Privileged access management software or hardware
By the Annex wording, a privileged access management software or hardware points to the important class I class (Annex III, class I, point 1). The route that class asks for: internal control (module A) only where harmonised standards, common specifications or a European cybersecurity certification scheme at assurance level at least substantial are applied in full; otherwise EU-type examination (module B then C) or full quality assurance (module H) (Art. 32(2)).
The Annex wording
Annex III, class I, point 1Identity management systems and privileged access management software and hardware, including authentication and access control readers, including biometric readers
Cited to the held text of Regulation (EU) 2024/2847. By the Annex wording; the Commission's technical descriptions of each category (Commission Implementing Regulation (EU) 2025/2392) are named, not quoted.
A line that places here
examplePAM-2 | privileged access management | EU, UK | consumers | harmonised standard
What the finder reads on these lines
11 of the 14 notes- 3. Important class I function with self-assessment planned: Which harmonised standard, common specification or certification scheme does the self-assessment apply in full, and is it cited for this category?
- 4. No process to report an actively exploited vulnerability or a severe incident: Who notifies the CSIRT and ENISA within 24 hours when this product carries an actively exploited vulnerability, and where is the process written down?
- 5. No support period stated, or under five years with no reason recorded: What is the support period, how was it set, and where is its end date shown to buyers?
- 6. A universal default password: When will each unit ship with a unique password, or require the user to set one at first use?
- 7. No published vulnerability contact: Where does a researcher report a vulnerability in this product, and is that address published?
- 8. No security update mechanism, or unsigned updates: How does a security fix reach units already sold, and how does the device check the update is genuine?
- 9. No software bill of materials kept, or partial: Where is the machine-readable SBOM for this product, and does it cover at least the top-level dependencies?
- 10. Sold to UK consumers with no statement of compliance: Where is the statement of compliance for this product, and does it travel with every unit sold to UK consumers?
- 11. Manufacturer outside the EU with no authorised representative: Will the company appoint an EU authorised representative, and if not, which importer holds the documentation for the market surveillance authorities?
- 12. Still on sale for 11 December 2027 with no conformity route planned: Which route will this product take, and by when, so units made available from 11 December 2027 carry the declaration?
- 13. Sold in California with no reasonable security feature recorded: Which reasonable security feature does this device carry for California, and is it unique per device or set by the user at first use?
Clauses
7 cited| Regime | Clause | Applies when |
|---|---|---|
| CRA | CRA Art. 7(1) Classifying a product as important (Annex III, class I or II) | sold in the EU |
| CRA | CRA Art. 32(2) Conformity assessment for important class I products | sold in the EU |
| CRA | CRA Annex VIII Part II Module B: EU-type examination application and manufacturer duties | sold in the EU |
| CRA | CRA Art. 13(1) Design, development and production to Annex I Part I | sold in the EU |
| CRA | CRA Annex I Part I(1) Appropriate level of cybersecurity based on the risks | sold in the EU |
| California | California 1798.91.04(a) Reasonable security feature or features | sold in California, as the manufacturer |
| California | California 1798.91.04(b) Authentication outside a local area network: unique password or forced new credential | sold in California, as the manufacturer |
The route clause, set out
CRA Art. 32(2)Conformity assessment for important class I productsFor an Annex III class I product, internal control is available only where the manufacturer has applied in full harmonised standards, common specifications or a certification scheme at assurance level at least substantial. Where it has applied them in part, not at all, or none exist, the product and processes must go, for the uncovered requirements, through module B plus C or module H.
Other functions in important products, class i (annex iii)
- Identity management system
- Authentication or access control reader
- Biometric reader
- Standalone or embedded browser
- Password manager
- Software that searches for, removes or quarantines malicious software
- Product with the function of a virtual private network
- Network management system
- Security information and event management system
- Boot manager
- Public key infrastructure or digital certificate issuance software
- Physical or virtual network interface
- Operating system
- Router
- Modem intended for connection to the internet
- Switch
- Microprocessor with security-related functionalities
- Microcontroller with security-related functionalities
- ASIC or FPGA with security-related functionalities
- Smart home general purpose virtual assistant
- Smart door lock
- Security camera
- Baby monitoring system
- Alarm system
- Internet-connected toy with social interactive or location tracking features
- Personal wearable with a health monitoring purpose
- Personal wearable intended for use by and for children