The Commission adopted Implementing Regulation (EU) 2025/2392 at the end of November 2025, in force from December 21. It gives binding technical descriptions for each category of important and critical product under the Cyber Resilience Act.
Here is why a medtech team should care. MDR and IVDR devices are outside the CRA, but the products around them often are not: wellness wearables, connectivity gateways, remote-access components, identity pieces. The 2025/2392 descriptions are how you tell whether one of yours lands in a category that needs third-party conformity assessment instead of self-assessment. The clock behind this: CRA Article 14 reporting duties start September 11, 2026, and full CRA application arrives December 11, 2027.
Do the classification pass now, on every non-MDR digital product in the portfolio. The conformity route, and how long it takes, depends entirely on which bucket the description drops you into.