Commission Implementing Regulation (EU) 2025/2392 of 28 November 2025 on the technical description of the categories of important and critical products with digital elements pursuant to Regulation (EU) 2024/2847

as it stood on 2025-11-28, permalink: /eu-eurlex/32025r2392/2025-11-28

Point-in-time view as at 2025-11-28. This version has been superseded, it applied 2025-11-28 → open. Jump to the version in force today or see exactly what changed next.

Text included, per-article reading view. Deterministic extraction of the verbatim retrieved document; each article carries its own hash and anchor. © European Union, 1998-2026. Reuse permitted with attribution under Commission Decision 2011/833/EU. Consolidated texts have no legal effect; only acts published in the Official Journal are authentic.

Outline, 3 provisions

art_1 art_2 art_3

art_1 #art_1

Article 1

For the purposes of this Regulation, the following definitions shall apply:

(1)	‘Common Criteria’ means the Common Criteria for Information Technology Security Evaluation as defined in Article 2(1) of Implementing Regulation (EU) 2024/482 or as set out in the standards referred to in Article 3(2), points (a) and (b), of that Implementing Regulation;

(2)	‘Common Evaluation Methodology’ means the Common Methodology for Information Technology Security Evaluation as defined in Article 2(2) of Implementing Regulation (EU) 2024/482 or as set out in the standards referred to in Article 3(2), points (c) and (d), of that Implementing Regulation.

art_2 #art_2

Article 2

The technical description of the categories of products with digital elements under classes I and II listed in Annex III to Regulation (EU) 2024/2847 shall be as set out in Annex I to this Regulation.
The technical description of the categories of products with digital elements listed in Annex IV to Regulation (EU) 2024/2847 shall be as set out in the Annex II to this Regulation.

art_3 #art_3

Article 3

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

Provenance and validity dates, identifier, hash

as of	2025-11-28 → this version applied
valid	2025-11-28 → open publisher-asserted
type	REG_IMPL Commission Implementing Regulation (EU) 2025/2392 of 28 November 2025 on the technical description of the categories of important and critical products with digital elements pursuant to Regulation (EU) 2024/2847 of the European Parliament and of the Council
language	en
published	2025-11-28
lex_id	eu-eurlex:32025r2392:2025-11-28
record sha256	0d7e755eb2ac119a916b2f3a4b4b17846389c6c26c747d6fc0abd7783094a9c3

New here? What am I looking at?

This is a consolidated text: the original law with every later amendment merged in, as the official publisher produced it for a given date. Laws are amended constantly, so “the law” has no single text, only a text per date. That date is the banner above.

It has no legal force. Only the version published in the official gazette (Mémorial / Official Journal) is authentic, the publishers say so themselves, and so do we. Lex reproduces their text without altering a byte, and links the source on every page. This is legal information, never legal advice: it reports what the text said, never what it means for your situation.

“Valid from → to” = the window in which this text applied. “Open” = still current as far as the publisher has consolidated. Each article carries its own hash so you can prove it was not tampered with , here is how.

timeline next version (2025-11-28) →

tier	A, publisher-supplied validity dates
history begins	publisher
index built	2026-08-07T19:46:23Z · corpus 8d5e859
stamp signature	valid (ECDSA-P256)