Nations Technologies Maps N32 to EU CRA Tiers and Moves Post-Quantum Cryptography into the Hardware Root of Trust

恒森科技
Nations TechnologiesEU CRAPost-Quantum CryptographySecurity ChipIndustrial MCU
A 13 October 2026 report by gongkong.com maps the Nations Technologies N32 family onto the EU Cyber Resilience Act in three tiers: Cortex-M0 parts such as the N32G0 and N32WB toward Class I, Cortex-M4/M7 parts such as the N32H and N32G4 toward Class II, and CC EAL4+ N32S-series security chips toward Critical, with the MCU roadmap aligned to SESIP and PSA Certified. Separately, the company stated on 26 May 2026 that it has embedded post-quantum cryptography in its hardware root of trust, natively integrating in-house CRYSTAL-Kyber and CRYSTALS-Dilithium algorithm IP, with the N32S032, N32S033 and NS350 already supporting PQC components. The article also sets out that CRA classification follows the core function of the end product, not the component.

On 13 October 2026 the Chinese industrial-automation portal gongkong.com published "Industrial Chips Enter the Trust Contest", an account of how Nations Technologies is positioning its portfolio — from high-performance MCUs and high-grade security chips through to post-quantum cryptography (PQC) and compliance with the EU Cyber Resilience Act — as its competitive differentiator. The piece is contributed and editorial in nature: its mapping of device families onto CRA assurance tiers reflects the publication's own account, not an independently verified certification outcome. This article restates that mapping with attribution and sets it against the European Commission's published rules on how CRA classification works.

The CRA tiering as reported

The report groups the N32 family by core platform and assigns each group a level under Regulation (EU) 2024/2847. In the publication's wording:

  • N32G0, N32WB and other Cortex-M0 platform MCUs — said to satisfy CRA Class I requirements;
  • N32H, N32G4 and other Cortex-M4 / Cortex-M7 platform MCUs — said to meet CRA Class II requirements;
  • N32S-series security chips, which already hold an international Common Criteria EAL4+ certificate — said to reach the CRA "Critical" level;
  • the MCU roadmap is described as fully aligned with security certification schemes including SESIP and PSA Certified;
  • end-to-end compliance support is presented in four steps: classification and threat modelling, secure development practice, verification and bill of materials, then assessment and CE filing.

The same report describes Nations Technologies as the first company in China to obtain EMVCo certification and among the country's first licensed commercial cryptography producers, and states that the company has already completed CRA Critical-class product certification domestically. Both claims originate with the report.

Classification follows the end product, not the component

The European Commission anchors CRA classification to the core function of the product placed on the market. Regulation (EU) 2024/2847 entered into force on 10 December 2024. Reporting obligations have applied since 11 September 2026, requiring manufacturers to notify ENISA and national CSIRTs of actively exploited vulnerabilities and severe incidents. Full application follows on 11 December 2027, from which point products placed on the EU market must meet the essential requirements and carry the CE marking. The Commission issued its first package of CRA guidance on 27 July 2026.

Under the Commission's rules on classification and conformity assessment:

  • Default category products, such as storage chips, mobile apps and smart speakers: manufacturers may self-assess;
  • Important products (Annex III, split into Class I and Class II, covering operating systems, antivirus software, routers and firewalls): where harmonised standards have not been applied, a notified body is required in some cases; the Annex III Class II list includes tamper-resistant microprocessors and tamper-resistant microcontrollers;
  • Critical products (Annex IV, including smart cards and secure elements, and smart metering gateways): a notified body is mandatory in all cases;
  • the technical description is laid down by implementing regulation (EU) 2025/2392 of 28 November 2025.

One distinction deserves to be stated plainly. CRA classification depends on the core function of the end product, not on a component in isolation; under the Article 7(1) FAQ, integrating an important or critical product into another product does not bring that outer product under the corresponding conformity assessment procedure. A general-purpose, non-tamper-resistant MCU therefore sits in the default category and can be self-assessed, and is covered only indirectly when it forms part of a Class I, Class II or critical product. The report's pairings — N32G0 and N32WB with Class I, N32H and N32G4 with Class II — are best read as compliance support aimed at end applications in those tiers, rather than as the MCU itself being listed by the EU as a Class I or Class II product.

A related concept is worth separating out: on 18 September 2026 this site reported that the N32H47x and N32H48x had obtained SGS certification to IEC 61508 SIL 2. Functional safety addresses the risk of failure, and is a different framework from the cybersecurity obligations the CRA imposes.

PQC moves into the hardware root of trust

On 26 May 2026 Nations Technologies published "Quantum Track, Chip Security", introducing its post-quantum encryption solution, which embeds PQC directly in the hardware root of trust (RoT). According to that announcement the solution natively integrates in-house CRYSTAL-Kyber (key encapsulation) and CRYSTALS-Dilithium (digital signature) algorithm IP, supports post-quantum digital signature schemes including LMS, XMSS and SPHINCS+ together with SHA-2 and SHA-3 hashing, and ships a post-quantum cryptographic interface library.

  • Chips the announcement names as already natively supporting PQC components: N32S032, N32S033 and NS350;
  • Migration follows a two-track approach of firmware upgrade plus hardware iteration: existing devices receive PQC components through remote firmware updates, while new devices integrate a quantum-safe root natively;
  • Next-generation quantum-safe products in development: pqSE (post-quantum secure element), pqTPM and pqTCM (post-quantum trusted cryptographic modules) and pqUSBToken (post-quantum USB token).

The threat logic given in the announcement is that the integer factorisation and discrete logarithm problems underpinning RSA and ECC collapse under Shor's algorithm, and that harvest-now-decrypt-later (HNDL) attacks can capture and store ciphertext today for decryption once quantum computing matures. On service life, the company puts industrial and critical-infrastructure equipment and IoT medical terminals and smart meters at 10 to 20 years — hardware that cannot be replaced often, which is why cryptographic agility matters.

Market figures cited in the announcement come from MarketsandMarkets: the global PQC market is expected to grow from roughly USD 500 million in 2025 to about USD 2.8 billion in 2030, a compound annual growth rate above 45%. The policy timeline compiled in the same announcement sets out that the NSA requires software and firmware signing transitions to begin immediately with full post-quantum signature use by 2030; that NIST will retire RSA-2048 and ECC-256 entirely by 2035; and that the EU and the UK expect critical infrastructure to complete quantum-safe upgrades by 2030.

The MCU and security base underneath

  • MCU tiers: the N32H7xx dual-core part (Cortex-M7 at 600 MHz plus Cortex-M4F at 300 MHz) targets multi-axis coordination and robot joint drives; the N32H47x/48x, N32MC471 and N32MD473 carry a 240 MHz Cortex-M4F for mainstream servo designs, with 125 ps resolution PWM output and EtherCAT; the N32G45x covers cost-sensitive applications.
  • Security base: hardware engines for AES/TDES/SHA, SM3, SM4 and MD5 with ECC, RSA and SM2; encrypted Flash storage with irreversible read/write protection; Secure Boot firmware verification at power-up; secure update with signature verification; and L0/L1/L2 multi-level read protection.
  • Circuit-breaker selection tiers: miniature circuit breakers (MCB) map to the N32G003 and N32WB031; moulded-case circuit breakers (MCCB, 125 A to 800 A) to the N32G435, N32G452 and N32G455; air circuit breakers (ACB, up to 200 A to 6300 A) to the N32G457 and N32H487.
  • Industrial gateways: the N32S032 security chip, which holds AEC-Q100 automotive qualification plus China's Grade 2 commercial cryptography certification and EAL5+, and the CC EAL4+ certified NS350, work alongside N32H-series MCUs for multi-protocol communication, secure boot, data encryption and security auditing.

The report also cites unnamed third-party research putting Asia-Pacific at roughly 46% of the global servo drive market, with Chinese servo motor revenue surpassing RMB 40 billion in 2025.

Sources

HSY Perspective

The CRA tiering turns on what an end product does, not on which MCU sits inside it — and treating a part number as a compliance grade is the most common misreading of this story. Regulation (EU) 2024/2847 classifies products placed on the EU market by their core function. A general-purpose, non-tamper-resistant MCU falls into the default category and can be self-assessed; under the Article 7(1) FAQ, embedding an important or critical product inside another product does not pull that outer product into the corresponding conformity assessment route. Read strictly, the report's pairing of the N32G0 with Class I and the N32H and N32G4 with Class II carries real meaning only when the product definition lands on an Annex III Class II entry such as tamper-resistant microcontrollers, and at that point whether a notified body is needed depends on whether harmonised standards were applied.

The harder constraint is the calendar. Reporting obligations have applied since 11 September 2026 and full application arrives on 11 December 2027, leaving a little over a year. NIST plans to retire RSA-2048 and ECC-256 outright by 2035. Nations Technologies puts service life at 10 to 20 years for industrial and metering equipment. Those three lines intersect in one place: gateways and servo drives specified today and still in the field after 2028 will have to swap cryptographic algorithms without going offline. The two-track approach of firmware upgrade plus hardware iteration is a response to that window rather than a message issued ahead of the demand.

The judgement has a clear boundary. If the Commission's first CRA guidance of 27 July 2026, or later harmonised standards, name industrial MCU classes explicitly in Annex III or even Annex IV, or if implementing regulation (EU) 2025/2392 pushes assessment granularity down to component level, then planning compliance by part number stops being a misreading and becomes a required action. Unless that happens, the compliance value delivered alongside a component lies in the documentation, threat modelling and verification chain behind it, not in a tier label attached to the chip.