Fictitious example. ACME Embedded GmbH, its products, records and document IDs are invented for illustration. Use this as a structural model, not as a template to adopt unchanged — and not as legal advice.
REG-REC-020 — CRA Product Classification Determination
| Document ID | REG-REC-020, rev. 1.0 |
| Product | SensorNode S300 (project P-2026-04, pre-development) |
| Reference | CRA Annex III (Important Class I/II), Annex IV (Critical); CDA implementing acts as published |
| Prepared by | Product Manager, 2026-07-02 |
| Approved by | Managing Director |
| Trigger for re-assessment | Any change of intended purpose, added functions (esp. security functions), or updated Commission implementing acts |
1. Product description and intended purpose
The SensorNode S300 is an industrial wireless condition-monitoring sensor (vibration/temperature) with digital elements: embedded firmware, an IEEE 802.15.4 radio, and a local configuration interface. It transmits measurement data to the ACME Gateway G50. Intended purpose: condition monitoring of rotating machinery in industrial environments. It is not intended for use as a security component, and performs no authentication, network management, or traffic-filtering function for other devices.
2. Assessment against Annex III — Important products
| Annex III category (abridged) | Applies? | Reasoning |
|---|---|---|
| Identity management / access control systems | No | No IAM function; device authenticates only itself to the gateway |
| Browsers, password managers, malware detection | No | Not present |
| Products with VPN function | No | No VPN capability |
| Network management, SIEM, boot managers | No | S300 manages no other devices; the gateway G50 was assessed separately (REG-REC-016) |
| Operating systems, hypervisors, container runtimes | No | RTOS is embedded, not placed on market as a standalone OS |
| Microcontrollers/-processors with security functionality placed on market as such | No | We integrate an MCU; we do not place the MCU on the market as a product |
| Smart home security/virtual assistant products, connected toys, wearables | No | Industrial product, not consumer |
| Industrial IoT devices not covered by NIS2 essential-entity scope / firewalls, IDS for industrial use | No | S300 is a sensing endpoint without security, filtering, or intrusion-detection function |
3. Assessment against Annex IV — Critical products
Hardware security modules, smart meter gateways, secure elements, tamper-resistant micro-controllers: none applicable — S300 contains a standard MCU with crypto acceleration, but is not itself placed on the market as any Annex IV category.
4. Determination
The SensorNode S300 is classified as a Default product (neither Important Class I/II nor Critical). Consequence: the conformity assessment route is selected in REG-REC-021; self-assessment under Module A is available.
Sensitivity note: if a planned "edge alarm" feature (autonomously triggering machine shutdown) is added in a later release, the intended purpose changes toward a safety-relevant function; classification and the applicability of other Union harmonisation legislation (e.g. Machinery Regulation interface) must then be re-assessed before development of that feature starts.
Approved: Managing Director (signed, 2026-07-04) — filed in project record P-2026-04 and referenced by the technical documentation.