporting since 11-09-2026](https://pitch.law/academy/cyber-resilience-act-vulnerability-handling-and-reporting)
  [What manufacturers must report under Article 14 of Regulation (EU) 2024/2847 since 11 September 2026, within 24 hours, 72 hours, 14 days and one month, and the vulnerability handling duties of Annex I, Part II, that follow from 11 December 2027.](https://pitch.law/academy/cyber-resilience-act-vulnerability-handling-and-reporting)
- ### [Cyber incidents across borders: the Cyber Solidarity Act](https://pitch.law/academy/cyber-solidarity-act)
  [What Regulation (EU) 2025/38 sets up, the European Cybersecurity Alert System, the Cybersecurity Emergency Mechanism with the EU Cybersecurity Reserve and the incident review mechanism, how a company hit by a major incident can benefit, and what it means for managed security service providers.](https://pitch.law/academy/cyber-solidarity-act)
- ### [The 2026 cybersecurity package: revised Cybersecurity Act and NIS2 amendments](https://pitch.law/academy/cybersecurity-act-revision-and-nis2-amendments)
  [What the Commission proposed on 20 January 2026 in COM(2026) 11 (the Cybersecurity Act 2, replacing Regulation (EU) 2019/881) and COM(2026) 13 (targeted amendments to the NIS2 Directive), where the procedures stand and what companies can prepare now.](https://pitch.law/academy/cybersecurity-act-revision-and-nis2-amendments)

## Let’s talk

Tell us what you’re working on. We’ll get the right person on it and reply within one business day. The first chat is free.

[Schedule a meeting](https://pitch.law/schedule)