Is my OT product important or critical under the CRA?

One test decides it: core functionality

Almost every networked OT product is in scope. The question that matters is which class — because class decides whether you can self-assess or need a notified body.

“Products with digital elements which have the core functionality of a product category set out in Annex III shall be considered to be important products with digital elements and shall be subject to the conformity assessment procedures referred to in Article 32(2) and (3).”

— Regulation (EU) 2024/2847, Article 7(1)

Two consequences trip up industrial manufacturers. First, integrating a listed component — an RTOS, a network interface, a VPN client — does not by itself make your controller or drive an important product:

“The integration of a product with digital elements which has the core functionality of a product category set out in Annex III shall not in itself render the product in which it is integrated subject to the conformity assessment procedures referred to in Article 32(2) and (3).”

— Regulation (EU) 2024/2847, Article 7(1)

Second, the reverse also holds. A product that can perform a listed function but whose core function is different is not in that category:

“a product with digital elements that has the ability to perform the functions of a product category set out in Annexes III and IV to Regulation (EU) 2024/2847 but whose core functionality itself is different from that of such product category is not to be considered to meet the technical description of that product category.”

— Implementing Regulation (EU) 2025/2392, recital 5

Source: Regulation (EU) 2024/2847, Article 7(1); Implementing Regulation (EU) 2025/2392, recital 5.

OT product types, classified

Default — Not in Annex III or IV

Self-assessment is available: internal control (Module A, Annex VIII) under Article 32(1). No notified body is needed, but the full Annex I evidence and the Annex VII technical file still are.

• Default
  Programmable logic controller (PLC)
  A networked PLC is in scope of the CRA — but no Annex III or IV category names a PLC, so it sits in the default class.
• Default
  HMI operator panel
  An HMI panel is in scope and usually default class — its core function is operator visualisation, which no Annex III category names.
• Default
  SCADA / DCS supervisory software
  SCADA and supervisory software placed on the EU market is in scope. It is default class unless its core function is managing the network itself.
• Default
  Industrial protocol gateway
  A protocol gateway (Modbus ↔ OPC UA, PROFIBUS ↔ PROFINET and similar) is in scope and usually default class — protocol translation is not a listed category.
• Default
  Remote terminal unit (RTU)
  An RTU is in scope and usually default class — telemetry and remote control of field equipment is not an Annex III category.
• Default
  Variable-frequency drive (VFD)
  A networked variable-frequency drive is in scope and default class — motor control is not an Annex III category.
• Default
  Smart transmitter or field instrument
  Smart transmitters and field instruments with a digital interface are in scope and default class — measurement is not an Annex III category.

Important — Class I — Annex III, Class I

Module A is only available if you apply harmonised standards, common specifications or a European cybersecurity certification scheme (assurance level at least ‘substantial’) in full. Otherwise a notified body is involved: EU-type examination (Module B + C) or full quality assurance (Module H) — Article 32(2).

• Important — Class I
  Managed industrial Ethernet switch
  A managed industrial switch is an important product (Annex III, Class I). An unmanaged switch is not in that category.
• Important — Class I
  Industrial or cellular router
  Industrial routers and cellular modems for internet connection are important products (Annex III, Class I).
• Important — Class I
  Secure remote-access / VPN gateway
  A remote-access or VPN gateway is an important product (Annex III, Class I).
• Important — Class I
  Fieldbus or industrial Ethernet interface module
  A fieldbus or industrial-Ethernet interface card sold as its own product can be an important product (Annex III, Class I — network interfaces).
• Important — Class I
  Real-time operating system (RTOS) sold as a product
  A real-time operating system placed on the market as a product is an important product (Annex III, Class I — operating systems).

Important — Class II — Annex III, Class II

Third-party assessment is required: Module B + C, Module H, or a European cybersecurity certification scheme at assurance level at least ‘substantial’ where available — Article 32(3). Self-assessment is not an option.

• Important — Class II
  Industrial firewall or OT security appliance
  An industrial firewall is an important product in Class II (Annex III) — self-assessment is not available.
• Important — Class II
  OT network monitoring / intrusion detection
  OT network monitoring and intrusion detection products are important products in Class II (Annex III).

Critical — Annex IV

A European cybersecurity certificate where a delegated act under Article 8(1) requires one; where it does not, the Class II procedures apply — Article 32(4).

• Critical
  Smart meter gateway
  Smart meter gateways within smart metering systems are critical products (CRA Annex IV).

Source: Regulation (EU) 2024/2847, Annexes III–IV and Article 32; Implementing Regulation (EU) 2025/2392, Annexes I–II.

After classification