CRASPACE
Scanning · scope · class · risk
CRASPACE
30 min with a CRA specialist - your classification confirmed against real specs, your open questions closed. Free, no obligation.Rulebook v0.5.1Full compliance 11 Dec 2027
Annex III, Class I, point 13 / Annex III, Class I, point 14

Is a microcontroller with security features Class I or Class II under the CRA?

Class I, unless it is designed for AVA_VAN level 2 or 3. Annex III Class I points 13 and 14 cover microprocessors and microcontrollers with security-related functionalities; Class II points 3 and 4 cover the tamper-resistant ones, which Implementing Regulation (EU) 2025/2392 defines by that designed resistance level.

ClassImportant - Class I
What that class requiresSelf-assessment only if harmonised standards applied; else notified body

The category, quoted in full:

Microprocessors with security-related functionalities

Annex III, Class I, point 13, Regulation (EU) 2024/2847

Microcontrollers with security-related functionalities

Annex III, Class I, point 14, Regulation (EU) 2024/2847

The boundary is an objective, documentable one rather than a matter of labelling. Implementing Regulation (EU) 2025/2392 recital 8 says these categories should be distinguished by the level of resistance against exploitability for which the part was designed, and gives AVA_VAN as the standardised way to express it: no tamper resistance means Class I points 13 or 14, designed for AVA_VAN level 2 or 3 means Class II points 3 or 4, and designed for at least AVA_VAN.4 means Annex IV point 3. Note too that both Class I points end with security-related functionalities, so a general-purpose part with no security function is not in the category at all.

Frequently confused with:

  • Tamper-resistant microprocessorsImportant - Class II

    Class II points 3 and 4 are the same two product types, distinguished by being designed for AVA_VAN level 2 or 3. A part described only as secure, with no designed resistance level stated, is read here as Class I - the word is a claim about function, not about tamper resistance. Confirming the level a part was designed for is one of the open questions a check will hand back.

  • Smartcards or similar devices, including secure elementsCritical

    Annex IV point 3 covers secure elements, which Implementing Regulation (EU) 2025/2392 describes as designed for at least AVA_VAN.4. Many secure elements are microcontrollers, so one die can sit in Class I, Class II or Annex IV - decided by the designed resistance level, not by the product name.

Obligations that apply to every product in scope, whatever its class:

  • Essential requirements (Annex I) - secure by design & default
  • Machine-readable SBOM
  • Coordinated vulnerability disclosure policy
  • Security updates across support period (~5 yrs)
  • Technical documentation (Annex VII)
  • Conformity assessment (route depends on class)
  • CE marking + EU Declaration of Conformity
  • 24h / 72h reporting to ENISA + CSIRT (from Sep 2026)

What a manufacturer is assessed against:

  1. Cybersecurity risk assessment Art 13(2)
  2. Secure-by-design essential requirements Annex I Pt I
  3. Vulnerability-handling process Annex I Pt II
  4. Software bill of materials (SBOM) Annex I Pt II §1
  5. Coordinated vulnerability disclosure policy Art 13 · Annex I Pt II
  6. Security updates & support period Art 13(8)
  7. Technical documentation (Annex VII) Annex VII
  8. Conformity assessment & EU Declaration of Conformity Art 28 · Annex V
  9. CE marking Art 30
  10. Vulnerability & incident reporting readiness Art 14 (from 11 Sep 2026)
  11. Economic-operator & market-surveillance obligations Art 13/19–24 · Annex II

The dates that matter:

  • 11 September 2026 - reporting obligations for actively exploited vulnerabilities and severe incidents apply.
  • 11 December 2027 - full compliance applies.
  • Market-surveillance authorities can order corrective action, withdrawal or recall, and fines reach €15 million or 2.5% of global annual turnover.

Check your own products against this

The same rulebook that produced this page runs the free check. It reads your products, classifies each one against Annex III and IV, and gives you an indicative verdict with the reasoning and citation for every product.

All categories
Tamper-resistant micro-processorsTamper-resistant microprocessors and microcontrollers are Annex III Class II, so a notified body is mandatory. The test is a designed AVA_VAN level of 2 or 3.Smartcards & secure elementsAnnex IV point 3 covers smartcards and similar devices including secure elements - critical products, designed for at least AVA_VAN.4 resistance.Product classificationWhich class each Annex III and IV category falls in, quoted from the regulation, with the conformity route it carries and the categories it is most often confused with.MethodologyThe versioned methodology behind every verdict: the six-step scoping flow, the four product classes, the eleven readiness checkpoints, and the Article each rests on.

Indicative assessment - not legal advice and not a conformity assessment.