Is PKI or certificate issuance software an important product under the CRA?

The category, quoted in full:

Public key infrastructure and digital certificate issuance software

Annex III, Class I, point 9, Regulation (EU) 2024/2847

The category names issuance. A product that only stores, deploys or monitors certificates it did not mint has a weaker claim to point 9, and its core functionality may put it elsewhere.

Frequently confused with:

• Is an identity and access management system an important product under the CRAImportant - Class I

  Point 1 is about granting access to systems. Point 9 is about issuing the credentials themselves. Products often do both and are sold as one platform.

• Smartcards or similar devices, including secure elementsCritical

  The card that holds the private key is Annex IV point 3, which requires a certificate from a notified body. The software that issues the certificate onto it is Class I. The same deployment spans the widest class gap in the regulation.

Obligations that apply to every product in scope, whatever its class:

• Essential requirements (Annex I) - secure by design & default
• Machine-readable SBOM
• Coordinated vulnerability disclosure policy
• Security updates across support period (~5 yrs)
• Technical documentation (Annex VII)
• Conformity assessment (route depends on class)
• CE marking + EU Declaration of Conformity
• 24h / 72h reporting to ENISA + CSIRT (from Sep 2026)

What a manufacturer is assessed against:

1. Cybersecurity risk assessment Art 13(2)
2. Secure-by-design essential requirements Annex I Pt I
3. Vulnerability-handling process Annex I Pt II
4. Software bill of materials (SBOM) Annex I Pt II §1
5. Coordinated vulnerability disclosure policy Art 13 · Annex I Pt II
6. Security updates & support period Art 13(8)
7. Technical documentation (Annex VII) Annex VII
8. Conformity assessment & EU Declaration of Conformity Art 28 · Annex V
9. CE marking Art 30
10. Vulnerability & incident reporting readiness Art 14 (from 11 Sep 2026)
11. Economic-operator & market-surveillance obligations Art 13/19–24 · Annex II

The dates that matter:

• 11 September 2026 - reporting obligations for actively exploited vulnerabilities and severe incidents apply.
• 11 December 2027 - full compliance applies.
• Market-surveillance authorities can order corrective action, withdrawal or recall, and fines reach €15 million or 2.5% of global annual turnover.