The European Commission published Commission Implementing Regulation (EU) 2025/2392 on December 1, 2025. The Regulation provides crucial technical descriptions for "important" and "critical" products with digital elements under Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements. The purpose of the Regulation is to clarify which products fall into the stricter compliance categories under Regulation (EU) 2024/2847.

Product classification is based on cybersecurity risk and the Regulation provides technical details review for two categories:

• Important Products (Annex III), which require EU-type examination procedure or conformity assessment based on full quality assurance; 
• Critical Products (Annex IV), which may require mandatory EU cybersecurity certification.

The main principle of digital product distribution is not on minor products features, but on the core functionality.

If a product has features similar to those listed as “Important” or “Critical”, but these are not its primary function, then it should not to be considered to meet the technical description of that product category and it is not subject to the stricter requirements.

For example, network equipment with a built-in firewall cannot be determined as a "firewall" (Important Class II) as its primary functionality is traffic routing. A built-in firewall is an additional security feature, but the product itself is simply a router. However, if the product is marketed as a "hardware firewall," it would be classified as the “Important Class II” according to the Regulation (EU) 2024/2847.

If your device is multifunctional, you should define its primary purpose from the user's perspective. This determines whether you need to undergo a more rigorous conformity assessment (as for Important Products) or whether the standard procedure (self-assessment) is sufficient.

The detailed technical descriptions are available via the link. 

‍

‍

The information has been prepared by the GMA Consult Group team.

If you want to get regular updates and insights from the industry, subscribe to our newsletter.‍

GMA Consult Group provides a full cycle of international type approval and global market access services for IT, Telecom, and industrial electrical products in all countries throughout the world. With proven expertise in worldwide regulations, compliance, certification, and conformity assessment, GMA Consult Group can help your company speed up access to any market with almost zero efforts from your side.

Need your own guide to the world of certification and approvals? Don't hesitate to contact us via info@gma.trade.