Which products the regulation covers and excludes, and how a product's core functionality places it in the default, important (Annex III class I or II) or critical (Annex IV) category, which sets the conformity assessment route.
Which products the Cyber Resilience Act covers: products with digital elements made available on the EU market with a direct or indirect data connection, the sector exclusions (medical devices, vehicles, aviation, marine equipment), spare parts, national security, and how remote data processing and web services are treated.
The 19 class I categories of important products, from identity and privileged access management, browsers, password managers and VPNs to SIEM, operating systems, routers and smart home security devices, and why class I can use self-assessment only when harmonized standards are applied in full.
The four class II categories (hypervisors and container runtimes, firewalls and intrusion detection or prevention systems, tamper-resistant microprocessors and tamper-resistant microcontrollers) and why they always need third-party conformity assessment or an EU certificate.
The three Annex IV critical product categories (hardware devices with security boxes, smart meter gateways and advanced security devices, smartcards and secure elements), the Commission's power to require EU cybersecurity certification, and the fallback to class II procedures.
How products that are both products with digital elements and high-risk AI systems under the AI Act can meet the AI Act cybersecurity requirement by complying with CRA Annex I, which conformity assessment procedure applies, and which authority supervises them.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.