Criticality classes

This is the most structuring page of the reference. A product’s class does not change what it must comply with — the Annex I essential requirements are identical for all. It changes how compliance must be proven, and therefore the cost, the lead time and the critical path.

The four-level pyramid

Level	Reference	Examples	Self-assessment	Third party required
Default	No annex: everything not listed	Word processors, games, business applications, the vast majority of products	Yes (module A)	No
Important — class I	Annex III, Part I	Browsers, password managers, VPNs, antivirus, SIEM, routers, identity management	Yes, but only if harmonised standards are applied in full	Otherwise yes
Important — class II	Annex III, Part II	Operating systems, hypervisors and container runtimes, firewalls, IDS/IPS, tamper-resistant microprocessors	No	Yes
Critical	Annex IV	Hardware security boxes, smart meter gateways, smart cards and secure elements	No	Yes, with possible EUCC certification at assurance level at least “substantial”

Three rules of method

1. Classify by actual functionality, not by product name. A product called an “administration console” that performs a network management function falls under class I. The marketing label is not binding.

2. A multi-function product falls into the highest applicable class. A suite bundling a password manager (class I) and a firewall (class II) is treated as class II.

3. The lists move. The Commission may specify by delegated act the technical description of the categories and update Annexes III and IV. This page carries a review date; the updates feed keeps it current.

Why this is the critical path

The argument to make to a committee, in three steps:

1. A class II or Critical product cannot self-assess: a notified body is required.
2. Notified bodies can only be designated since 11 June 2026, and their number will be limited at first.
3. Third-party assessment requires freezing a version, compiling a file, and counting in months rather than weeks.

Conclusion: for every class II or Critical product, contracting an assessment slot is a task for now, before the technical documentation is even complete. It is the only item on the programme whose lead time is not yours to control.

The uncertainty to accept

For class I, the self-assessment route is open only where the manufacturer applies in full harmonised standards, common specifications or a European certification scheme covering all the relevant essential requirements. Until the harmonised standards arising from standardisation request M/606 are published and cited in the Official Journal, that route is closed in practice.

Two scenarios must therefore be planned for class I: self-assessment if the standards arrive in time, notified body otherwise. Treating the second as the base case is the prudent position.

What to produce

A classification sheet per product, filed with the technical documentation: actual functionality, Annex III and IV categories examined, the category retained or the reason for ruling it out, the resulting class, the assessment route chosen, date and signatories. The method sets out the line of questioning.