EU Cyber Resilience Act for IoT and connected consumer products
Settle the class and support period before your device ships.
App-connected appliances, bike computers and headphones are default products under the Cyber Resilience Act. Kids' watches are always class I, fitness bands only with health tracking. Without a fully applied harmonised standard, common specification or certification, a notified body then assesses them (Art. 32(2)). Book that slot early.
Last reviewed:
- Applies in full
- 11 December 2027
- Early warning
- 24 hours · Art. 14(2)(a)
- Support period
- at least 5 years · Art. 13(8)
- Most common class here
- Default product
Which class do IoT and consumer products have under the EU Cyber Resilience Act?
Most connected consumer products, such as app-controlled washing machines, bike computers or headphones, are default-class products under the EU Cyber Resilience Act and self-assessed (Art. 32(1)). Only two groups are class I: internet-connected toys that talk, film or track location (Annex III point 18), and wearables for health monitoring or for children under 14 (point 19).
Product classes
Which connected consumer products are default class, and which are class I?
A consumer product is in scope of the Cyber Resilience Act when its intended purpose or reasonably foreseeable use includes a direct or indirect data connection to a device or network (Art. 2(1)), and pairing with a phone over Bluetooth qualifies. Core functionality sets the class (Art. 7(1)); an Annex III microcontroller on the board does not raise the device's class by itself. The list below is our assessment based on typical features.
Spread in this sector
Pick a product
Washing machine, oven, coffee machine or fridge with an app
Why this class
No category in Annex III or IV; a built-in voice assistant does not change the core functionality (Art. 7(1), second sentence, EU CRA).
Conformity route
- 1Risk assessment
- 2Self-assessment (module A)
- EU declaration of conformity + CE
Self-assessment by the manufacturer, Art. 32(1) EU CRA.
An assessment based on typical core functions. Your product's intended purpose and design decide.
All product examples as a table+
| Product | EU CRA class | Why |
|---|---|---|
| Washing machine, oven, coffee machine or fridge with an app | Default product | No category in Annex III or IV; a built-in voice assistant does not change the core functionality (Art. 7(1), second sentence, EU CRA). Product page → |
| Robot vacuum or kitchen scale with an app | Default product | No category in Annex III or IV. Product page → |
| Pet tracker, bike computer, headphones with an app, without health features and not made for children | Default product | Under point 18, location tracking only makes toys class I; pet and sports accessories have no category of their own. |
| E-bike display or pedelec drive with an app | Default product | Default class in our assessment; Art. 2(2)(c) excludes vehicles under Regulation (EU) 2019/2144, and pedelecs do not fall under it. |
| Power tool with Bluetooth and an app | Default product | No category in Annex III or IV. |
| Notification-only smartwatch for adults | Default product | Our assessment: default category. An added health monitoring function would change that. |
| Bluetooth toy car without voice, camera or location features | Default product | Point 18 needs an internet connection plus social interaction or location tracking. |
| Fitness tracker or smartwatch with heart rate or sleep tracking | Important product, class I (Annex III) | Health monitoring purpose, so Annex III class I point 19; route under Art. 32(2) EU CRA. |
| Kids' smartwatch, GPS watch and other wearables for children | Important product, class I (Annex III) | Annex III class I point 19, second alternative, regardless of health features; route under Art. 32(2) EU CRA. |
| Talking doll, learning robot with camera, toy with location tracking | Important product, class I (Annex III) | Annex III class I point 18 for internet-connected toys under Directive 2009/48/EC; route under Art. 32(2) EU CRA. |
Your product isn't listed? The maturity assessment gives a first classification for your own product. Start the EU CRA assessment →
Spare parts that replace identical components and are made to the same specifications are outside the Cyber Resilience Act (Art. 2(6)). Voice assistants, smart locks, security cameras, baby monitors and alarm systems (Annex III class I, points 16 and 17) are covered on our Smart Home & Consumer Electronics sector page.
Obligations
Cyber Resilience Act requirements for IoT device manufacturers
- 01
End-of-support date shown at the point of sale
Art. 13(19) EU CRA; Annex II(7)
Art. 13(19) of the Cyber Resilience Act has manufacturers state the end date of the support period at the time of purchase, at least as month and year, on the product, the packaging or by digital means. Where feasible, the device itself announces when support has ended, and the date also appears in the user information (Annex II(7)).
- 02
Secure out of the box, patched automatically
Products go on sale with a secure default configuration, a reset to the original state and authentication against unauthorised access (Annex I Part I(2)(b) and (d) EU CRA). Where the risk assessment calls for it, security updates install automatically by default with a clear opt-out (point (c)), and consumers receive them without delay and free of charge (Part II(8)).
- 03
A documented component inventory for device, app and cloud
The EU Commission guidance assigns the companion app to the device's SBOM (section 2.4); back-end services that carry a product function go into its risk assessment and technical documentation (section 8.2). The SBOM itself has to be machine-readable, in a commonly used format, and list at least the top-level dependencies (Annex I Part II(1) EU CRA).
- 04
Actively exploited vulnerabilities reported on time
Art. 14(2) and (8) EU CRA
Under Art. 14(2)(a) EU CRA, applicable as of 11 September 2026, a manufacturer sends an early warning on an actively exploited vulnerability to the coordinating CSIRT and ENISA within 24 hours of becoming aware of it, via the single reporting platform; the notification follows within 72 hours. The manufacturer then informs affected users about the vulnerability and the mitigations they can take (Art. 14(8)), which for consumer products needs a direct channel such as the app.
Related regulation
How does the Cyber Resilience Act fit with the RED Delegated Regulation and other rules for connected consumer products?
For certain radio equipment, the cybersecurity requirements in Art. 3(3)(d), (e) and (f) of the Radio Equipment Directive 2014/53/EU apply today through Delegated Regulation (EU) 2022/30. Recital 30 of the Cyber Resilience Act states that its essential requirements include all elements of those three. Repealing or amending the Delegated Regulation is left to the Commission, which is also to give manufacturers subject to both acts guidance for the transition.
Radio Equipment Directive 2014/53/EU, Delegated Regulation (EU) 2022/30
Type-examination certificates already issued for cybersecurity requirements under other Union harmonisation legislation keep their validity through the transition period in Art. 69(1) EU CRA.
Toy Safety Directive 2009/48/EC
Annex III point 18 EU CRA relies on this directive to define what counts as a toy, while toy safety proper is assessed under the directive itself.
Medical devices, Regulations (EU) 2017/745 and 2017/746
Art. 2(2)(a) and (b) of the Cyber Resilience Act carve out medical devices and in vitro diagnostics, which remain under the MDR and IVDR.
Representative Actions Directive (EU) 2020/1828
Because Art. 67 EU CRA lists the regulation in Annex I of the directive, qualified consumer organisations can take breaches to court as representative actions.
ETSI EN 303 645
A voluntary consumer IoT security standard and a practical implementation aid. Under Art. 27(1) EU CRA, presumption of conformity attaches to harmonised standards referenced in the Official Journal.
In practice
Where consumer IoT compliance stalls
Discontinued models need patches for years
Art. 13(8) of the Cyber Resilience Act ties the support period to how long a product is expected to be used. With a new generation every year, the team ends up patching several older models while it develops the next one.
Late features reopen the classification
A product team that adds a microphone to a plush toy or a pulse sensor to a wristband after design freeze moves the product into class I, and the external assessment has to fit into a schedule that never planned for it.
Releases come from three teams
Firmware ships over the air, the companion app through the app stores and the back end through server deployments, often from three different teams. An SBOM for a product version depends on knowing which app release pairs with which firmware build.
White-label products depend on the ODM's records
With an ODM-built device, source code, chip SDK and build environment sit at the ODM. The brand owner relies on that data for the SBOM, vulnerability status and fix times of the models it sells.
With Kunnus
How Kunnus supports connected consumer product manufacturers
Kunnus covers the Cyber Resilience Act layer of conformity. Radio, EMC, toy safety and general product safety requirements stay in your existing CE process.
Worked example
How long must manufacturers of connected consumer products provide security updates?
Article 13(8) of the Cyber Resilience Act requires a support period of at least five years for connected consumer products, set to match how long the product is expected to be used and what buyers can reasonably expect. The EU Commission guidance (C(2026) 5252) treats five years as the minimum, so a product with a longer expected life needs a longer period. Security updates stay available for at least ten years after release, or until the support period ends if that is later (Art. 13(9) EU CRA).
- 1RangeFitness band, kids' smartwatch, app-connected kitchen scale and robot lawnmower, with one new generation of each a year
- 2Annex III statusPoint 19 for the band and the kids' watch (class I); default category for the scale and the lawnmower
- 3Expected use6 years, which sets a 6-year support period per generation instead of the 5-year minimum (Art. 13(8) EU CRA)
- 4Release cadence4 firmware releases per generation per year
- 5Generations under supportup to 6 per product line, 24 in total
- 6Builds to track per year96 (24 × 4), with an SBOM for each; security fixes stay downloadable for at least 10 years (Art. 13(9) EU CRA)
Illustrative figures, not market data.
Products
Which products from this sector have their own page?
Frequently asked questions
What does self-assessment involve for a connected appliance without security functions?+
A connected appliance without a security function goes through internal control under Art. 32(1)(a) of the Cyber Resilience Act (Module A), with no notified body involved. The manufacturer compiles the technical documentation set out in Annex VII, issues the EU declaration of conformity under Art. 28 and affixes the CE marking under Art. 30. The essential requirements of Annex I apply in full.
Is the cloud remote control of a device part of the product under the Cyber Resilience Act?+
Recital 12 of the Cyber Resilience Act names cloud features that let users control a household appliance remotely as in scope. The test sits in Art. 3(2): remote data processing belongs to the product when the manufacturer developed the software, or had it developed under its responsibility, and the device would lose a function without it. The EU Commission guidance counts onboarding, configuration and update distribution as functions; telemetry collected only for statistics is not remote data processing.
Which wearables are important products in class I under Annex III?+
For wearables aimed at adults, Annex III point 19 of the Cyber Resilience Act turns on health monitoring. In our reading, the deciding factor is the intended purpose the manufacturer states in the user information (Annex II(4)): a band marketed with heart-rate, sleep or stress analysis points to class I. Product pages, app copy and packaging should therefore describe the same purpose as the technical documentation.
We sell an ODM-built device under our own brand. Who is the manufacturer under the Cyber Resilience Act?+
The brand owner is the manufacturer. Art. 3(13) of the Cyber Resilience Act defines the manufacturer as whoever has a product designed or made and markets it under its own name or trademark, so white-label sellers carry the obligations of Articles 13 and 14. The ODM's components fall under the brand owner's due diligence duty in Art. 13(5), which is why access to SBOMs and fixes belongs in the supply contract.
Does the Cyber Resilience Act apply to legacy devices already on the market?+
Devices placed on the market before 11 December 2027 only have to meet the requirements of the Cyber Resilience Act once they undergo a substantial modification (Art. 69(2)). Under Art. 69(3), the reporting obligations of Art. 14 have applied to these legacy devices since 11 September 2026. According to the EU Commission guidance, reporting continues after the support period ends.
Which conformity assessment route applies to a connected toy in class I when no harmonised standard exists?+
Without a fully applied harmonised standard, Art. 32(2) of the Cyber Resilience Act allows two procedures for a connected toy under Annex III point 18: EU type-examination (Module B) followed by internal production control (Module C), or full quality assurance (Module H). A notified body takes part in both; the Chapter IV rules on notified bodies are applicable as of 11 June 2026.
Default category or class I: where do your products land?
The EU CRA assessment gives you a first estimate of class, obligations and next steps for your connected products in a few minutes.
Further reading
Other sectors
EU CRA compliance in other industries
Source: Regulation (EU) 2024/2847 (Cyber Resilience Act), Official Journal of the EU. https://eur-lex.europa.eu/eli/reg/2024/2847/oj
This page is an orientation on the Cyber Resilience Act for this sector, not legal advice. Whether and how the regulation applies to a specific product depends on its intended purpose and design.