The definition
A product with digital elements (PDE) is any software or hardware product, and its remote data processing solutions, whose intended or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network.
Read that carefully: "indirect" and "reasonably foreseeable" do a lot of work. A sensor that only speaks Modbus to a gateway is in scope. A device that is only ever programmed over a JTAG header during manufacturing is arguably not — but the moment it has a BLE stack for commissioning, it is.
What is carved out
- Products already covered by sector legislation with equivalent requirements: medical devices (MDR/IVDR), civil aviation (2018/1139), motor vehicles (2019/2144), and certain marine equipment.
- Spare parts supplied to replace identical components.
- Non-commercial free and open-source software — but the CRA introduces the open-source software steward, a lighter-touch role for foundations and organisations that monetise or systematically support FOSS.
- Products developed exclusively for national security or defence, and products handling classified information.
The three tiers
| Tier | Examples | Conformity route |
|---|---|---|
| Default (the large majority) | Smart sensors, most consumer IoT, general purpose apps | Self-assessment (Module A) |
| Important, Class I (Annex III) | Password managers, VPNs, network management, microcontrollers with security-related functionality, smart home general-purpose devices, connected toys, wearables | Self-assessment only if harmonised standards are applied in full; otherwise third-party |
| Important, Class II (Annex III) | Hypervisors, firewalls, tamper-resistant microprocessors and microcontrollers | Third-party assessment (Module B+C or H) |
| Critical (Annex IV) | Hardware devices with security boxes, smart meter gateways, smartcards and secure elements | Third-party, potentially European cybersecurity certification |
Practical classification advice for embedded teams
Classification depends on the product's function, not its price or size. Two heuristics catch most mistakes:
- If a security function of another system depends on your device (it terminates a VPN, it stores keys for someone else, it enforces network segmentation), you are probably in Annex III or IV.
- A general-purpose microcontroller is default tier. A microcontroller with security-related functionality — a secure element, a crypto accelerator marketed for security use — is Class I.
Classify once, in writing, with the reasoning recorded. That memo becomes part of your technical documentation and is the first thing a market surveillance authority will ask for.