Cyber Resilience Act for energy and building technology
Inverters, chargers, building controllers: each product classified and on record.
Under the Cyber Resilience Act most devices in this sector are default products; the smart meter gateway is the critical exception. Kunnus gives you one place for classification, vulnerability tracking and reporting on every product you have shipped, installed units included.
Last reviewed:
- Applies in full
- 11 December 2027
- Early warning
- 24 hours · Art. 14(2)(a)
- Support period
- at least 5 years · Art. 13(8)
- Most common class here
- Default product
Which class do solar inverters, EV chargers, building automation and smart meter gateways have under the Cyber Resilience Act?
Solar inverters, battery storage, EV chargers, heat pump controllers and building automation appear in neither annex of the Cyber Resilience Act and are default products the manufacturer self-assesses (Art. 32(1)). A built-in router or VPN module does not change that (Art. 7(1), second sentence). The exception is the smart meter gateway, a critical product under Annex IV, point 2.
Product classes
Which energy and building technology products fall under the EU Cyber Resilience Act?
If an energy or building technology product has a direct or indirect data connection to a device or network, the Cyber Resilience Act applies to it (Art. 2(1) EU CRA). A KNX, BACnet or Modbus link is enough to qualify. Where a device function depends on the manufacturer's cloud, the cloud is remote data processing and part of the product (Art. 3(2) EU CRA). Core functionality decides the class, and for most products in this sector the result is the default class.
Spread in this sector
Pick a product
Solar or hybrid inverter
Why this class
No category in Annex III or IV.
Conformity route
- 1Risk assessment
- 2Self-assessment (module A)
- EU declaration of conformity + CE
Self-assessment by the manufacturer, Art. 32(1) EU CRA.
An assessment based on typical core functions. Your product's intended purpose and design decide.
All product examples as a table+
| Product | EU CRA class | Why |
|---|---|---|
| Solar or hybrid inverter | Default product | No category in Annex III or IV. Product page → |
| Battery storage with storage controller | Default product | No category in Annex III or IV. Product page → |
| Wallbox and charging station, AC and DC | Default product | No category in Annex III or IV. Product page → |
| Heat pump, heating and ventilation controller, room thermostat | Default product | No category in Annex III or IV. Product page → |
| KNX, BACnet and Modbus devices without a security function | Default product | No category in Annex III or IV. |
| Lighting and blind control for buildings | Default product | No category in Annex III or IV. |
| Electronic electricity meter without a gateway | Default product | Annex IV, point 2 covers the smart meter gateway, not the meter. |
| Building management system, EMS and HEMS with the manufacturer's cloud | Default product | No category; the cloud is remote data processing and part of the product (Art. 3(2), recital 12 EU CRA). |
| Remote maintenance gateway with VPN as core functionality | Important product, class I (Annex III) | Annex III, class I, point 5. |
| LTE routers, internet modems and managed switches for site networks | Important product, class I (Annex III) | Annex III, class I, point 12. |
| Access control reader, including biometric | Important product, class I (Annex III) | Annex III, class I, point 1. |
| Firewall, IDS or IPS for building and control networks | Important product, class II (Annex III) | Annex III, class II, point 2, where that is the core functionality. |
| Smart meter gateway in a smart metering system | Critical product (Annex IV) | Annex IV, point 2; it covers the gateway, not the meter. Until a delegated act under Art. 8(1) mandates a certificate, the class II procedures with a notified body apply (Art. 32(4) EU CRA). |
Your product isn't listed? The maturity assessment gives a first classification for your own product. Start the EU CRA assessment →
Not covered: spare parts built to the same specification as the identical component they replace (Art. 2(6) EU CRA). Smart door locks and alarm systems (Annex III, class I, point 17) are on the smart home and consumer electronics page. Utilities and grid operators fall under NIS2 as essential or important entities.
Obligations
What matters most for energy and building technology manufacturers
- 01
A support period that reflects expected use
The manufacturer sets the support period, and it has to reflect how long the product is expected to be in use (Art. 13(8) EU CRA). Reasonable user expectations, the product's nature and intended purpose, and the support periods of third-party components that provide core functions all feed into it. The reasoning goes into the technical documentation.
- 02
Manufacturers report exploited vulnerabilities and severe incidents
Art. 14(1) to (4) EU CRA
The duty to report sits with the manufacturer, not the building owner or grid operator. Actively exploited vulnerabilities and severe incidents go to the coordinating CSIRT and ENISA at once, via the single reporting platform (Art. 14(1) and (3) EU CRA). The Art. 14(2) deadlines, which manufacturers have had to meet since 11 September 2026, are an early warning within 24 hours of becoming aware, a notification within 72 hours and, for vulnerabilities, a final report no later than 14 days after a fix is available.
- 03
Portal, app and backend count as part of the device
A monitoring portal, app or charging backend is remote data processing when the manufacturer designs it, or has it designed, and the device loses a function without it (Art. 3(2) EU CRA). Risk assessment and vulnerability handling then cover both as one product.
- 04
Third-party modules integrated with due diligence
Few manufacturers write their own radio stack, real-time OS or TLS library. Art. 13(5) EU CRA requires due diligence when integrating such third-party components, open source included.
- 05
A security update is generally not a substantial modification
Models placed on the market before 11 December 2027 only have to meet the full requirements once they are substantially modified (Art. 69(2) EU CRA). Recital 39 treats a security update that lowers the risk and keeps the intended purpose as generally not substantial. A firmware release that adds a core function may be.
- 06
Selling under your own brand makes you the manufacturer
Art. 3(13) and Art. 21 EU CRA
Putting your own brand on an ODM-built charger or inverter makes you its manufacturer (Art. 3(13) EU CRA), with every obligation under Articles 13 and 14. Importers and distributors take on that role under Art. 21 when they sell under their own name or substantially modify the product.
Related regulation
How does the Cyber Resilience Act fit with NIS2, the RED and the Machinery Regulation in this sector?
In energy and building technology, the Cyber Resilience Act governs product cybersecurity, while separate acts cover operators, radio equipment and machinery.
NIS2 Directive (EU) 2022/2555
NIS2 is aimed at utilities and grid operators, the Cyber Resilience Act at whoever makes their equipment; the reporting channels stay separate. Essential entities' critical dependency on a product category is one ground for adding it to Annex IV (Art. 8(2)(a) EU CRA).
Radio Equipment Directive (RED), Delegated Regulation (EU) 2022/30
Wi-Fi and LTE chargers, thermostats and meters are subject to the RED cybersecurity requirements of Art. 3(3)(d) to (f) today, and recital 30 EU CRA confirms that Annex I contains all elements of those requirements. EU type-examination certificates on cybersecurity issued under other harmonisation legislation stay valid for a transitional period (Art. 69(1) EU CRA).
Machinery Regulation (EU) 2023/1230
Ventilation units and gate drives that qualify as machinery have to meet both sets of requirements. Meeting the Cyber Resilience Act can make sections 1.1.9 and 1.2.1 of Annex III to the Machinery Regulation easier to satisfy, if the manufacturer demonstrates the link (recital 53 EU CRA).
Directive (EU) 2019/944 on the internal market for electricity
Annex IV, point 2 EU CRA relies on Art. 2(23) of this directive for what counts as a smart metering system, and that definition decides which gateways are critical.
In practice
Where energy and building technology manufacturers get stuck
Shared firmware across hardware generations
A controller's OS, network stack and TLS library often carry over between hardware generations. When a CVE lands in one of them, the first question is which variants in the field contain it.
Supplier support that ends first
Radio modules and real-time operating systems come from suppliers whose support often ends before yours. The maker of the finished device still handles vulnerabilities in those parts for its whole support period (Art. 13(8) EU CRA).
Firmware and backend in separate teams
The inverter portal or the charger's OCPP backend is often run by a different team than the firmware. Under the Cyber Resilience Act both ship as one product, with one risk assessment.
Devices behind the firewall
Isolated site networks keep many field devices offline, so updates arrive by service tool or through the installer. Tracking which firmware version runs on which unit gets harder as a result.
With Kunnus
What Kunnus handles for energy and building technology manufacturers
Your CE process for EMC, low-voltage and radio testing stays as it is. On top of it, Kunnus keeps the EU CRA work for each product in one record: classification, SBOM, vulnerability handling, reporting and technical documentation.
Worked example
Worked example: a building automation manufacturer
Take a maker of room and plant controllers with three hardware generations in the field on one firmware platform:
- 1Variants in the field3 generations × 8 = 24
- 2SBOMs a year, at 2 releases per generation48
- 3Variants hit by one CVE in the shared TLS libraryall 24
- 4Early warning if actively exploited (Art. 14(2))within 24 hours of becoming aware
- 5Support period at 15 years' expected use (Art. 13(8))15 years, not 5
- 6Technical documentation kept (Art. 13(13))15 years per variant
Assumed values for illustration, not sector statistics. Documentation is kept for at least ten years or the support period, whichever is longer (Art. 13(13) EU CRA).
Products
Which products from this sector have their own page?
Frequently asked questions
Are solar inverters important or critical products under the Cyber Resilience Act?+
Solar inverters are default products under the Cyber Resilience Act today, because neither Annex III nor Annex IV lists them; the manufacturer assesses a connected inverter under Art. 32(1) EU CRA. Moving inverters into Annex III would take a delegated act under Art. 7(3) EU CRA, which as a rule provides a transitional period of at least 12 months.
Is a smart meter gateway a critical product under the Cyber Resilience Act?+
A smart meter gateway within a smart metering system as defined in Art. 2(23) of Directive (EU) 2019/944 is a critical product under Annex IV, point 2 of the Cyber Resilience Act. The gateway is listed; the electricity meter itself is not. A European cybersecurity certificate becomes mandatory only once a delegated act under Art. 8(1) EU CRA requires it and a scheme is available. Until then, smart meter gateways go through a notified body under Art. 32(3) EU CRA.
Does the Cyber Resilience Act apply to EV charging stations?+
An EV charger with a network, radio or backend connection is in scope of the Cyber Resilience Act (Art. 2(1) EU CRA). No annex lists charging points, so the manufacturer self-assesses under Art. 32(1), and a manufacturer-built OCPP backend the charger depends on is part of the product. A separately sold VPN router for remote access to chargers would be an Annex III class I product in its own right (point 5).
Does the Cyber Resilience Act cover building automation controllers that only talk on a local bus such as KNX or BACnet?+
A building automation controller on a local KNX or BACnet bus is in scope of the Cyber Resilience Act: Art. 2(1) EU CRA covers any direct or indirect logical or physical data connection to a device or network, with or without internet access. Without a security core function, the controller is a default product under Art. 32(1) EU CRA.
How long must manufacturers of building technology provide security updates?+
Art. 13(8) of the Cyber Resilience Act ties the support period to the time a product is expected to be in use and sets a minimum of five years. A boiler or building automation controller expected to stay in service longer gets a correspondingly longer support period. Security updates released in that period must stay available for ten years, or until the support period ends if that is later (Art. 13(9) EU CRA).
Do the reporting obligations apply to products already installed in buildings?+
Reporting obligations under the Cyber Resilience Act cover products already installed in buildings: Art. 69(3) EU CRA extends Art. 14 to every in-scope product placed on the market before 11 December 2027. Since the reporting obligations took effect on 11 September 2026, a vulnerability in an inverter that has sat on a roof for years has been reported exactly as one in a new unit. To report, the manufacturer needs to know which firmware versions in the field carry the vulnerability.
Which class are your products in?
The EU CRA assessment gives you a first read on which class your products fall into and which obligations to tackle first.
Further reading
Other sectors
EU CRA compliance in other industries
Source: Regulation (EU) 2024/2847 (Cyber Resilience Act), Official Journal of the EU. https://eur-lex.europa.eu/eli/reg/2024/2847/oj
This page is an orientation on the Cyber Resilience Act for this sector, not legal advice. Whether and how the regulation applies to a specific product depends on its intended purpose and design.