Important and critical products

The classification layer: what the lists change and how to read them.

Classification is the Regulation's difficulty dial. Annex III names the important products — class I broadly, class II a shorter and heavier list F-023 F-024 — and Annex IV names the critical products F-025. Implementing Regulation (EU) 2025/2392 supplies the technical descriptions that decide edge cases F-048.

What classification changes is the conformity route: default products self-assess, class I self-assesses only where harmonised standards, common specifications or a European cybersecurity certification scheme are applied in full, class II uses Modules B+C, Module H or a scheme at 'substantial' level, and critical products use a European certification scheme where available, otherwise the class II procedures F-026.

Verified facts this page relies on

F-023 Annex III Class I — important products, class I (items 1–19). Annex III Class I; Implementing Regulation (EU) 2025/2392
F-024 Annex III Class II — important products, class II (items 1–4). Annex III Class II; Implementing Regulation (EU) 2025/2392
F-025 Annex IV — critical products (items 1–3). Annex IV; Implementing Regulation (EU) 2025/2392
F-048 Commission Implementing Regulation (EU) 2025/2392 provides technical descriptions of the Annex III and Annex IV product categories (in force 21 December 2025); the class matcher uses those descriptions, not shorthand labels. Implementing Regulation (EU) 2025/2392; Art. 7(4)
F-026 Conformity routes: default products may use internal control (Module A), EU-type examination plus internal production control (Modules B+C), full quality assurance (Module H) or a European cybersecurity certification scheme; important class I must use B+C or H (or a scheme at 'substantial' level) unless harmonised standards, common specifications or such a scheme are applied in full; important class II must use B+C, H or a scheme at 'substantial' level; critical products use a European scheme where available, otherwise the class II procedures. Art. 32(1)–(4), Annex VIII

Facts are maintained and human-verified in the CEMarque Facts Table (v2026.09.4, verified 2026-09-10).

Editorial review: Claude (AI reviewer, delegated by the editor), 2026-10-08. Methodology and correction process: how this site works.

Related in the reference

Not sure whether this applies to your product? Check if the CRA applies to you on CRARequired.