ORDINARY, IMPORTANT, OR CRITICAL?

Each category is shown with its technical description under Implementing Regulation (EU) 2025/2392. The fact that a product performs other functions alongside its core functionality does not take it out of the category (recital 4 of the same regulation).

A product follows the procedure of the category its core functionality falls into — for important products under Article 7(1), for critical products under Article 8(1). Integrating a component that would itself fall into one of the categories changes nothing about the classification of the product (recital 2 of Implementing Regulation 2025/2392). The manufacturer must, however, assess the security of the whole product, and therefore of the integrated component as well (recital 3 of the same regulation).

This is where class I, class II and Annex IV part company. Class II is reserved for microprocessors and microcontrollers that are tamper evident, tamper resistant or tamper responsive and designed for protection at level AVA_VAN 2 or 3. A secure element designed for at least AVA_VAN 4 belongs in Annex IV. The AVA_VAN levels are laid down by the common criteria and the common evaluation methodology referenced in Article 1 of Implementing Regulation 2025/2392.

The technical description in Annex IV defines a secure element by exactly that level. A chip that resists tampering but is designed only for level AVA_VAN 2 or 3 is a tamper-resistant microprocessor or microcontroller, that is, class II of Annex III.

The first item of Annex IV is defined by physical protection: the enclosure must be tamper evident, tamper resistant or tamper responsive as a countermeasure against physical attacks, and the device consists of several separate components.

The Annex IV description assumes the device manages the communication between the components of a smart metering system and authorised third parties, collects, processes and stores metering or personal data, protects it cryptographically, has a built-in firewall function and allows other devices to be controlled.

SOAR software can collect, analyse and present data just as a SIEM does, but its core functionality is a different one, so it is generally not considered to meet the description of the SIEM category (recital 5 of Implementing Regulation 2025/2392).

The category covers toys within the meaning of Directive 2009/48/EC connected to the internet that either have built-in technologies for incoming and outgoing communication (keyboard, microphone, speaker, camera) or allow the location of the toy or its user to be tracked or found.

The technical description of the category rests on the protection of the physical safety of consumers in residential buildings and on the product being operable or manageable remotely from other systems. It also covers the hardware and software that centrally controls such products.

The CRA does not apply at all to products covered by Regulation (EU) 2017/745 on medical devices or Regulation (EU) 2017/746 on in vitro diagnostic medical devices (Article 2(2)). That is why the wearables category in Annex III is expressly limited to products to which those regulations do not apply.

For products qualifying as free and open-source software that fall into the categories of Annex III, the procedures under Article 32(1) may be used — including internal control under module A — provided that the technical documentation under Article 31 is made available to the public at the time of placing on the market (Article 32(5)). The option does not extend to critical products in Annex IV.