Critical products with digital elements
View on EUR-LexArticle 7 defines the highest-risk band: critical products listed in Annex IV. These products must be certified under European cybersecurity certification schemes (e.g. EUCC) before being placed on the market. The list is short and includes hardware devices with security-by-design functions, smartcards, secure elements, and similar.
What you must do
- → Check Annex IV — if listed, you must certify under an applicable EU cybersecurity scheme.
- → Engage with ENISA-recognised certification bodies early.
The authoritative text of Article 7 is published by the Publications Office of the European Union on EUR-Lex. We link directly to it rather than mirror it, so you always read the current consolidated version straight from the source.
Read Article 7 on EUR-LexSource: Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act). The only authentic version is the one published in the Official Journal of the European Union.