What is the difference between CRA Important Class I and Important Class II products?

Important Class I products can sometimes be self-assessed, but only when the manufacturer fully applies the relevant harmonised standards, common specifications, or an approved certification path. Important Class II products always require a third-party conformity assessment by a notified body. In practice, Class II signals a higher assurance burden and less flexibility in how compliance is demonstrated.

Why This Matters for Security Teams

The difference between Important Class I and Important Class II under the EU Cyber Resilience Act is not just regulatory labelling. It changes how much assurance a product must prove before it can reach market, how much evidence a manufacturer must preserve, and whether an independent third party must validate the conformity path. For security teams, that affects procurement timelines, supplier scrutiny, and the quality of upstream controls on software, firmware, and connected components.

NHI Management Group’s research shows that 97% of NHIs carry excessive privileges, which is a useful reminder that assurance gaps often compound when identity and product governance are weak at the same time. The more critical the product class, the less acceptable it is to rely on informal testing or self-declared control maturity. In practice, many security teams encounter compliance and assurance failures only after a product is already embedded in operations, rather than through intentional risk review.

How It Works in Practice

Important Class I products sit in a middle tier: they are considered important because compromise would matter, but the CRA allows some flexibility in how conformity is demonstrated when the manufacturer fully applies the relevant harmonised standards, common specifications, or an approved certification route. That means the burden is still real, but the evidence can sometimes be compiled internally if the product and its controls fit the prescribed path.

Important Class II products move into a stricter assurance category. The key difference is that they always require a third-party conformity assessment by a notified body. That changes the operating model in three ways: evidence must be structured for external review, control claims must be defensible under scrutiny, and release planning must account for assessment lead time.

• Class I can sometimes use self-assessment only when the manufacturer fully satisfies the relevant conformity route.
• Class II requires an external notified body, so the manufacturer cannot rely on internal declaration alone.
• Both classes require stronger documentation, but Class II usually demands deeper traceability across design, build, and update controls.
• Security, engineering, and compliance teams should treat the class as a design constraint, not a paperwork step.

For teams mapping product obligations to broader identity and software assurance work, the NHI Management Group’s Ultimate Guide to NHIs — What are Non-Human Identities is useful for understanding how credentials, service accounts, and machine access controls affect downstream risk. The CRA’s own product-security direction also aligns with the EU’s wider resilience expectations in the EU Cyber Resilience Act. These controls tend to break down when product evidence is spread across suppliers, build pipelines, and component teams because no single owner can prove end-to-end conformity.

Common Variations and Edge Cases

Tighter assurance often increases cost and lead time, so organisations have to balance faster release cycles against the risk of under-scoped conformity evidence. That tradeoff becomes more visible when a product contains multiple components with different assurance expectations, or when a vendor supplies both software and embedded functionality under the same commercial package.

Best practice is evolving around how manufacturers should classify mixed products, document inherited controls, and prove that a harmonised standard has been fully applied. There is no universal shortcut for this yet, and teams should be careful not to assume that a self-assessed path for one component automatically carries over to the full product. If a vendor claims Class I treatment, security reviewers should verify the exact conformity route, the standards applied, and whether any exclusions or conditions narrow that claim.

The practical test is simple: if the product’s failure could materially affect users, operational continuity, or upstream trust, then the class designation should trigger stronger supplier due diligence, not just a checkbox review. The Ultimate Guide to NHIs — The NHI Market is a helpful reminder that modern systems are increasingly interconnected, which makes product assurance boundaries harder to define cleanly. In mixed-scope environments, Class II-style scrutiny is often applied informally even when the formal label is Class I.

Related resources from NHI Mgmt Group

• What is the difference between attack surface management and NHI governance?
• What is the difference between reviewing human access and reviewing NHIs?
• What is the difference between role-based access and API key governance for NHI security?
• What is the difference between human IAM controls and NHI governance?