The product class decides how you prove conformity: by self-assessment, or with a notified body or certification.
Most products fall into the default class. The lists in Annex III and IV name the others.
Default
Products not listed in Annex III or IV. Conformity by internal control, without a notified body.
Important, class I
For example identity management systems, browsers, password managers, antivirus software, VPNs, operating systems, routers and switches, and smart home security products such as door locks, cameras and alarm systems.
Important, class II
Hypervisors and container runtime systems, firewalls and intrusion detection and prevention systems, and tamper-resistant microprocessors and microcontrollers.
Critical
Hardware devices with security boxes, smart meter gateways, and smartcards and secure elements.
What each class means for your project.
Internal control (Module A): the manufacturer assesses conformity and draws up the technical documentation.
Internal control is possible only if harmonised standards, common specifications or a European cybersecurity certification at level substantial or higher are applied in full. Otherwise EU-type examination with conformity to type (Modules B and C) or full quality assurance (Module H).
EU-type examination with conformity to type (Modules B and C), full quality assurance (Module H), or a European cybersecurity certification at level substantial or higher.
A European cybersecurity certification where the Commission requires one by delegated act; otherwise the same routes as class II.
Free and open-source software in class I or II can use internal control if its technical documentation is made public.
Classification depends on the core functionality of the product, not on a component it contains. A product that integrates a class I component is not automatically class I itself.
Borderline cases are common: smart home devices, industrial gateways and products with security functions. We document the reasoning, because market surveillance authorities may ask for it.
As of October 2026. These guides explain the regulation in plain language and are not legal advice.
We classify your products, document the reasoning and choose the conformity route with you.
Tell us about your product and the rule you are facing. You talk to an engineer from the first call.
Cybersecurity consulting and the AITIGRITY platform for connected products and industrial systems.
