EU CRA ComplianceA Malkan Solutions company
Product classifier See the CRA Workbench →Workbench →

Product classifierImportant — Class IIRegulation (EU) 2024/2847

Is an OT intrusion detection system covered by the EU Cyber Resilience Act?

The short answer, the Official Journal text behind it, and the judgment calls an assessor will test.

01
Verdict

OT network monitoring / intrusion detection

In scope · Important — Class II

Scope
In scope if it has a direct or indirect data connection to a device or network (Article 2(1)) — almost every modern one does.
Class
Important — Class II — Annex III, Class II.
Route
Third-party assessment is required: Module B + C, Module H, or a European cybersecurity certification scheme at assurance level at least ‘substantial’ where available — Article 32(3). Self-assessment is not an option.
Dates
Article 14 reporting has applied since 11 September 2026; the main obligations apply from 11 December 2027 (Article 71).

OT network monitoring and intrusion detection products are important products in Class II (Annex III).

02
Why

Why it lands in this class

Annex III, Class II point 2 lists intrusion detection and prevention systems. The Implementing Regulation covers systems that monitor traffic ‘for suspicious activity’ and detect that an intrusion ‘has been attempted, is occurring, or has occurred’ — network-based and host-based.

Passive OT monitoring sensors that alert on anomalous industrial traffic fit this description even though they never block traffic; blocking is what makes it an intrusion prevention system.

“Intrusion detection systems are products with digital elements that monitor traffic once it has entered the network environment for suspicious activity and detect or identify that an intrusion has been attempted, is occurring, or has occurred on a connected network or system. This category includes but is not limited to network-based intrusion detection systems and host-based intrusion detection systems.”

— Implementing Regulation (EU) 2025/2392, Annex I, Class II point 2 (CRA Annex III, Class II, point 2)

Source: Regulation (EU) 2024/2847 — Articles 2(1), 7(1), 32; Annexes III–IV. Implementing Regulation (EU) 2025/2392.

03
Edge cases

When the answer changes

  • The product only inventories assets and does not detect intrusions: the core function may be different — document it; asset inventory alone is not a listed category.
  • The product is delivered purely as a cloud service with no product placed on the market: the CRA covers products, not stand-alone services.
04
Auditor view

What an assessor will ask you to show

Class decides the route. It doesn’t reduce the work: every product needs the full Annex I evidence, an Article 13 risk assessment and an Annex VII technical file.

  • The notified-body route and timeline — there is no Module A path for Class II.
  • Integrity and authenticity of detection content (signatures, models) delivered after sale.
  • How the sensor’s own exposure on sensitive OT networks is minimised by default.

Already developing to IEC 62443-4-1? See which requirements map to which CRA obligations in the IEC 62443 ↔ CRA crosswalk, and check your organisation’s footing with the CRA readiness score.

Classification is step one of six.

The CRA Workbench records your core-functionality reasoning the way an assessor will read it, then carries it through risk, Annex I, conformity route, vulnerability handling and the Annex VII file — with the IEC 62443 bridge built in.

See the CRA Workbench →

This page is general information about Regulation (EU) 2024/2847 and Commission Implementing Regulation (EU) 2025/2392, not legal advice. Quoted text is from the Official Journal; the analysis around it is ours. Classification turns on your product’s actual core functionality — document your own determination and confirm it against the current official texts. The CRA Workbench produces draft documentation for expert review; it indicates the evidence needed and does not, by itself, guarantee compliance.