You've finished this phase Next phase: What could go wrong with my product?
The very first CRA question — “which class does my product fall into?” — trips up more than a third of SMEs surveyed by ENISA. The wrong answer decides whether you self-assess or need a notified body. This guide explains the three classes, quotes the survey data, and hands you a free 12-question wizard that returns a deterministic answer.
Product classification is ranked among the challenges alongside understanding documentation (66%) and conformity assessment (66%).
Source: ENISA SME CRA Survey 2026, Section 1.2 (p. 11), Table 6 (p. 19) and Table 8 (p. 20).
Uncertainty is highest among importers, distributors and service providers — for whom scope depends on how the supply chain is set up.
This page and the free wizard exist because CRA studio users repeated the same question.
The class decides your conformity assessment route — from self-declaration to full quality-assurance audit by a notified body.
General-purpose products with digital elements — the majority. Conformity is via self-assessment (Module A). You still comply with Annex I, but you certify yourself.
Higher risk categories such as password managers, identity management, browsers, VPN clients and IoT firmware. Requires application of a harmonised standard or third-party conformity assessment.
Highest-risk categories such as hardware security modules, smart-meter gateways and firewalls for industrial use. Requires third-party conformity assessment by a notified body.
A separate class defined by delegated act — currently including hardware devices with security boxes, smart meters and smart-card readers — subject to European cybersecurity certification schemes.
A deterministic 12-question wizard for anonymous visitors, and a persistent product-record with change history for registered users.