How the CRA Treats Routers and Modems

Routers and Internet Modems Are Annex III Class I

Annex III Class I category 12 covers routers, modems intended for connection to the internet, and switches. These products therefore sit in the Class I important-product framework where the supplied product has the core functionality described for the category. The inclusion of all three technologies in one Annex category does not mean they perform the same function. Commission Implementing Regulation (EU) 2025/2392 provides separate technical descriptions for routers, internet modems and switches. Manufacturers should classify the actual product using the relevant part of that description and then connect the result to Article 32(2). A multifunction home or enterprise gateway may perform routing, modem, firewall, wireless-access and VPN functions, so product-level core-functionality analysis is particularly important.

• Routers are in Annex III Class I category 12.
• Internet modems are in the same category.
• Qualifying switches are also in category 12.
• Multifunction network equipment requires core-functionality analysis.

Routers Establish and Control Data Flow Between Networks

The 2025 technical description defines routers as products with digital elements that establish and control the flow of data between different networks by selecting paths or routes using routing protocol mechanisms and algorithms. The function typically operates at the network layer. The core routing function therefore distinguishes a router from a firewall, VPN gateway or network-management system even though one appliance can combine several of these capabilities. Manufacturers should document the networks connected by the product, routing mechanisms, control functions and the role those functions play in the product's intended purpose. If routing defines the product, category 12 is directly relevant.

• Routers connect different networks.
• They select paths or routes.
• Routing protocols and algorithms are relevant.
• The function typically operates at the network layer.

Wired, Wireless and Virtual Routers Are Included

Commission Implementing Regulation (EU) 2025/2392 expressly states that the router category includes, but is not limited to, wired routers, wireless routers and virtual routers. The CRA classification is therefore not limited to traditional physical network appliances. A virtual router supplied as software can fall within the same Class I category when routing is its core functionality. Wireless capability also does not create a separate classification category. The manufacturer should identify the supplied router product, its deployment form and routing function rather than assume that only conventional hardware routers are covered. Virtualised and software-defined networking architectures should preserve a clear product boundary for the router component or product being placed on the market.

• Wired routers are expressly included.
• Wireless routers are expressly included.
• Virtual routers are expressly included.
• Software implementation does not exclude router classification.

Routers With or Without Modems Are Included

The technical description specifically includes routers with or without modems. This is important for consumer and telecommunications products where a single gateway combines routing and modem functionality. A combined router-modem device does not need to be split artificially into two products for the category to apply where it is supplied as one product. The manufacturer should still document the product boundary and identify both functions because different technical characteristics and security risks can arise in the routing and communications layers. Integrated wireless access, firewalling, VPN, voice or management functions should also be recorded, but those additional capabilities do not automatically displace the router core functionality.

Internet Modems Have a Specific Technical Description

The modem portion of Annex III category 12 is specifically limited to modems intended for connection to the internet. Commission Implementing Regulation (EU) 2025/2392 describes these as hardware products with digital elements that use digital modulation and demodulation techniques to convert analogue signals from and to digital signals for IP-based communication. The intended internet-connection role therefore matters. A manufacturer should not assume that every communications modem or signal-conversion device falls into this category without checking the described purpose and functionality. The classification record should identify the communications medium, conversion function and role in providing IP-based internet connectivity.

• The Annex wording refers to modems intended for internet connection.
• The technical description refers to hardware products.
• Digital modulation and demodulation are central.
• The conversion supports IP-based communication.

Several Internet Modem Types Are Expressly Identified

The implementing regulation provides a useful non-exhaustive list of modem examples. It includes fibre modems, Digital Subscriber Line modems, cable modems using DOCSIS, satellite modems and cellular modems. These examples show that the category is intended to cover multiple internet-access technologies rather than one legacy form of modem. The examples are illustrative, so a newer or different communications technology can still require analysis where it meets the technical description. Manufacturers should therefore focus on the internet-connectivity function and signal-conversion characteristics rather than asking only whether the product carries one of the familiar modem labels listed in the implementing regulation.

• Fibre modems are examples.
• DSL modems are examples.
• DOCSIS cable modems are examples.
• Satellite and cellular modems are examples.

Switches Are Part of the Same Annex III Category

Although this page focuses on routers and modems, Annex III category 12 also includes switches. The implementing regulation describes switches as products with digital elements that provide connectivity between networked devices through packet-forwarding mechanisms and that have a management plane, typically implemented at the data-link or network layer. Examples include managed switches, smart switches, multilayer switches, virtual security switches, programmable switches for software-defined networking and bridges such as wireless access points. The management-plane requirement is particularly useful when analysing switching products. Manufacturers should use the technical description rather than assume that every simple connectivity device is automatically within the switch category.

• Switches are included in category 12.
• Packet forwarding is central.
• The technical description includes a management plane.
• Managed and programmable switching products are express examples.

Integrated Firewall Functionality Does Not Automatically Make a Router Class II

A router can include firewall functionality, but this does not automatically convert the router into the Class II firewall category. Commission Implementing Regulation (EU) 2025/2392 expressly discusses a router integrating firewall functionality as an example of a product containing functionality from another important-product category while retaining its own core functionality. The manufacturer should compare the defining routing function with the security-filtering function and document which one characterises the supplied product. A dedicated firewall appliance that also performs limited routing can produce the opposite conclusion. The analysis should therefore follow architecture, intended purpose and principal functions rather than whichever feature appears most security-sensitive.

• Routers are Class I category 12.
• Firewalls are Class II category 2.
• Integrated firewall functionality does not automatically change router classification.
• Use the product's core functionality.

VPN Functionality Also Needs a Separate Core-Functionality Test

Routers commonly include VPN server, client or gateway functions. VPN products have their own Annex III Class I category 5, but the presence of VPN capability does not mean every VPN-capable router should be classified as a VPN product. A conventional router still principally establishes and controls data flow between networks. A dedicated VPN gateway principally establishes encrypted logical tunnels. The manufacturer should determine which function defines the supplied product and preserve the reasoning. Where a multifunction gateway is marketed and architected around several equivalent functions, the classification record should consider all plausible categories and document why the selected core functionality best fits the actual product.

• VPN products have a separate Class I category.
• Routers can integrate VPN functionality.
• Core functionality determines the product category.
• Multifunction gateways need documented reasoning.

Class I Conformity Rules Apply to Category 12 Products

Routers, qualifying internet modems and switches within category 12 are Class I important products. Article 32(2) therefore governs the conformity route. Internal control can remain available where the applicable conditions involving harmonised standards, common specifications or an applicable European cybersecurity certification scheme are met. Where they are not met, stricter assessment procedures apply. The European Commission specifically identifies routers among important products for which conformity assessment can require notified-body participation depending on how conformity is demonstrated. Manufacturers should classify the product early, map applicable standards and leave sufficient time for external assessment where necessary.

• Category 12 products are Class I.
• Class I internal control is conditional.
• Standards coverage can affect the route.
• Notified-body involvement may become necessary.

Document the Complete Network Appliance Rather Than One Feature

A classification record for routers and modems should identify the exact product and version, intended purpose, physical or virtual implementation, routing functions, modem functions, switching functions and any integrated firewall, VPN, wireless-access or management capabilities. The record should reference Annex III category 12 and the relevant technical description in Commission Implementing Regulation (EU) 2025/2392. For combined devices, the reasoning should explain which functions establish the product's core functionality and why integrated security functions do or do not change the classification. The result can then be connected to the cybersecurity risk assessment, technical documentation and Article 32 route. Major changes to the network role or product architecture should trigger review.

• Record router, modem and switching functions.
• Record physical or virtual implementation.
• Identify integrated firewall and VPN functions.
• Document the core-functionality conclusion.
• Record the Article 32 route.
• Review after major architecture changes.