> For the complete documentation index, see [llms.txt](https://www.headlesslaw.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.headlesslaw.com/cra/annexes/annex-iii.md).

# Annex III

*In force · Consolidated version of 20 November 2024 · Checked against EUR-Lex on 2 Oct 2026 ·* [*Official source*](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02024R2847-20241120)

#### IMPORTANT PRODUCTS WITH DIGITAL ELEMENTS

**Class I**

**1.** Identity management systems and privileged access management software and hardware, including authentication and access control readers, including biometric readers

**2.** Standalone and embedded browsers

**3.** Password managers

**4.** Software that searches for, removes, or quarantines malicious software

**5.** Products with digital elements with the function of virtual private network (VPN)

**6.** Network management systems

**7.** Security information and event management (SIEM) systems

**8.** Boot managers

**9.** Public key infrastructure and digital certificate issuance software

**10.** Physical and virtual network interfaces

**11.** Operating systems

**12.** Routers, modems intended for the connection to the internet, and switches

**13.** Microprocessors with security-related functionalities

**14.** Microcontrollers with security-related functionalities

**15.** Application specific integrated circuits (ASIC) and field-programmable gate arrays (FPGA) with security-related functionalities

**16.** Smart home general purpose virtual assistants

**17.** Smart home products with security functionalities, including smart door locks, security cameras, baby monitoring systems and alarm systems

**18.** Internet connected toys covered by Directive 2009/48/EC of the European Parliament and of the Council that have social interactive features (e.g. speaking or filming) or that have location tracking features

**19.** Personal wearable products to be worn or placed on a human body that have a health monitoring (such as tracking) purpose and to which Regulation (EU) 2017/745 or (EU) No 2017/746 do not apply, or personal wearable products that are intended for the use by and for children

**Class II**

**1.** Hypervisors and container runtime systems that support virtualised execution of operating systems and similar environments

**2.** Firewalls, intrusion detection and prevention systems

**3.** Tamper-resistant microprocessors

**4.** Tamper-resistant microcontrollers


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://www.headlesslaw.com/cra/annexes/annex-iii.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.