Important — class II
The list (Annex III, Part II)
- Hypervisors and container runtime systems that support virtualised execution of operating systems and similar environments.
- Firewalls, intrusion detection and prevention systems (IDS / IPS).
- Tamper-resistant microprocessors.
- Tamper-resistant microcontrollers.
- Operating systems.
The regime
Self-assessment is excluded. Only two modules are open, and both involve a notified body:
| Module | Content | What is certified |
|---|---|---|
| B + C | EU type-examination, then conformity to type based on internal control of production | The product, in a given version |
| H | Full quality assurance: the design, development and production system is audited and approved | The process |
Holding a European cybersecurity certificate at assurance level at least “substantial” and covering the relevant essential requirements is also an admissible route.
Choosing between B+C and H
| Criterion | B + C | H |
|---|---|---|
| Release cadence | Suits long-cycle products with rare versions | Suits continuous delivery |
| New version | May require an extension or reassessment of the certificate | Covered by the approved quality system |
| Up-front effort | Concentrated on a product file | Falls on the organisation: procedures, traceability, audits |
| Recurring effort | At every significant version | Periodic surveillance audits |
| Suited to | Firmware, hardware products, embedded operating systems | Software vendors releasing frequently |
For a vendor releasing several times a month, module B+C becomes unmanageable quickly: every substantial modification reopens the certificate question. Module H costs more up front but absorbs the cadence.
Programme implications
- Cost of assessment, to be budgeted per product and per cycle.
- Lead time of several months, dependent on the body’s workload, not compressible.
- Version freeze during examination, for module B.
- Managing substantial modifications after certification: any change affecting conformity reopens a procedure.
- Contracting early: this is the only item on the programme whose lead time you do not control.
Scheduling alert. The chapter on notification of conformity assessment bodies has applied since 11 June 2026. The number of accredited bodies and their capacity will be limited at the outset, while the entire market must pass through them before 11 December 2027. Booking a slot is a task for now, not for when the file is ready.
Qualification watch points
- “Operating system” reads broadly: an embedded or real-time operating system you distribute falls within the category.
- A container runtime is covered; a mere orchestrator is not, on the same basis, but the whole must be examined component by component.
- A tamper-resistant microcontroller falls under class II; the same microcontroller without that property falls under class I if it carries security-related functionalities. The qualification must be settled by engineering, on the basis of the physical countermeasures actually implemented, and documented.
- A product that embeds an operating system without placing it on the market separately is not for that reason alone in class II: what counts is the function offered to the market. Due diligence on that third-party component remains owed, however.