Fossick › CRA scope check › Important product, class II

Important product class II under the Cyber Resilience Act

The product is listed in Annex III, class II: the higher important tier, where a compromise propagates broadly. Examples include hypervisors and container runtimes, firewalls, intrusion detection and prevention systems, and tamper-resistant microprocessors and microcontrollers.

What the manufacturer must do

• Everything required of a default product, at a higher standard of evidence.
• Engage a notified body: internal self-assessment is not available for this class.
• Maintain the technical documentation, the SBOM and the vulnerability handling records in a state that a notified body can audit at any point in the support period.

Which deadlines apply

Reporting duties apply from 11 September 2026. All remaining obligations apply from 11 December 2027. Because a notified body must be involved, engagement realistically has to begin during 2026.

What the conformity route looks like

Mandatory third party conformity assessment by a notified body: EU type-examination (module B) followed by conformity to type (module C), or full quality assurance (module H).

The reporting timeline

The reporting duty is the one that bites first, and it runs on three clocks that all start when the manufacturer becomes aware of an actively exploited vulnerability or a severe incident affecting the security of the product.

• 24 hours — early warning to ENISA and the CSIRT designated as coordinator in the Member State of main establishment.
• 72 hours — full notification, with an assessment of the vulnerability or incident and any corrective or mitigating measures taken.
• 14 days — final report once a corrective or mitigating measure is available: a description of the vulnerability, its severity and impact, and where available the exploitation vector.

The 14 day clock runs from the availability of the fix, not from the initial awareness, so a long remediation does not remove the earlier two deadlines.

Products already on the market are reached too

The reporting duty is not limited to new launches. From 11 September 2026 it applies to products with digital elements that are already placed on the EU market, for the whole time the manufacturer supports them. A product shipped in 2024 and still supported in 2027 is inside the regime, even though it was designed before it existed. The full set of obligations, including the technical documentation and CE marking, applies to products placed on the market from 11 December 2027, and to substantially modified versions of existing products after that date.

Check another product

• Rerun the CRA scope check
• Out of scope
• Default product
• Important product, class I

This is guidance, not a legal determination. Classification under the Cyber Resilience Act depends on the full technical description of your product and, in borderline cases, on the assessment of a notified body or your national market surveillance authority.