{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2024-11-20","gaps":[],"covered":["CRA L1"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/cra/annexes/annex-iii","url":"https://www.headlesslaw.com/cra/annexes/annex-iii","title":"Annex III","family":"l1_generated","work_id":"cra","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-02","applies_from":null,"application":null,"version_label":"Consolidated version of 20 November 2024","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02024R2847-20241120","valid_from":"2024-11-20","valid_until":null,"revision":1,"content_id":"74a7e8b489d20993","change_date":null,"nearest_versions":["2024-11-20"],"first_text_date":"2024-10-23","correction_applies":false,"versions":["2024-11-20"],"version_url":"https://www.headlesslaw.com/cra/annexes/annex-iii/versions/2024-11-20","revision_url":"https://www.headlesslaw.com/cra/annexes/annex-iii/versions/2024-11-20/rev/74a7e8b489d20993","versions_url":"https://www.headlesslaw.com/cra/annexes/annex-iii/versions","relations_url":"https://www.headlesslaw.com/cra/annexes/annex-iii/relations","source_line":null,"attribution":null},"provenance":{"official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02024R2847-20241120","check":{"result":"matched","checked_at":"2026-10-26","against":"EUR-Lex"},"repo_path":"spaces/cra/annexes/annex-iii.md","body_sha256":"29e0fa8ea172d4e8907229a4b89a16f6854a906dc119319efdf7e86da2c91c8c"},"units":[{"locator":"cra/annex/iii","kind":"annex","status":"in_force","label":null,"heading":"IMPORTANT PRODUCTS WITH DIGITAL ELEMENTS","text":"","marks":[],"revision":1,"text_hash":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","reason":null},{"locator":"cra/annex/iii/heading/1","kind":"heading","status":"in_force","label":null,"heading":null,"text":"IMPORTANT PRODUCTS WITH DIGITAL ELEMENTS","marks":[],"revision":1,"text_hash":"eff2c0edf5c5c4e837e9e396590e28768ad5f62e34a3ef604880777e7f9ee0ce","reason":null},{"locator":"cra/annex/iii/heading/2","kind":"heading","status":"in_force","label":null,"heading":null,"text":"Class I","marks":[],"revision":1,"text_hash":"b770a220f2bdfb66e0ee1fe4c1fe6b70d94422d439e9c7e837bcfb1553bab8fc","reason":null},{"locator":"cra/annex/iii/pt/3","kind":"point","status":"in_force","label":"(3)","heading":null,"text":"Identity management systems and privileged access management software and hardware, including authentication and access control readers, including biometric readers","marks":[],"revision":1,"text_hash":"449c5b35dfcec49a3bb7cd3d4771b6c1bcbd3a06150ae350d61e201f098b1b25","reason":null},{"locator":"cra/annex/iii/pt/4","kind":"point","status":"in_force","label":"(4)","heading":null,"text":"Standalone and embedded browsers","marks":[],"revision":1,"text_hash":"2c87614939102d601dfcce0ba4593475d84671cb6e18a4c1a89cc450f06e7d3f","reason":null},{"locator":"cra/annex/iii/pt/5","kind":"point","status":"in_force","label":"(5)","heading":null,"text":"Password managers","marks":[],"revision":1,"text_hash":"30a07b4061ad498cd190ed94a65cc04110a5f97982e2591bf7df67105758d2d4","reason":null},{"locator":"cra/annex/iii/pt/6","kind":"point","status":"in_force","label":"(6)","heading":null,"text":"Software that searches for, removes, or quarantines malicious software","marks":[],"revision":1,"text_hash":"180328365106d0d2a62aa0620b226c48d0496bb739b5cd2a3150ac6efcdfe7ba","reason":null},{"locator":"cra/annex/iii/pt/7","kind":"point","status":"in_force","label":"(7)","heading":null,"text":"Products with digital elements with the function of virtual private network (VPN)","marks":[],"revision":1,"text_hash":"62d76135ab406236d7e052d551a8ebe538f6d4d817faa825324cbd35f51dc3cd","reason":null},{"locator":"cra/annex/iii/pt/8","kind":"point","status":"in_force","label":"(8)","heading":null,"text":"Network management systems","marks":[],"revision":1,"text_hash":"db6cec63644e9e0fac6b4712e03a5036b69c1dd0098c0131726584f01b3438c7","reason":null},{"locator":"cra/annex/iii/pt/9","kind":"point","status":"in_force","label":"(9)","heading":null,"text":"Security information and event management (SIEM) systems","marks":[],"revision":1,"text_hash":"8c700aff0f87b407340e1d8417c0951f9e47bbbd74fc5e3cc648ff4f523da74d","reason":null},{"locator":"cra/annex/iii/pt/10","kind":"point","status":"in_force","label":"(10)","heading":null,"text":"Boot managers","marks":[],"revision":1,"text_hash":"6a6d665d58bfaec5dfb753993d16795f948faba759404f96f666b763d6b61b6f","reason":null},{"locator":"cra/annex/iii/pt/11","kind":"point","status":"in_force","label":"(11)","heading":null,"text":"Public key infrastructure and digital certificate issuance software","marks":[],"revision":1,"text_hash":"65b7a2440a89ec176d778aece155be3a06131c5ec2f5449d47e4fc2a162e2ab2","reason":null},{"locator":"cra/annex/iii/pt/12","kind":"point","status":"in_force","label":"(12)","heading":null,"text":"Physical and virtual network interfaces","marks":[],"revision":1,"text_hash":"d61df7fd3a68161a4198f89fe8e68b4b09c4fa22a7cd486f7f32a07571c76f9e","reason":null},{"locator":"cra/annex/iii/pt/13","kind":"point","status":"in_force","label":"(13)","heading":null,"text":"Operating systems","marks":[],"revision":1,"text_hash":"d385f37ed41f8ef59646c1c1bf3c1f703feebcb0232dbd4916836e451a9e1c89","reason":null},{"locator":"cra/annex/iii/pt/14","kind":"point","status":"in_force","label":"(14)","heading":null,"text":"Routers, modems intended for the connection to the internet, and switches","marks":[],"revision":1,"text_hash":"8c55bc37883ac8571719c74581b856dbed815d3c40220abb78e05f3e88a525a5","reason":null},{"locator":"cra/annex/iii/pt/15","kind":"point","status":"in_force","label":"(15)","heading":null,"text":"Microprocessors with security-related functionalities","marks":[],"revision":1,"text_hash":"74d65599ec29af718b61e795f8ace17ae28873592555094656eadb801ab2fd3f","reason":null},{"locator":"cra/annex/iii/pt/16","kind":"point","status":"in_force","label":"(16)","heading":null,"text":"Microcontrollers with security-related functionalities","marks":[],"revision":1,"text_hash":"2927c26eeb28414de101b73c790a95c1f63d52ae84ce25e16e43846bf48f0c59","reason":null},{"locator":"cra/annex/iii/pt/17","kind":"point","status":"in_force","label":"(17)","heading":null,"text":"Application specific integrated circuits (ASIC) and field-programmable gate arrays (FPGA) with security-related functionalities","marks":[],"revision":1,"text_hash":"4a39161364f68a3773bd44bd0a302b9017cccd3f2df15926551b419e50c2d65b","reason":null},{"locator":"cra/annex/iii/pt/18","kind":"point","status":"in_force","label":"(18)","heading":null,"text":"Smart home general purpose virtual assistants","marks":[],"revision":1,"text_hash":"0a2c8fcd98b07aa06b3a78b5b23a58df452189363c3b53a618c1304157bc40f5","reason":null},{"locator":"cra/annex/iii/pt/19","kind":"point","status":"in_force","label":"(19)","heading":null,"text":"Smart home products with security functionalities, including smart door locks, security cameras, baby monitoring systems and alarm systems","marks":[],"revision":1,"text_hash":"18749e79ba1f92a2c2c13475366890347679df6e8e12c0167b5c3c3d59b0718c","reason":null},{"locator":"cra/annex/iii/pt/20","kind":"point","status":"in_force","label":"(20)","heading":null,"text":"Internet connected toys covered by Directive 2009/48/EC of the European Parliament and of the Council that have social interactive features (e.g. speaking or filming) or that have location tracking features","marks":[],"revision":1,"text_hash":"bcfef11d2bd631732a098894aceab2d2da689602d562752fed4d2d3dd8e59846","reason":null},{"locator":"cra/annex/iii/pt/21","kind":"point","status":"in_force","label":"(21)","heading":null,"text":"Personal wearable products to be worn or placed on a human body that have a health monitoring (such as tracking) purpose and to which Regulation (EU) 2017/745 or (EU) No 2017/746 do not apply, or personal wearable products that are intended for the use by and for children","marks":[],"revision":1,"text_hash":"cf43c5b3e38a832a3ceef69b2cc987c1f67fc580dd7eddbaea46453d4a41034e","reason":null},{"locator":"cra/annex/iii/heading/22","kind":"heading","status":"in_force","label":null,"heading":null,"text":"Class II","marks":[],"revision":1,"text_hash":"dbc90daab8bdec13b8d7661098ea6bf6ba9f4aafaf823aa113bd478026aa6621","reason":null},{"locator":"cra/annex/iii/pt/23","kind":"point","status":"in_force","label":"(23)","heading":null,"text":"Hypervisors and container runtime systems that support virtualised execution of operating systems and similar environments","marks":[],"revision":1,"text_hash":"0989a9d7694786a5161b4e301810d46a4a830b8b138088fc7cfce2dcaef349e1","reason":null},{"locator":"cra/annex/iii/pt/24","kind":"point","status":"in_force","label":"(24)","heading":null,"text":"Firewalls, intrusion detection and prevention systems","marks":[],"revision":1,"text_hash":"ed85fd978d00719632c45375424c4e290984587919e5dc13a3b09d7699e52656","reason":null},{"locator":"cra/annex/iii/pt/25","kind":"point","status":"in_force","label":"(25)","heading":null,"text":"Tamper-resistant microprocessors","marks":[],"revision":1,"text_hash":"4b7183e79218778aac345dd9ee62e773c20848d41f7cda6f6d30d3f930120c1b","reason":null},{"locator":"cra/annex/iii/pt/26","kind":"point","status":"in_force","label":"(26)","heading":null,"text":"Tamper-resistant microcontrollers","marks":[],"revision":1,"text_hash":"1270c435c910bf4b773af02a218f5203e230bed41cda6bb9e3efa4076d3fa86e","reason":null}],"markdown":"---\ntitle: \"Annex III\"\ntype: regulation\nlegal_status: in_force\nsource: \"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02024R2847-20241120\"\nsource_retrieved: 2026-10-02\nshortTitle: \"Annex III\"\ninstrument_type: level1_regulation\nauthority: Commission\nbinding: true\nbinding_character: binding\nmica_level2: false\nlegal_basis: \"Regulation (EU) 2024/2847\"\ninstrument: cra\ncelex: \"32024R2847\"\nregulation: CRA\nregulation-full: \"Regulation (EU) 2024/2847\"\nannex: III\nstatus: in_force\nobject_id: eu.cra.legal_text.annex.iii\ntext_version: \"Consolidated version of 20 November 2024\"\nsource_url: \"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02024R2847-20241120\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\n---\n\n*In force · Consolidated version of 20 November 2024 · Checked against EUR-Lex on 26 Oct 2026 · [Official source](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02024R2847-20241120)*\n\n### IMPORTANT PRODUCTS WITH DIGITAL ELEMENTS\n\n#### Class I\n\n<a id=\"p-i-1\"></a>**1.** Identity management systems and privileged access management software and hardware, including authentication and access control readers, including biometric readers\n\n<a id=\"p-i-2\"></a>**2.** Standalone and embedded browsers\n\n<a id=\"p-i-3\"></a>**3.** Password managers\n\n<a id=\"p-i-4\"></a>**4.** Software that searches for, removes, or quarantines malicious software\n\n<a id=\"p-i-5\"></a>**5.** Products with digital elements with the function of virtual private network (VPN)\n\n<a id=\"p-i-6\"></a>**6.** Network management systems\n\n<a id=\"p-i-7\"></a>**7.** Security information and event management (SIEM) systems\n\n<a id=\"p-i-8\"></a>**8.** Boot managers\n\n<a id=\"p-i-9\"></a>**9.** Public key infrastructure and digital certificate issuance software\n\n<a id=\"p-i-10\"></a>**10.** Physical and virtual network interfaces\n\n<a id=\"p-i-11\"></a>**11.** Operating systems\n\n<a id=\"p-i-12\"></a>**12.** Routers, modems intended for the connection to the internet, and switches\n\n<a id=\"p-i-13\"></a>**13.** Microprocessors with security-related functionalities\n\n<a id=\"p-i-14\"></a>**14.** Microcontrollers with security-related functionalities\n\n<a id=\"p-i-15\"></a>**15.** Application specific integrated circuits (ASIC) and field-programmable gate arrays (FPGA) with security-related functionalities\n\n<a id=\"p-i-16\"></a>**16.** Smart home general purpose virtual assistants\n\n<a id=\"p-i-17\"></a>**17.** Smart home products with security functionalities, including smart door locks, security cameras, baby monitoring systems and alarm systems\n\n<a id=\"p-i-18\"></a>**18.** Internet connected toys covered by Directive 2009/48/EC of the European Parliament and of the Council that have social interactive features (e.g. speaking or filming) or that have location tracking features\n\n<a id=\"p-i-19\"></a>**19.** Personal wearable products to be worn or placed on a human body that have a health monitoring (such as tracking) purpose and to which Regulation (EU) 2017/745 or (EU) No 2017/746 do not apply, or personal wearable products that are intended for the use by and for children\n\n#### Class II\n\n<a id=\"p-ii-1\"></a>**1.** Hypervisors and container runtime systems that support virtualised execution of operating systems and similar environments\n\n<a id=\"p-ii-2\"></a>**2.** Firewalls, intrusion detection and prevention systems\n\n<a id=\"p-ii-3\"></a>**3.** Tamper-resistant microprocessors\n\n<a id=\"p-ii-4\"></a>**4.** Tamper-resistant microcontrollers\n"}