EU CRA ComplianceA Malkan Solutions company
Product classifier See the CRA Workbench →Workbench →

Product classifierImportant — Class IIRegulation (EU) 2024/2847

Is an industrial firewall covered by the EU Cyber Resilience Act?

The short answer, the Official Journal text behind it, and the judgment calls an assessor will test.

01
Verdict

industrial firewall or OT security appliance

In scope · Important — Class II

Scope
In scope if it has a direct or indirect data connection to a device or network (Article 2(1)) — almost every modern one does.
Class
Important — Class II — Annex III, Class II.
Route
Third-party assessment is required: Module B + C, Module H, or a European cybersecurity certification scheme at assurance level at least ‘substantial’ where available — Article 32(3). Self-assessment is not an option.
Dates
Article 14 reporting has applied since 11 September 2026; the main obligations apply from 11 December 2027 (Article 71).

An industrial firewall is an important product in Class II (Annex III) — self-assessment is not available.

02
Why

Why it lands in this class

Annex III, Class II point 2 lists ‘firewalls, intrusion detection and prevention systems’. The Implementing Regulation describes firewalls as protecting a network ‘by monitoring and restricting data communication traffic to and from that network’.

OT firewalls, deep-packet-inspection appliances for industrial protocols and unidirectional filtering products with policy enforcement all sit close to this description.

“Firewalls are products with digital elements that protect a connected network or system from unauthorized access by monitoring and restricting data communication traffic to and from that network. This category includes but is not limited to network firewalls and application firewalls such as web application firewalls or filters and anti-spam gateways.”

— Implementing Regulation (EU) 2025/2392, Annex I, Class II point 2 (CRA Annex III, Class II, point 2)

Source: Regulation (EU) 2024/2847 — Articles 2(1), 7(1), 32; Annexes III–IV. Implementing Regulation (EU) 2025/2392.

03
Edge cases

When the answer changes

  • Filtering is a minor feature of a router or switch whose core function is connectivity: recital 5 — the product is classified on its core function (Class I for routers and managed switches).
  • A hardware data diode with no configurable policy: check carefully against the firewall description and document the reasoning — this is a contested edge.
04
Auditor view

What an assessor will ask you to show

Class decides the route. It doesn’t reduce the work: every product needs the full Annex I evidence, an Article 13 risk assessment and an Annex VII technical file.

  • Which notified body and which route (Module B + C or Module H), and when you will engage them — Class II has no self-assessment path.
  • How rule-set updates and signature feeds are secured and delivered.
  • Evidence that the product’s own management plane meets the requirements it enforces for others.

Already developing to IEC 62443-4-1? See which requirements map to which CRA obligations in the IEC 62443 ↔ CRA crosswalk, and check your organisation’s footing with the CRA readiness score.

Classification is step one of six.

The CRA Workbench records your core-functionality reasoning the way an assessor will read it, then carries it through risk, Annex I, conformity route, vulnerability handling and the Annex VII file — with the IEC 62443 bridge built in.

See the CRA Workbench →

This page is general information about Regulation (EU) 2024/2847 and Commission Implementing Regulation (EU) 2025/2392, not legal advice. Quoted text is from the Official Journal; the analysis around it is ours. Classification turns on your product’s actual core functionality — document your own determination and confirm it against the current official texts. The CRA Workbench produces draft documentation for expert review; it indicates the evidence needed and does not, by itself, guarantee compliance.