Default products
Most of what a maker of meters, trackers, sensors and gateways sells is not listed in Annex III or IV. The default class may use any Art. 32(1) procedure, including internal control; every other duty of the Act still applies.
Functions the finder reads as default
26- Smart meter (no gateway role declared)
- In-home display
- Asset or vehicle tracker
- NFC or RFID tag with no software
- Sensor
- Data logger
- Telematics unit
- Industrial or IoT gateway
- Industrial controller
- Operator panel
- Smart thermostat or heating controller
- Smart plug or switch
- Smart lighting
- Electric vehicle charger
- Printer
- Connected appliance
- Smart TV, set-top box or streaming device
- Payment terminal
- Machine vision or dashboard camera
- Smart home huba question
- Wearablea question
- Camera, purpose not declareda question
- Microcontroller or microprocessor, security functions not declareda question
- Companion mobile app
- Device cloud or management platform (remote data processing)
- Firmware or embedded software sold separately
The route this class asks for
Art. 32(1)Any Art. 32(1) procedure: internal control (module A), EU-type examination (module B then C), full quality assurance (module H), or a European cybersecurity certification scheme where available.
CRA Art. 32(1)Choosing a conformity assessment procedure (default products)The manufacturer must assess the product and its processes against Annex I and demonstrate conformity by one of: internal control (module A), EU-type examination (module B) followed by conformity to type (module C), full quality assurance (module H), or, where available, a European cybersecurity certification scheme under Article 27(9).
CRA Annex VIII Part IModule A: internal controlUnder internal control the manufacturer draws up the Annex VII technical documentation, takes all measures so that design, development, production and vulnerability handling and their monitoring ensure compliance with Annex I Parts I and II, affixes the CE marking to each conforming product, and draws up the declaration, keeping it with the technical documentation for ten years or the support period if longer. The authorised representative may handle marking and declaration under mandate.
By the Annex wording; the Commission's technical descriptions of each category (Commission Implementing Regulation (EU) 2025/2392) are named, not quoted. A component with an Annex III function (a cellular or satellite module, a network interface, a secure microcontroller) may be important on its own; integrating it does not in itself make the product it sits in important (Art. 7(1)).