CRA Annex III and IV: important and critical products with digital elements, explained

Article 7(1) sets the basic test: a product is classified by its own core functionality, not by what it contains. A VPN feature bundled into a broader business application does not turn that whole application into an "important" VPN product — only a product whose core purpose is to provide VPN functionality falls under that Annex III category. The same logic applies throughout: integrating an important or critical component into a larger product does not, by itself, pull the larger product into that stricter tier.

Article 7(2) gives the two criteria a category must meet to belong in Annex III at all: (a) the product primarily performs functions critical to the cybersecurity of other products, networks or services — securing authentication and access, intrusion prevention and detection, endpoint security, or network protection; or (b) it performs a function carrying a significant risk of adverse effects through direct manipulation, such as a central system function like network management, configuration control, virtualisation, or processing of personal data. Article 8 layers on extra criteria for critical products in Annex IV, including whether essential entities under the NIS2 Directive depend on the product and whether it risks disrupting critical supply chains.

Per the regulation's own text, Class I covers:

1. Identity management systems and privileged access management software and hardware, including authentication and access control readers (including biometric readers)
2. Standalone and embedded browsers
3. Password managers
4. Software that searches for, removes or quarantines malicious software
5. Products with digital elements with the function of virtual private network (VPN)
6. Network management systems
7. Security information and event management (SIEM) systems
8. Boot managers
9. Public key infrastructure and digital certificate issuance software
10. Physical and virtual network interfaces
11. Operating systems
12. Routers, modems intended for the connection to the internet, and switches
13. Microprocessors with security-related functionalities
14. Microcontrollers with security-related functionalities
15. Application-specific integrated circuits (ASICs) and field-programmable gate arrays (FPGAs) with security-related functionalities
16. Smart home general-purpose virtual assistants
17. Smart home products with security functionalities, including smart door locks, security cameras, baby monitoring systems and alarm systems
18. Internet-connected toys with social-interactive features or location-tracking features
19. Personal wearable products with a health-monitoring purpose, or that are intended for use by children, where Regulation (EU) 2017/745 or (EU) 2017/746 (the medical devices regulations) do not already apply

Class II, reserved for important products the recitals describe as carrying greater potential impact if compromised, lists 4 categories: hypervisors and container runtime systems that support virtualised execution of operating systems and similar environments; firewalls and intrusion detection/prevention systems; tamper-resistant microprocessors; and tamper-resistant microcontrollers.

Annex IV, the critical tier, is the shortest list of all — just 3 categories: hardware devices with security boxes (hardware security modules); smart meter gateways within smart metering systems and other devices for advanced security purposes, including secure cryptoprocessing; and smartcards or similar devices, including secure elements.

Annex III and IV name categories in plain language, but plenty of products sit near a boundary — does a smartphone's built-in password manager make the phone an "important product"? Article 7(4) required the Commission to settle questions like that by adopting an implementing act with precise technical descriptions, due 11 December 2025. The Commission met that deadline on 28 November 2025, adopting Commission Implementing Regulation (EU) 2025/2392; it was published in the Official Journal on 1 December 2025 and has applied since 21 December 2025. Its own Annex I gives the technical descriptions for important-product categories and its Annex II for critical-product categories — manufacturers near a classification boundary should check that text, not just the category names in Annex III/IV themselves. The CRA also lets the Commission amend Annex III or IV later by delegated act — adding a category, moving one between Class I and Class II, or withdrawing one — so this classification is not expected to stay static over the regulation's lifetime.