InsideCRA
InsideCRA › Annexes › Annex IV

Regulation (EU) 2024/2847

Annex IV — Critical products with digital elements

The critical-products list: three categories.

LAW Official text — verbatim from the Official Journal snapshot.

1. Hardware Devices with Security Boxes

2. Smart meter gateways within smart metering systems as defined in Article 2, point (23) of Directive (EU) 2019/944 of the European Parliament and of the Council and other devices for advanced security purposes, including for secure cryptoprocessing

3. Smartcards or similar devices, including secure elements

( 1 ) Directive (EU) 2019/944 of the European Parliament and of the Council of 5 June 2019 on common rules for the internal market for electricity and amending Directive 2012/27/EU ( OJ L 158, 14.6.2019, p. 125 ).

BINDING Source: Regulation (EU) 2024/2847 (Cyber Resilience Act) · publisher European Union · captured 2026-09-16 · snapshot sha256:27b7c6c64c773001… · CELEX 32024R2847

How to read this annex

Annex IV names the critical products in three categories F-025, with the technical descriptions supplied by Implementing Regulation (EU) 2025/2392 F-048. For critical products, a European cybersecurity certification scheme is the route where one is available, and otherwise the class II procedures apply F-026.

Verified facts this page relies on

Facts are maintained and human-verified in the CEMarque Facts Table (v2026.09.4, verified 2026-09-10).

Editorial review: Claude (AI reviewer, delegated by the editor), 2026-10-08. Methodology and correction process: how this site works.

Related in the reference

Not sure whether this applies to your product? Check if the CRA applies to you on CRARequired.