If you ship a container runtime, a notified body is on your critical path

Most vendors who read the Cyber Resilience Act conclude, correctly, that their product is in the default category, that they will self-assess, draw up the documentation and affix the CE marking themselves, and that December 2027 is an admin problem rather than a scheduling one. For a surprising number of ordinary infrastructure products, that conclusion is wrong in a way that only becomes visible when there is no time left to act on it.

The short answer

Annex III Class II includes hypervisors and container runtime systems supporting virtualised execution of operating systems, and it includes firewalls, intrusion detection and intrusion prevention systems. Class II is the one class that cannot be self-assessed under any circumstances: it requires EU type-examination followed by conformity to type, or full quality assurance, carried out by a notified body.Art. 32⁠(3)⁠ And it changes no reporting deadline whatsoever.

The gap between the classes is not a matter of degree

Default products self-assess through internal control, draw up their own technical documentation and declaration of conformity, and never speak to anyone.Art. 32⁠(1)⁠

Class I products may also self-assess, but conditionally — the internal-control route is open only where harmonised standards, common specifications or a European cybersecurity certification scheme are applied in full and cover the essential requirements.Art. 32⁠(2)⁠ Where they are not, a third-party procedure applies instead. That is a conditional, and conditionals are where plans go wrong.

Class II has no such route. There is no set of standards you can apply diligently enough to avoid the notified body. The question is not whether you engage one, only when.

The lead time is the queue

This is the operationally important part and it is easy to miss while reading the Regulation, because the Regulation describes a procedure and says nothing about capacity. A notified body is an organisation with finite assessors, designated under a scheme that is itself still being stood up, serving every manufacturer in a category across the whole Union, against one fixed date.

The assessment takes as long as it takes. The wait to begin it is the part that sets your launch date, and it is the part you cannot compress by being well prepared. A vendor who works out in the middle of 2027 that their product is Class II has not discovered a documentation task; they have discovered that their release schedule now depends on somebody else's calendar.

What the class does not do

It does not touch a single reporting deadline. This needs saying plainly, because the word "important" reads like an escalation and people reasonably assume an important product reports faster.

It does not. The twenty-four-hour early warning and the seventy-two-hour notification are the same for a default product and a critical one.Art. 14⁠(2)⁠ Class decides the December 2027 conformity route and nothing else. Two separate obligations, two separate dates, and treating one as a proxy for the other produces confident wrong answers in both directions — a Class II vendor who thinks they have a shorter clock, and a default vendor who thinks a longer one.

The categories are broader than the labels suggest

The Class I list runs to nineteen categories and includes things people do not instinctively file under "security product": operating systems, routers and switches, network interfaces both physical and virtual, network management systems, boot managers, and personal wearables with a health purpose that fall outside the medical device regulations.

If you ship something in that neighbourhood, the class is worth establishing now rather than during the year the deadline lands — not because the class is hard to determine, but because the consequence of it has a queue attached.

The scope check asks five questions and names the conformity route your answers imply, including whether a notified body is involved. No account, and the article behind every step of the verdict.