Does a firewall need a notified body under the CRA?

The category, quoted in full:

Firewalls, intrusion detection and prevention systems

Annex III, Class II, point 2, Regulation (EU) 2024/2847

Firewalls and IDS or IPS are one category, so a product that is only one of them carries the same route as a product that is both.

Frequently confused with:

• Security information and event management (SIEM) systemsImportant - Class I

  SIEM is Class I point 7, not Class II. The mandatory notified body does not follow from a product being security monitoring - it follows from being in the traffic path as an IDS or IPS, or being a firewall.

• Is a VPN an important product under the CRAImportant - Class I

  VPN function is Class I point 5. An appliance doing both is read on its core functionality - and per recital 4 of Implementing Regulation (EU) 2025/2392, a product does not lose its own core functionality merely by integrating that of another category.

A worked example:

Obligations that apply to every product in scope, whatever its class:

• Essential requirements (Annex I) - secure by design & default
• Machine-readable SBOM
• Coordinated vulnerability disclosure policy
• Security updates across support period (~5 yrs)
• Technical documentation (Annex VII)
• Conformity assessment (route depends on class)
• CE marking + EU Declaration of Conformity
• 24h / 72h reporting to ENISA + CSIRT (from Sep 2026)

What a manufacturer is assessed against:

1. Cybersecurity risk assessment Art 13(2)
2. Secure-by-design essential requirements Annex I Pt I
3. Vulnerability-handling process Annex I Pt II
4. Software bill of materials (SBOM) Annex I Pt II §1
5. Coordinated vulnerability disclosure policy Art 13 · Annex I Pt II
6. Security updates & support period Art 13(8)
7. Technical documentation (Annex VII) Annex VII
8. Conformity assessment & EU Declaration of Conformity Art 28 · Annex V
9. CE marking Art 30
10. Vulnerability & incident reporting readiness Art 14 (from 11 Sep 2026)
11. Economic-operator & market-surveillance obligations Art 13/19–24 · Annex II

The dates that matter:

• 11 September 2026 - reporting obligations for actively exploited vulnerabilities and severe incidents apply.
• 11 December 2027 - full compliance applies.
• Market-surveillance authorities can order corrective action, withdrawal or recall, and fines reach €15 million or 2.5% of global annual turnover.