EU CRA for smart home and consumer electronics
Document the class of your smart home range and tell buyers when support ends.
Thermostats, bulbs, smart plugs and smart TVs are default products under the Cyber Resilience Act. Class I applies to devices that protect physical security at home, such as locks, cameras and baby monitors, and to voice assistants.
Last reviewed:
- Applies in full
- 11 December 2027
- Early warning
- 24 hours · Art. 14(2)(a)
- Support period
- at least 5 years · Art. 13(8)
- Most common class here
- Default product
Which class does a smart home device have under the Cyber Resilience Act?
Most smart home devices are default-class products under the Cyber Resilience Act: thermostats, bulbs, smart plugs, smart TVs. The manufacturer self-assesses them under module A (Art. 32(1)). Class I covers devices that protect physical security at home, namely smart locks, security cameras, baby monitors and alarm systems (Annex III item 17), plus general-purpose voice assistants (item 16).
Product classes
Which smart home devices are default class, and which are class I?
The Cyber Resilience Act covers every smart home device and piece of consumer electronics with a data connection to a device or network (Art. 2(1)). Core functionality sets the class (Art. 7(1)): without a security function, a device stays in the default class. In this market, the main class I entries in Annex III are routers (item 12), separately sold radio and network adapters such as Zigbee USB sticks (item 10), general-purpose voice assistants (item 16) and products that protect physical security at home (item 17). Under Implementing Regulation (EU) 2025/2392, item 17 also covers the hubs that control such devices.
Spread in this sector
Pick a product
Radiator or room thermostat with app
Why this class
A comfort function without security functionality; no category in Annex III or IV.
Conformity route
- 1Risk assessment
- 2Self-assessment (module A)
- EU declaration of conformity + CE
Self-assessment by the manufacturer, Art. 32(1) EU CRA.
An assessment based on typical core functions. Your product's intended purpose and design decide.
All product examples as a table+
| Product | EU CRA class | Why |
|---|---|---|
| Radiator or room thermostat with app | Default product | A comfort function without security functionality; no category in Annex III or IV. Product page → |
| Smart bulb, smart plug or blind actuator | Default product | No category in Annex III or IV; self-assessment under module A (Art. 32(1) EU CRA). Product page → |
| KNX, Zigbee or Matter actuator and switch | Default product | The fieldbus or radio link brings the device into scope but does not change its class. Product page → |
| Smart home hub for lighting, heating and shading | Default product | Under Implementing Regulation (EU) 2025/2392, item 17 only covers hubs that control security products. A hub that also controls locks, cameras or alarm systems can fall under item 17, depending on its core functionality. Product page → |
| Smart TV, streaming stick or soundbar | Default product | No category in Annex III or IV; a built-in assistant does not change the core functionality (Art. 7(1), second sentence, EU CRA). |
| Wi-Fi or Bluetooth speaker without a voice assistant | Default product | Without a general-purpose voice assistant, no Annex III category applies. |
| Heating controller or heat pump with app | Default product | No category in Annex III or IV. Product page → |
| General-purpose home voice assistant, speaker or display | Important product, class I (Annex III) | Class I item 16. |
| Smart door lock | Important product, class I (Annex III) | Class I item 17; under recital 12, the manufacturer's cloud function for unlocking remotely is part of the product. |
| Indoor or outdoor security camera | Important product, class I (Annex III) | Class I item 17. |
| Baby monitor with video or app | Important product, class I (Annex III) | Class I item 17; recital 10 counts baby monitors among products for vulnerable consumers. |
| Alarm system with hub, sensors and app | Important product, class I (Annex III) | Class I item 17; under Implementing Regulation (EU) 2025/2392 the hub is included. |
| Wi-Fi router, mesh system or cable modem | Important product, class I (Annex III) | Class I item 12: routers, internet modems and switches. |
Your product isn't listed? The maturity assessment gives a first classification for your own product. Start the EU CRA assessment →
No smart home end device matches a class II category (Annex III class II items 1–4, firewalls among them) or a critical product in Annex IV EU CRA. Smart meter gateways (Annex IV item 2) are covered on the energy & building technology sector page. Devices placed on the market before 11 December 2027 only become subject to the requirements of the Cyber Resilience Act once substantially modified after that date (Art. 69(2)). Connected toys (item 18), wearables (item 19) and connected household appliances have their own page under IoT & consumer products.
Obligations
How long must consumer electronics manufacturers provide security updates?
Under the Cyber Resilience Act, security updates run for the support period the manufacturer sets: at least five years under Art. 13(8) EU CRA, shorter only for products expected to be in use for less than five years. The period follows expected use time, which is why the EU Commission guidance (ch. 5) treats a flat period as open to challenge for a TV or door lock that evidently stays in use longer. The reasoning belongs in the Annex VII technical documentation.
- 01
Buyers see the end date before they pay
At purchase, the end date of the support period appears on the product, its packaging or by digital means, easy to find and with at least month and year (Art. 13(19) EU CRA). User information also states the type of security support on offer (Annex II item 7).
- 02
Secure out of the box and after a reset
Annex I Part I(2)(b) and (d) EU CRA
A video doorbell or an alarm hub ships with a secure default configuration and a reset to the original state (Annex I Part I(2)(b)). Authentication, identity or access management keeps out unauthorised users, and possible unauthorised access gets reported (point (d)).
- 03
Security updates that install themselves
Automatic installation is the default where it suits the device (Annex I Part I(2)(c)), with a notice to users, the option to postpone and a clear opt-out. Where technically feasible, security fixes ship apart from feature updates (Annex I Part II(2)).
- 04
Personal data gone when the device changes hands
Users can wipe all data and settings permanently, securely and easily (Annex I Part I(2)(m)). That covers camera footage, door lock codes and smart TV profiles, for example.
- 05
Authorities and users told in time
Art. 14(2) and (8) EU CRA
Since the Art. 14 obligations took effect on 11 September 2026, manufacturers have had to send an early warning within 24 hours of becoming aware of an actively exploited vulnerability and a notification within 72 hours, both through the single reporting platform to the coordinating CSIRT and ENISA (Art. 14(2) EU CRA). Affected users then hear what they can do themselves (Art. 14(8)).
Related regulation
Which other EU rules apply to smart home devices alongside the Cyber Resilience Act?
Radio Equipment Directive 2014/53/EU and Delegated Regulation (EU) 2022/30
Delegated Regulation (EU) 2022/30 applies Art. 3(3)(d), (e) and (f) of the Radio Equipment Directive (network harm, privacy, fraud) to certain radio equipment. Recital 30 EU CRA states that the essential requirements of the EU CRA include every element of those three, and manufacturers subject to both acts are due Commission guidance during the transition.
General Data Protection Regulation (EU) 2016/679
The GDPR continues to apply in full (recital 32 EU CRA). Annex I Part I(2)(e) and (g) EU CRA add confidentiality and data minimisation as product requirements, for example for video and audio recorded at home.
In practice
Where smart home manufacturers get stuck
One chipset under many product lines
Camera, video doorbell and baby monitor often run the same chipset and vendor SDK. One SDK flaw then reaches several lines and model years, and both report and fix depend on knowing which firmware build sits on which device.
Model years with their own end dates
Last year's model sold from a retailer's stock shows an earlier end of support than its successor on the same shelf. Box, product page and app need to state the same date for that generation.
Firmware, app and cloud from different hands
The SDK comes from the chip vendor, the app from an agency, part of the cloud from a platform provider. Due diligence under Art. 13(5) EU CRA means assessing these pieces per device and keeping the evidence.
Class I only: notified body dates in the launch calendar
Until a fully applied harmonised standard supports self-assessment, a new lock or camera generation needs a notified body slot in the project plan. A holiday-season launch means booking the type examination before production release.
With Kunnus
How Kunnus supports smart home manufacturers
Per product line and model year, Kunnus keeps what the Cyber Resilience Act asks for: the classification and its rationale, SBOMs, vulnerability status and reports. Radio, EMC and electrical safety testing stay in your existing CE process.
Worked example
Worked example: a thermostat and lighting range with an app
One radio platform, three lines (radiator thermostat, smart bulb, smart plug), controlled through the manufacturer's own app and cloud. Each line gets a new generation every year, each with a five-year support period under Art. 13(8) EU CRA.
- 1Classdefault class for all three lines; self-assessment under module A, no notified body
- 2The product includesdevice, app and the manufacturer's cloud, where a device function depends on it (Art. 3(1) and (2) EU CRA; for the app, EU Commission guidance section 2.4, example 9)
- 3Generations in support3 lines × 5 model years = 15 at once
- 4Shared componentsradio stack and cloud back end in all 15 generations; a flaw there reaches every line
- 5Support end dates15, stated at purchase with month and year (Art. 13(19) EU CRA)
- 6Retentiontechnical documentation per generation kept for at least 10 years (Art. 13(13) EU CRA)
Illustrative assumptions, not sector data. Adding a camera line would put that line in class I (Annex III item 17) with its own conformity assessment route.
Products
Which products from this sector have their own page?
Frequently asked questions
Which conformity route applies to smart locks, cameras and baby monitors?+
Smart door locks, security cameras, baby monitors and alarm systems (Annex III class I item 17) may only be self-assessed under module A where the manufacturer fully applies a harmonised standard, a common specification or a certification scheme at assurance level 'substantial' or higher (Art. 32(2)). Otherwise a notified body assesses them (modules B and C, or module H).
Is a smart TV with a built-in voice assistant an important product?+
Under the Cyber Resilience Act, a smart TV with a built-in assistant usually stays in the default class, because according to Art. 7(1) EU CRA an integrated Annex III component does not by itself pull the host device into the stricter assessment, as the EU Commission guidance shows with a smartphone and its operating system (ch. 6, example 58). Marketing, manual and documentation should describe the TV's core functionality consistently. A speaker sold mainly as a home assistant falls under class I item 16.
Does a Wi-Fi router with a built-in firewall count as class II?+
A home Wi-Fi router stays in class I under Annex III item 12 EU CRA, firewall or not. The EU Commission guidance uses exactly this case (ch. 6, example 63): the router's own core functionality decides, and the integrated firewall component changes nothing. Class II item 2 applies to firewalls sold as products in their own right.
Is a smart smoke detector or a smart home hub covered by Annex III item 17?+
Class I item 17 of Annex III EU CRA introduces its four named device types with the word "including", so the list is open. In our assessment the test is whether a security functionality is the device's core functionality (Art. 7(1)): a hub acting as an alarm system's control unit leans towards item 17, one that switches lights and heating does not. Implementing Regulation (EU) 2025/2392 holds the category descriptions.
What happens when the support period of a smart home device ends?+
At the end of the support period, users get a notice where the device makes that technically feasible (Art. 13(19) EU CRA, second sentence). Each security update stays available for at least ten years after release, or for the rest of the support period if that is longer (Art. 13(9)). Art. 14 reporting carries on (EU Commission guidance, ch. 9.1), and voluntary patching of old generations, paid or free, stays possible (ch. 5).
Do the reporting obligations cover devices already in people's homes?+
Reporting under the Cyber Resilience Act covers devices already in homes: Art. 69(3) extends Art. 14 to in-scope products placed on the market before 11 December 2027, baby monitors and routers sold years ago included. Under the EU Commission guidance (ch. 9.1), exploitation the manufacturer knew of before 11 September 2026 is not reportable; exploitation discovered afterwards is.
Is ETSI EN 303 645 enough for Cyber Resilience Act conformity of a smart home device?+
ETSI EN 303 645 is a voluntary consumer IoT standard whose 13 provisions overlap with much of Annex I EU CRA. A presumption of conformity comes only from harmonised standards referenced in the Official Journal, and only as far as they reach (Art. 27(1); EU Commission guidance, ch. 6.3). For a class I device, ETSI EN 303 645 cannot stand in for a harmonised standard under Art. 32(2). Support period, SBOM and reporting to ENISA need evidence of their own.
Which class do your smart home products fall into?
The Cyber Resilience Act assessment takes a few minutes and returns a first, non-binding estimate of your devices' product class, with suggested next steps.
Further reading
Other sectors
EU CRA compliance in other industries
Source: Regulation (EU) 2024/2847 (Cyber Resilience Act), Official Journal of the EU. https://eur-lex.europa.eu/eli/reg/2024/2847/oj
This page is an orientation on the Cyber Resilience Act for this sector, not legal advice. Whether and how the regulation applies to a specific product depends on its intended purpose and design.