All other products (default class)

Products with digital elements that do not fall under the important or critical classes. Self-assessment under Module A is the typical route.

The Cyber Resilience Act applies to a wide range of products with digital elements. Products that are not on the Annex III (important) or Annex IV (critical) lists fall under the default class. Conformity is typically assessed under Module A, the manufacturer's internal control, without a notified body. The full set of Annex VII technical documentation, an EU Declaration of Conformity and the Annex I requirements still apply.

Annex III / IV structure

Not listed in Annex III or Annex IV (Regulation (EU) 2024/2847, Art. 32(1)(a))

Products in this class are those NOT named in Annex III or Annex IV:

• No categories from Annex III or Annex IV are named for this class.

This is the Regulation's own structure (Regulation (EU) 2024/2847, Art. 32(1)(a)): everything that is not named in Annex III or Annex IV sits here. Whether a particular product is actually excluded from those annexes is the manufacturer's guided questionnaire answer, never an assumption of this site.

Conformity assessment

Module A (internal control, self-assessment)

Key obligations

• Annex VII technical documentation for the product and its vulnerability handling
• EU Declaration of Conformity (Annex V) under the sole responsibility of the manufacturer
• Annex I essential requirements: secure by default, update mechanism, access control, data protection, incident resilience
• Annex I Part II vulnerability handling: SBOM, CVD policy, security contact, coordinated vulnerability disclosure
• Support period determination per Article 13(8) and support-period information
• Reporting actively exploited vulnerabilities and severe incidents per Article 14