Important class I (Annex III)

Important products listed in Annex III, class I: Module A is available ONLY when the manufacturer fully applied harmonised standards / common specifications / an ECS scheme of at least substantial level (Art. 32(2)); otherwise EU-type examination (B+C) or full quality assurance (H).

Important class I products are listed in Annex III. Module A (internal control) is available for them ONLY where the manufacturer fully applied harmonised standards, common specifications or a European cybersecurity certification scheme of at least substantial level (Art. 32(2)). The CRA harmonised standards are largely not yet published, so in practice most class I products cannot use Module A today and must use EU-type examination with a notified body (Module B+C) or full quality assurance (Module H). The route is established by the guided classification questionnaire, never assumed.

Annex III / IV structure

Annex III, Class I (Regulation (EU) 2024/2847, Art. 32(2))

The Regulation's own structure names these 19 categories in Annex III, Class I:

• identity management systems and privileged access management (PAM) software and hardware
• standalone and embedded browsers
• password managers
• software that searches for, removes or quarantines malicious software
• virtual private network (VPN) products
• network management systems
• security information and event management (SIEM) systems
• boot managers
• public key infrastructure (PKI) and digital certificate issuing software
• physical and virtual network interfaces
• operating systems
• routers, modems and switches intended for connection to the internet
• microprocessors with security-related functionalities and microcontrollers
• application-specific integrated circuits (ASIC) and field-programmable gate arrays (FPGA) with security-related functionalities
• smart home products with security functionalities, including smart home gateways, smart home hubs and smart home central points of control
• internet-connected toys
• personal wearables for health tracking and smart textiles
• internet-connected cameras, smart door locks and baby monitors
• smart speakers, smart displays and virtual assistants

This is the Regulation's own structure (Regulation (EU) 2024/2847, Annex III Class I), not an assessment of any specific product. Whether a particular product falls within a named category is the manufacturer's guided questionnaire answer, never an assumption of this site.

Conformity assessment

EU-type examination (Module B+C) or full quality assurance (Module H); Module A only with full harmonised standards / ECS scheme (Art. 32(2))

Key obligations

• All default-class obligations, plus the stricter documentation duties of the important class
• Verification against the review criteria of Article 7(2) and the Annex III categories
• Notification of the market surveillance authority after placing on the market where required
• Conformity assessment route confirmed during the compliance assessment, not assumed