Answer the questions and see the reasoning.
Default is a category, not an exemption
A product whose core functionality does not match an important or critical category is generally treated as Default. It still has to meet applicable CRA requirements. Internal control is one available assessment procedure under Article 32(1).
An ordinary locally installed productivity application may be Default. The same distribution format can also contain a password manager, operating system or firewall whose core function falls within a listed category. Classify functionality, not the words “app”, “software” or “device”.
Important Class I
Annex III Class I includes defined categories such as identity management systems, password managers, malware protection, VPN products, network management systems, operating systems, routers and certain consumer connected products. The technical descriptions set boundaries and examples for these categories.
A Class I result does not by itself establish mandatory notified-body involvement in every case. Article 32(2) allows internal control where its specified conditions on harmonised standards, common specifications or qualifying certification are satisfied.
Important Class II and Critical
Class II includes hypervisors and container runtime systems supporting virtualised execution, firewalls and intrusion detection or prevention systems, and defined tamper-resistant microprocessors and microcontrollers. The critical categories include specified hardware security boxes, smart-meter gateways and advanced secure-processing devices.
Do not infer Critical simply from high business impact or a product being used in critical infrastructure. Likewise, do not treat an ordinary microcontroller as tamper-resistant without checking its design properties and the technical criteria.
Components and multifunction products
Embedding an operating system or browser does not automatically transfer its classification to the entire host product. The implementing act gives the example of a news application with an embedded browser: the app is assessed as a whole.
A router with ancillary firewall functionality is not automatically a firewall for classification. Conversely, adding routing features to a product whose core function is traffic security does not automatically reduce it to a router. If several functions are central, document each match and seek a product-specific assessment.
Use the category to choose the next assessment
Keep the matched technical description and evidence supporting the core-function decision. Then check the route with the current availability and coverage of standards or certification. The FOSS exception under Article 32(5) also needs separate evaluation.
Categories and related acts can change. The finder is a screening tool based on its reviewed source set; recheck the official text and applicable measures at the time of placing the product on the market.
Frequently asked questions
Does Class II mean that my product is insecure?
No. It is a regulatory product category affecting the assessment procedure, not a finding about actual security or compliance.
Does using a secure element make my entire product Critical?
Not automatically. The classification depends on the core functionality of the whole product. A separately supplied secure element requires its own assessment.