Cyber Resilience Act product classification: how a declared function is matched
The Act sorts products with digital elements by core function: Annex III lists important products in class I (nineteen categories) and class II (four), Annex IV lists three critical categories, and everything else is default. The finder reads the function column of each line against a published dictionary keyed to that wording.
How the match works
- Each function carries word-bounded trigger phrases; the longest phrase in the line wins, so "smart meter gateway" is read before "smart meter" and "router" never matches "routing software".
- A generic word (gateway, camera, wearable, app) yields to a specific one on the same line.
- Where a line also names a stricter function (an industrial gateway "with firewall and VPN"), the match is borderline: the class turns on the product's core function (Art. 7(1)), and the note is worded as a question.
- A function the Annex words with a condition (a toy with social interactive features, a wearable with a health monitoring purpose, a microcontroller with security-related functionalities) is a question where the line does not show the condition.
- Integrating a component with an Annex III function does not in itself make the host product important (Art. 7(1)); a module sold on its own is read by its own function.
- Article 2 exclusions (medical devices, in vitro diagnostics, vehicle systems under type approval, certificate-holding aviation equipment, marine equipment, identical spare parts, national security or defence) are read as out of scope, with the article.
By the Annex wording; the Commission's technical descriptions of each category (Commission Implementing Regulation (EU) 2025/2392) are named, not quoted.
Every function, by class
72 functionsCritical products (Annex IV)
- Hardware device with a security box (hardware security module)Annex IV, point 1
- Smart meter gatewayAnnex IV, point 2
- Device for advanced security purposes, including secure cryptoprocessingAnnex IV, point 2
- Smartcard or similar deviceAnnex IV, point 3
- Secure elementAnnex IV, point 3
Important products, class II (Annex III)
- HypervisorAnnex III, class II, point 1
- Container runtime systemAnnex III, class II, point 1
- FirewallAnnex III, class II, point 2
- Intrusion detection or prevention systemAnnex III, class II, point 2
- Tamper-resistant microprocessorAnnex III, class II, point 3
- Tamper-resistant microcontrollerAnnex III, class II, point 4
Important products, class I (Annex III)
- Identity management systemAnnex III, class I, point 1
- Privileged access management software or hardwareAnnex III, class I, point 1
- Authentication or access control readerAnnex III, class I, point 1
- Biometric readerAnnex III, class I, point 1
- Standalone or embedded browserAnnex III, class I, point 2
- Password managerAnnex III, class I, point 3
- Software that searches for, removes or quarantines malicious softwareAnnex III, class I, point 4
- Product with the function of a virtual private networkAnnex III, class I, point 5
- Network management systemAnnex III, class I, point 6
- Security information and event management systemAnnex III, class I, point 7
- Boot managerAnnex III, class I, point 8
- Public key infrastructure or digital certificate issuance softwareAnnex III, class I, point 9
- Physical or virtual network interfaceAnnex III, class I, point 10
- Operating systemAnnex III, class I, point 11
- RouterAnnex III, class I, point 12
- Modem intended for connection to the internetAnnex III, class I, point 12
- SwitchAnnex III, class I, point 12
- Microprocessor with security-related functionalitiesAnnex III, class I, point 13
- Microcontroller with security-related functionalitiesAnnex III, class I, point 14
- ASIC or FPGA with security-related functionalitiesAnnex III, class I, point 15
- Smart home general purpose virtual assistantAnnex III, class I, point 16
- Smart door lockAnnex III, class I, point 17
- Security cameraAnnex III, class I, point 17
- Baby monitoring systemAnnex III, class I, point 17
- Alarm systemAnnex III, class I, point 17
- Internet-connected toy with social interactive or location tracking featuresAnnex III, class I, point 18, a question
- Personal wearable with a health monitoring purposeAnnex III, class I, point 19
- Personal wearable intended for use by and for childrenAnnex III, class I, point 19
Connected devices a maker sells (default class)
- Smart meter (no gateway role declared)default
- In-home displaydefault
- Asset or vehicle trackerdefault
- NFC or RFID tag with no softwaredefault
- Sensordefault
- Data loggerdefault
- Telematics unitdefault
- Industrial or IoT gatewaydefault
- Industrial controllerdefault
- Operator paneldefault
- Smart thermostat or heating controllerdefault
- Smart plug or switchdefault
- Smart lightingdefault
- Electric vehicle chargerdefault
- Printerdefault
- Connected appliancedefault
- Smart TV, set-top box or streaming devicedefault
- Payment terminaldefault
- Machine vision or dashboard cameradefault
- Smart home hubdefault, a question
- Wearabledefault, a question
- Camera, purpose not declareddefault, a question
- Microcontroller or microprocessor, security functions not declareddefault, a question
Software and remote data processing (default class)
- Companion mobile appdefault
- Device cloud or management platform (remote data processing)default
- Firmware or embedded software sold separatelydefault
Out of scope (Article 2)
- Medical deviceArt. 2(2)(a)
- In vitro diagnostic medical deviceArt. 2(2)(b)
- Vehicle system under type approvalArt. 2(2)(c), a question
- Aviation equipment under the aviation safety regulationArt. 2(3)
- Marine equipmentArt. 2(4)
- Developed exclusively for national security or defenceArt. 2(7)
- Identical spare partArt. 2(6), a question