Check your product
Tick every category that matches your product’s core functionality. Leave them all unticked if none does.
- Internal control (module A): you assess conformity yourself.
The Article 14 reporting duties are the same in every class: an early warning within 24 hours, a notification within 72 hours, and a final report.
Guidance, not legal advice. The labels are shortened; the legal text decides.
How classification works
A product is important or critical when its core functionality is that of a category in Annex III or IV (Art. 7(1) and 8(1)). Containing such a component, like a browser engine, a VPN library or a secure element, does not on its own put the product in that category.
Implementing Regulation (EU) 2025/2392, in force since 21 December 2025, gives the technical description of each category. Check your product against it before you rely on the result.
What the class decides
- Default: the manufacturer assesses conformity itself (internal control, module A).
- Important, class I: module A when harmonised standards, common specifications or a European cybersecurity certification scheme at level “substantial” or higher are applied in full. Otherwise EU-type examination (modules B and C) or full quality assurance (module H).
- Important, class II: EU-type examination (modules B and C), full quality assurance (module H), or a European cybersecurity certification scheme at level “substantial” or higher.
- Critical: a European cybersecurity certification scheme where a delegated act under Art. 8(1) requires one; otherwise the class II procedures.
- Free and open-source software in an Annex III category may use module A when its technical documentation is public at the time it is placed on the market (Art. 32(5)).
The reporting duties in Article 14 are the same in every class: 24 hours, 72 hours, final report. The CRA guide covers the rest of the regulation, from scope to fines.
