Which product classes exist, and where does a banking app belong?
The act knows three classes above the default product. The technical description of the categories is contained in Implementing Regulation (EU) 2025/2392 of 28 November 2025; its interpretive principle carries every classification: what matters is the product's core functionality, not an ancillary or integrated function. A browser embedded in the app does not make the app a browser; a biometric login does not automatically make it an identity management system.
| Class | Categories (selection) | Assessment route under Art. 32 |
|---|---|---|
| Default product (around 90 % of all products) | everything not listed in Annex III or IV – typically a banking or insurance app whose core function is account management, payment or claims notification | Module A (internal control) permitted |
| Important products, Class I (Annex III, 19 categories) | identity management, password managers, browsers, malware protection, VPN, network management, SIEM, PKI software, operating systems, routers, security microprocessors, voice assistants, connected toys, wearables, among others | Module A only where harmonised standards, common specifications or certification schemes are applied in full (para. 2) – otherwise module B+C, module H or a notified body |
| Important products, Class II (Annex III, 4 categories) | hypervisors and container runtimes, firewalls, intrusion detection/prevention, tamper-resistant microprocessors | module B+C, module H or a European certification scheme at level “substantial” or higher (para. 3) |
| Critical products (Annex IV, 3 categories) | hardware security modules, smart meter gateways, smartcards and secure elements | European certification scheme under Art. 8(1), alternatively the procedures of para. 3 (para. 4) |
The class is the most consequential single decision of a readiness assessment because it determines whether a notified body is needed. It belongs in the product file with reasons: core function, the version of the implementing regulation relied on, open questions. A code from a tool does not carry it.
Which assessment routes exist?
Module A (internal control), modules B+C, module H and a certification scheme whose delegated act is still missing.
| Route | What it means | Precondition |
|---|---|---|
| Module A | Internal control by the manufacturer (Annex VIII Part I) | default products; Class I only with full application of standards |
| Modules B + C | EU-type examination by a notified body, then conformity to type | notified body available |
| Module H | Full quality assurance, assessed by a notified body | notified body available |
| Certification scheme | European cybersecurity certificate (e.g. EUCC), “where available and applicable” | delegated act under Art. 27(9) – not adopted |
Zero of 41: Why is the presumption of conformity empty?
Art. 27(1) ties the presumption of conformity to harmonised standards whose references are published in the Official Journal. Standardisation request M/606 (Implementing Decision C(2025) 618 of 3 February 2025, accepted on 3 April 2025) covers 41 standards: a horizontal EN 40000 series and vertical product standards. The delivery deadlines were: horizontal core standards by 30 August 2026, vertical standards by 30 October 2026, remaining horizontal standards by 30 October 2027.
| Standard | Subject | Status (21 October 2026) |
|---|---|---|
| prEN 40000-1-1 | Terminology | enquiry closed; ratification scheduled for 2 November 2026; no Official Journal citation planned |
| FprEN 40000-1-2 | Principles of cyber resilience | formal vote since August 2026; ratification scheduled for 2 November 2026; no Official Journal citation planned |
| prEN 40000-1-3 | Vulnerability handling (Annex I Part II) | under approval; original delivery deadline August 2026 lapsed, new target 31 October 2026 not in force |
| prEN 40000-1-4 | Generic security requirements (Annex I Part I, the thirteen product properties) | early draft stage; target 30 October 2027 – six weeks before full application |
| EN 304 617 to 304 636 (ETSI) | 17 vertical standards for Annex III categories | approval procedure since 13 August 2026; drafts, none published |
| prEN 50770-1 to -6 (CENELEC) | vertical OT product standards, partly overlapping with ETSI | drafts; delimitation between the strands open |
The Commission's list of harmonised standards has no entry for Regulation (EU) 2024/2847; a search for an implementing decision on harmonised standards for the CRA in EUR-Lex returns nothing. The July 2026 draft amendment to M/606, which moves the first delivery deadlines to 31 October and 31 December 2026, is not adopted – formally a deadline applies that has already lapsed, and in practice one that is not in force. No conformity assessment body is notified for the CRA, although Chapter IV has applied since 11 June 2026. The delegated act under Art. 27(9) that would make the EUCC scheme count is not adopted; the Commission plans it for the fourth quarter of 2026. ENISA expressly states that without this act no presumption arises from a certificate.
The sentence “module A is permitted if the harmonised standards have been applied in full” cannot be fulfilled as of this page's status date because no harmonised standard exists. The bottleneck thus moves from the requirement to assessment capacity: the decisive question of a manufacturer of important products is no longer “do we meet the requirements?” but “will we get an assessment slot in time?”. Art. 35(2) requires Member States to ensure a sufficient number of notified bodies by 11 December 2026 – in the German version as an obligation of result, in the English, French and Italian versions as a best-efforts duty (“shall strive to ensure”). In practice the best-efforts reading shared by three versions will prevail.
Why does the CRA timetable still stand?
For the AI Act the legislator reacted to the missing standards with a postponement; the Digital Omnibus (Regulation (EU) 2026/1744, in force since 27 July 2026) moves the high-risk layer by up to sixteen months. It amends the AI Act, Regulation (EU) 2018/1139 and the Machinery Regulation – not the CRA. The Digital Omnibus on data law (COM(2025) 837) and the cybersecurity package of 20 January 2026 likewise leave the CRA untouched. The guidance of 27 July 2026 confirms 11 September 2026 and 11 December 2027 without any announcement of a postponement. Bitkom demanded in February 2026 a two-year transition if no standards are cited by 11 December 2026; no Commission proposal exists.
What replaces the presumption?
Annex VII point 5: where harmonised standards are not applied or only partly applied, the other solutions adopted to meet the requirements must be described. That is the reversal of the presumption and, as of this page's status date, the only passable road. The burden of proof lies with the manufacturer, per requirement and per product. Mature drafts are suitable working targets – prEN 40000-1-3 for vulnerability handling, the relevant vertical standard for Annex III products – because final versions rarely diverge sharply from mature drafts. Risk assessment, SBOM, technical documentation and the vulnerability process are owed regardless of any standard.
Which steps lead to approving a release?
Five steps, from risk assessment and product boundary (Art. 13) through mapping requirements to evidence to the declaration of conformity (Art. 28) and CE marking (Art. 30).
- Link product description, product boundary and intended use with the risk assessment under Art. 13(2) and (3); justify non-applicable Annex I requirements (Art. 13(4)).
- Assign each Annex I requirement to a measure and a piece of evidence (Annex VII point 5).
- Tie tests, findings and handled deviations to the specific version.
- Record product class and assessment route with reasons; for Class I and II, reflect the assessment-capacity bottleneck in the project plan.
- Bring together the EU declaration of conformity (Art. 28, Annex V), CE marking (Art. 30) and support information before publication.
Frequently asked questions
Is a banking app an important Class I product?
Usually not: the core function is decisive. Account management, payment and claims notification are not listed in Annex III. An embedded login or an embedded browser does not change the core function. Document the classification with version and reasoning.
Are there harmonised standards for the CRA?
As of 21 October 2026 none of the 41 commissioned standards is cited in the Official Journal; the presumption of conformity under Art. 27(1) is therefore unavailable. The first EN 40000 parts are scheduled for ratification on 2 November 2026; no Official Journal citation is planned for them.
Is an EUCC certificate sufficient for the presumption of conformity?
Not yet. Art. 27(8) requires the scheme to be designated by delegated act under paragraph 9. That act is announced for the fourth quarter of 2026 and not adopted.
Does Mag. Eiler & Partner offer CE certification?
No. We are not a notified body. We structure product class, evidence file and project planning up to release.
Ing. Mag. Patrick Eiler
Patrick Eiler advises banks and insurers in Vienna on regulatory reporting, data architecture and AI compliance. More than twenty years in banking, insurance and financial services; speaker at the Hypo-Verband (expert session of 23 September 2026).