Is a network management system an important product under the CRA?

The category, quoted in full:

Network management systems

Annex III, Class I, point 6, Regulation (EU) 2024/2847

Frequently confused with:

• Are routers, modems and switches important products under the CRAImportant - Class I

  Routers, modems and switches are point 12, a separate category in the same class. A controller that manages access points is point 6; the access points and switches it manages are point 12. Both are Class I, so the route is the same, but a report that names the wrong one is citing the wrong line of the annex.

Obligations that apply to every product in scope, whatever its class:

• Essential requirements (Annex I) - secure by design & default
• Machine-readable SBOM
• Coordinated vulnerability disclosure policy
• Security updates across support period (~5 yrs)
• Technical documentation (Annex VII)
• Conformity assessment (route depends on class)
• CE marking + EU Declaration of Conformity
• 24h / 72h reporting to ENISA + CSIRT (from Sep 2026)

What a manufacturer is assessed against:

1. Cybersecurity risk assessment Art 13(2)
2. Secure-by-design essential requirements Annex I Pt I
3. Vulnerability-handling process Annex I Pt II
4. Software bill of materials (SBOM) Annex I Pt II §1
5. Coordinated vulnerability disclosure policy Art 13 · Annex I Pt II
6. Security updates & support period Art 13(8)
7. Technical documentation (Annex VII) Annex VII
8. Conformity assessment & EU Declaration of Conformity Art 28 · Annex V
9. CE marking Art 30
10. Vulnerability & incident reporting readiness Art 14 (from 11 Sep 2026)
11. Economic-operator & market-surveillance obligations Art 13/19–24 · Annex II

The dates that matter:

• 11 September 2026 - reporting obligations for actively exploited vulnerabilities and severe incidents apply.
• 11 December 2027 - full compliance applies.
• Market-surveillance authorities can order corrective action, withdrawal or recall, and fines reach €15 million or 2.5% of global annual turnover.