On 28 November 2025 the European Commission formally adopted Commission Implementing Regulation (EU) 2025/2392, which sets out detailed technical descriptions of the important and critical product categories defined in the Cyber Resilience Act (CRA). The regulation enters into force on the twentieth day after publication and is intended to give manufacturers clear legal guidance on which products must follow the stricter cybersecurity conformity assessment procedures.

Core functionality determines classification

The regulation makes clear that a product's core functionality is the decisive factor in determining whether it falls within the important or critical categories. If a product integrates the functions of other security components but has a different core functionality of its own, the product as a whole is not automatically placed in the corresponding category. A smartphone, for instance, integrates an operating system and a password manager, but that is not its core functionality, so it is not treated as a critical product of that category.

When carrying out conformity assessment, manufacturers must judge on the basis of the overall core functionality and ensure that the product as a whole meets the essential cybersecurity requirements, while giving full consideration to the security of the components it integrates.

Important products cover a broad field

Under Annex I of the regulation, important products are divided into two classes and cover a wide field. Class I comprises 19 categories, including identity management systems, standalone and embedded browsers, password managers, antivirus software, virtual private networks, network management systems, operating systems, routers and switches, microprocessors and microcontrollers with security functions, smart home virtual assistants, connected toys and health-monitoring wearables.

Class II focuses on higher-security products, including hypervisors and container runtime systems supporting virtualised execution, firewalls and intrusion detection and prevention systems, and tamper-resistant microprocessors and microcontrollers. Tamper-resistant products must meet the AVA_VAN 2 or 3 assurance levels defined in the Common Criteria.

Critical products face a higher threshold

Annex II sets out technical descriptions for three categories of critical products. Hardware security devices such as physical payment terminals and hardware security modules must provide physical tamper resistance. Smart meter gateways, as the core control component of smart metering systems, must provide data encryption and firewall functions.

Smart cards and similar devices are subject to the highest security standard and must meet AVA_VAN 4, covering trusted platform modules, embedded universal integrated circuit cards, electronic identity documents and payment cards. These devices are typically used to store and manage identity credentials or payment information and face the highest security risk.