What happened
Commission Implementing Regulation (EU) 2025/2392 of 28 November 2025 was published in the Official Journal on 1 December 2025. It gives the technical description of the product categories listed in Annex III (important products) and Annex IV (critical products) of the Cyber Resilience Act, as Articles 7(4) and 8 of the CRA require.
What it means for machine builders
This is the text that tells you whether a product you place on the market, or a component you build in, counts as important or critical. Routers, switches, firewalls, operating systems and microcontrollers with security functions are among the categories described. The class decides the conformity assessment route from 11 December 2027: self-assessment for the default category, a harmonised standard or a notified body for important class I and II, a notified body or certification for critical products. Compliance managers should map every connected product in the catalogue against these descriptions now.
Official source EUR-Lex, Commission Implementing Regulation (EU) 2025/2392
Published 16 October 2026 by Edge SDN. A summary, not legal advice. Always check the official text for your case.