EU CRA ComplianceA Malkan Solutions company
Product classifier See the CRA Workbench →Workbench →

Product classifierImportant — Class IRegulation (EU) 2024/2847

Is a real-time operating system covered by the EU Cyber Resilience Act?

The short answer, the Official Journal text behind it, and the judgment calls an assessor will test.

01
Verdict

real-time operating system (RTOS) sold as a product

In scope · Important — Class I

Scope
In scope if it has a direct or indirect data connection to a device or network (Article 2(1)) — almost every modern one does.
Class
Important — Class I — Annex III, Class I.
Route
Module A is only available if you apply harmonised standards, common specifications or a European cybersecurity certification scheme (assurance level at least ‘substantial’) in full. Otherwise a notified body is involved: EU-type examination (Module B + C) or full quality assurance (Module H) — Article 32(2).
Dates
Article 14 reporting has applied since 11 September 2026; the main obligations apply from 11 December 2027 (Article 71).

A real-time operating system placed on the market as a product is an important product (Annex III, Class I — operating systems).

02
Why

Why it lands in this class

Annex III, Class I point 11 lists operating systems, and the Implementing Regulation explicitly includes ‘real-time operating systems, general-purpose and special-purpose operating systems’.

This applies to the RTOS vendor. The device maker who embeds the RTOS in a PLC or drive is integrating a listed component — Article 7(1) keeps that device out of the Class I procedures.

“Software products with digital elements that provide an abstract interface of the underlying hardware and control the execution of software, and that may provide services such as computing resource management and configuration, scheduling, input-output control, managing data, and providing an interface through which applications interact with system resources and peripherals. This category includes but is not limited to real-time operating systems, general-purpose and special-purpose operating systems.”

— Implementing Regulation (EU) 2025/2392, Annex I, point 11 (CRA Annex III, Class I, point 11)

Source: Regulation (EU) 2024/2847 — Articles 2(1), 7(1), 32; Annexes III–IV. Implementing Regulation (EU) 2025/2392.

03
Edge cases

When the answer changes

  • The OS is only distributed inside your own hardware and never placed on the market separately: it is a component of that product, not a product in its own right.
  • The RTOS is free and open-source software: Article 32(5) allows the Article 32(1) procedures, including self-assessment, provided the technical documentation is made available to the public when it is placed on the market.
04
Auditor view

What an assessor will ask you to show

Class decides the route. It doesn’t reduce the work: every product needs the full Annex I evidence, an Article 13 risk assessment and an Annex VII technical file.

  • Whether the OS is placed on the market separately, and under what licence.
  • The conformity route (Module A needs full application of a harmonised standard or scheme).
  • How downstream device makers receive vulnerability notifications and fixes.

Already developing to IEC 62443-4-1? See which requirements map to which CRA obligations in the IEC 62443 ↔ CRA crosswalk, and check your organisation’s footing with the CRA readiness score.

Classification is step one of six.

The CRA Workbench records your core-functionality reasoning the way an assessor will read it, then carries it through risk, Annex I, conformity route, vulnerability handling and the Annex VII file — with the IEC 62443 bridge built in.

See the CRA Workbench →

This page is general information about Regulation (EU) 2024/2847 and Commission Implementing Regulation (EU) 2025/2392, not legal advice. Quoted text is from the Official Journal; the analysis around it is ours. Classification turns on your product’s actual core functionality — document your own determination and confirm it against the current official texts. The CRA Workbench produces draft documentation for expert review; it indicates the evidence needed and does not, by itself, guarantee compliance.