Important product with digital elements

The CRA sorts products with digital elements into three tiers: default, important, and critical. Important products are split into two classes, and the classification is defined by function categories listed in the regulation's annexes — examples include identity and access management software, firewalls, network interfaces, and certain industrial and operating system components — rather than by a general risk judgement made by the manufacturer alone.

Why the tier matters

• Class I important products can generally use internal control if a harmonised standard is applied, or need third-party involvement if it is not.
• Class II important products generally require notified body involvement, or an equivalent stricter route.
• The classification determines how much of the technical documentation must be independently checked before CE marking.

Manufacturers sometimes assume their product is 'default' because it does not resemble the headline examples in guidance. The correct approach is to check the product's function against the annex categories directly, since classification depends on function, not on product marketing category or industry sector.

Misclassification discovered late in a programme is expensive, because it can mean restarting the conformity assessment route with a notified body rather than completing internal control.