Which bucket does your product fall into? An interactive Cyber Resilience Act classifier
By Kike Gandia · Hardware & OT · 9 min read
September 11 went almost unnoticed by most manufacturers of connected products, but it is the date on which Article 14 of the Cyber Resilience Act started to bite: 24 hours to give early warning of an actively exploited vulnerability, 72 to notify it, 14 days for the final report. It covers the entire catalog, including products that have been on the market for years. Before looking at deadlines, though, there is a prior question that determines everything else: which bucket your product falls into. That is what this article is about, and that is why it comes with a tool rather than just text.
Why you can't answer this by eye
The CRA sorts products with digital elements into four levels: default, important class I, important class II and critical. What decides the bucket is the product's core functionality, not what it has built in. An application that embeds a browser engine is not a browser; a phone with a password manager is classified by what it is, not by what it includes.
Since December 21, 2025, that question has a technical answer rather than an intuitive one: Implementing Regulation (EU) 2025/2392 describes each of the twenty-six categories in Annexes III and IV in legal detail. Classifying a product today means checking it against that text, not against whatever marketing label you have given it.
The decision tree, turned into a form
The tool below walks through exactly that tree: scope and exclusions first, core functionality next, and a couple of nuances that only come up when they are relevant (resistance to physical tampering, open-source software with public documentation). At the end you get an indicative category with the full reasoning on display, so you can check it yourself instead of trusting a black box.
This is not an official classification and it is no substitute for a conformity analysis. It does not collect, transmit or store any data: all the processing happens in your browser, and the result includes a button to copy it and take it wherever you need it.
Interactive classification tool available in the web version of this article. It follows the same decision tree explained in the text: Article 2 scope, core functionality against Annexes III and IV, and the nuances around tamper resistance and open-source software. For the full decision tree in text form, with all 26 categories in detail, see the complete CRA guide for manufacturers at /en/resources/cyber-resilience-act-guide-for-manufacturers/.
The clock doesn't wait for December 2027
Almost all the media noise about the CRA points to full application on December 11, 2027. That is the date that brings in all of Annex I, conformity assessment and CE marking — but it is not the only date that matters, and treating it as if it were is the most expensive mistake a manufacturer can make right now. There are three phases aimed at different parties, and one of them is already under way.
Timeline with the six key CRA dates: December 10, 2024 (entry into force), June 11, 2026 (member states can start designating notified bodies), September 11, 2026 (Article 14 applies and binds all manufacturers), December 11, 2027 (full application), June 11, 2028 (end of the grace period for existing certificates) and 2032–2042 (long-term support obligations). Full details of each milestone are in the complete CRA guide at /en/resources/cyber-resilience-act-guide-for-manufacturers/.
What to do with the result
Whatever bucket you landed in, there is one shared action that can't wait: Article 14 applies to a default product just as it does to a critical one, so registering on ENISA's reporting platform before you need it is not optional. From there, the work depends on the indicative result:
- Out of scope or no commercial activity: document the exclusion in writing and watch for any future change (added connectivity, indirect monetization) that would bring you into scope.
- Default product: you can move forward without depending on anyone. The priority is the process — risk assessment, SBOM, support period — not a third party.
- Important, class I: there are currently no harmonized standards referenced and no notified bodies designated, so self-assessment is effectively closed off. Prepare the technical file as if it were going to an external audit.
- Important class II, or critical: a third party is mandatory by definition and none is available yet under the CRA. The sooner you open talks with prospective notified bodies, the shorter the queue you'll face.
All the documentation you need to have ready
The bucket decides who can sign off on conformity, but the underlying technical file is practically the same for everyone. This is what you need to have ready, ordered by the point in the lifecycle when it is needed — not by how urgent it seems today:
Checklist of the documentation required by the CRA, in five phases: design and development (Article 13(2) risk assessment, support period); before placing on the market (Annex VII technical documentation, SBOM, EU declaration of conformity, CE marking, Annex II instructions); maintenance throughout the lifecycle (coordinated vulnerability disclosure policy, component inventory, testing after every update, secure patch distribution); in the event of an actively exploited vulnerability or incident — enforceable since September 11, 2026 — (24-hour early warning, 72-hour notification, final report 14 days after the patch, communication to affected users); and, if the product requires a third party, notified body certification or the applicable European scheme. Full details, including the obligations of each economic operator, are in the complete CRA guide for manufacturers at /en/resources/cyber-resilience-act-guide-for-manufacturers/.
Official resources for completing the technical file
Two links worth bookmarking now rather than hunting for on the day you need them:
- ENISA reporting platform: this is where you submit the early warning, the notification with an initial assessment and the final report under Article 14. It has been live since September 11, 2026, the same day the article started to apply. Reporting portal (Single Reporting Platform) · ENISA fact sheet
- Notified bodies (NANDO database): this is where the bodies authorized to certify class II and critical products will be listed as soon as member states designate them — as of this writing, none is listed yet under the CRA. NANDO database, filterable by legislation
The result the tool gives you is exactly that: an indication, with the reasoning on display so you can defend it or correct it. If you want to see it at the level of detail of a conformity analysis — all 26 categories, the assessment routes, the penalties and what to do depending on your situation in Spain — the complete CRA guide for manufacturers brings all of that together in one place. If you would rather go straight to preparing a proposal, the CRA scoping form captures your role, products and technical maturity in eight sections so we can talk with context. And if you would like someone to review it with you before you decide anything, that is what our team is here for.
Related service
Cyber Resilience Act (CRA) consulting
Topics
#Cyber-Resilience-Act #CRA #Compliance #IoT #Hardware #EU-Regulation
Keep reading
- Cyber Resilience Act reporting is now mandatory: what has changed and what to do this quarter
- European compliance calendar 2026-2030: CRA, AI Act, Data Act and everything still to come
- KOMPLIANCE: the audit you can watch as it happens, and the platform that stays afterward
- How an industrial plant gets attacked: the leap from IT to the metal, explained with a machine
- Hardware Analysis Series – Part 7: Advanced ARM Microcontroller Debugging with JTAG and the Bus Pirate