EU CRA for connected home appliances
Your appliance is default class. App, cloud and voice control included.
A washing machine, oven or coffee machine with Wi-Fi and an app falls under the Cyber Resilience Act. It does not need a notified body.
Last reviewed:
- Applies in full
- 11 December 2027
- Early warning
- 24 hours · Art. 14(2)(a)
- Support period
- at least 5 years · Art. 13(8)
- Most common class here
- Default product
Does the Cyber Resilience Act apply to home appliances with an app?
Yes. An appliance with Wi-Fi, Bluetooth or an app connects to a device or network and is therefore in scope of the Cyber Resilience Act (Art. 2(1)). Washing machines, ovens and fridges are not listed in Annex III or IV, so they are default class. The manufacturer self-assesses under module A (internal control, without a notified body).
Product classes
When is a home appliance in scope of the EU CRA?
Three questions decide. Does the appliance have a data connection, direct or indirect, including Bluetooth, a service port or the service engineer's diagnostic tool? Is it placed on the EU market? Do none of the Art. 2 exclusions apply? Then the appliance is in scope. The app belongs to the product as software. The manufacturer's cloud belongs to it if the appliance needs it for a function, such as remote start (remote data processing, Art. 3(2)).
Spread in this sector
Pick a product
Washing machine, dryer or dishwasher with Wi-Fi and app
Why this class
No category in Annex III or IV; self-assessment under module A, Art. 32(1) EU CRA.
Conformity route
- 1Risk assessment
- 2Self-assessment (module A)
- EU declaration of conformity + CE
Self-assessment by the manufacturer, Art. 32(1) EU CRA.
An assessment based on typical core functions. Your product's intended purpose and design decide.
All product examples as a table+
| Product | EU CRA class | Why |
|---|---|---|
| Washing machine, dryer or dishwasher with Wi-Fi and app | Default product | No category in Annex III or IV; self-assessment under module A, Art. 32(1) EU CRA. |
| Oven, hob or cooker hood with remote control by app | Default product | Cooking or extraction is the core functionality; remote control is an extra function of the appliance. |
| Coffee machine or kitchen machine with recipe app | Default product | Core functionality is making coffee; no category in Annex III or IV. |
| Fridge with interior camera for groceries | Default product | In our assessment not a security camera under Annex III item 17: the camera does not protect the physical security of the household. |
| Robot vacuum or robot mower with app and room map | Default product | In our assessment default class as long as it is not marketed as a surveillance camera; its core functionality is cleaning or mowing. |
| Appliance with a built-in voice assistant | Default product | The core functionality stays washing, cooking or cooling (Art. 7(1) EU CRA). |
| Smart speaker with assistant as a kitchen hub, sold separately | Important product, class I (Annex III) | General-purpose virtual assistant under Annex III class I item 16 EU CRA, where the assistant is the core functionality. |
Your product isn't listed? The maturity assessment gives a first classification for your own product. Start the EU CRA assessment →
Appliances with no data connection at all, such as a toaster with electronics but no data or service interface, are outside the Cyber Resilience Act. Placing on the market counts per unit: units of a series first supplied to distributors or customers from 11 December 2027 must comply. Units placed on the market before that date only become subject to the requirements after a substantial modification (Art. 69(2)). Art. 14 covers them as well (Art. 69(3)).
Default class
What does the default class mean for an appliance manufacturer?
Default class means the manufacturer may assess conformity itself. The class does not reduce the Annex I requirements of the Cyber Resilience Act; the risk assessment decides which product requirements of Annex I Part I(2) apply to appliance, app and cloud (Art. 13(3)); vulnerability handling under Part II always applies.
Conformity assessment under module A
Module A is internal control without a notified body: the manufacturer checks whether the appliance and its vulnerability handling meet the requirements (Annex VIII Part I EU CRA).
Art. 32(1)(a) EU CRA
Technical documentation per model
Risk assessment, a description of the security functions, the software bill of materials and the support period with its rationale go into the technical documentation. It stays available for ten years or for the support period, whichever is longer.
Art. 31, Art. 13(13), Annex VII EU CRA
One EU declaration of conformity and CE marking
Where several EU acts require a declaration of conformity for the appliance, the Radio Equipment Directive for example, the manufacturer must issue a single declaration covering all of them, the Cyber Resilience Act included. A copy or the simplified declaration comes with the appliance, which carries the CE marking.
Art. 13(20), Art. 28(3) and Art. 30 EU CRA
Exceptions
When does an appliance or part of it become class I?
The class follows the product's core functionality (Art. 7(1) EU CRA), and Implementing Regulation (EU) 2025/2392 holds the technical descriptions. For the appliance itself, mainly two categories come into question, items 16 and 17, and each applies only where it describes the core functionality. Parts sold as products of their own come on top.
Integration does not change the class
A voice assistant inside an oven does not make the oven a class I product. Art. 7(1), second sentence, of the Cyber Resilience Act rules that out for integrated products. The EU Commission guidance shows the logic with a smartphone and its operating system (section 6.1, example 58).
Art. 7(1) EU CRA
Assistant or security hub as a product of its own
A smart speaker sold mainly as an assistant that controls devices in the home is a general-purpose virtual assistant under Annex III class I item 16. A hub that centrally controls security products such as cameras or alarm systems falls under item 17. Self-assessment is then only open with a fully applied harmonised standard, common specification or certification at assurance level 'substantial' or higher; otherwise a notified body assesses it.
Annex III class I items 16 and 17, Art. 32(2) EU CRA
Radio module from the supplier
A Wi-Fi or radio module that its supplier places on the market as a product of its own is a physical network interface under Annex III class I item 10. That concerns the module maker. For the appliance it sits in, the first point above applies.
Annex III class I item 10 EU CRA
Keep marketing, manual and documentation consistent
Marketing, the user manual and the technical documentation have to describe the core functionality consistently (EU Commission guidance, section 6.1). An appliance advertised as a home security hub can shift its classification.
Art. 7(1) EU CRA
Obligations
What does a manufacturer of appliances with an app have to do?
App and cloud that the appliance needs for a function and that are developed for the manufacturer are part of its product, and it carries full responsibility for them. For bought-in components such as the radio module, the due diligence duty of Art. 13(5) EU CRA applies. For a typical appliance that means:
- 01
Risk assessment before launch
Art. 13(2) and (3) EU CRA
The cybersecurity risks are assessed and documented: pairing with the app, remote start, cloud account, service engineer access, the update path. The assessment shows which Annex I requirements apply and how they are met.
- 02
Secure out of the box
Annex I Part I(2)(b) and (d) EU CRA
Annex I requires a secure default configuration and protection from unauthorised access, implemented for example through confirmed pairing with the app and remote start of an oven only after authentication. The device reports possible unauthorised access.
- 03
Security updates, automatic where possible
Annex I Part I(2)(c) EU CRA
Vulnerabilities in firmware, app and cloud are fixed through security updates. Where it suits the appliance, they install automatically by default, with a notice to the user and a way to opt out.
- 04
Data wiped before resale
Annex I Part I(2)(m) EU CRA
Users can delete all data and settings permanently, securely and easily, such as Wi-Fi credentials, account links or a robot vacuum's room map.
- 05
End of support shown at purchase
Art. 13(8) and (19) EU CRA
The support period follows the expected use time, weighed with the other factors in Art. 13(8); five years is the floor. At purchase, its end date appears with month and year on the appliance, its packaging or by digital means.
- 06
Reporting exploited vulnerabilities and severe incidents
Art. 14(1) to (4) and (8) EU CRA
An actively exploited vulnerability requires an early warning within 24 hours and a notification within 72 hours to the coordinating CSIRT and ENISA; severe incidents follow the same deadlines. The obligation has applied since 11 September 2026, including for appliances already in people's homes. Affected users then hear what they can do themselves.
Related regulation
Which other EU rules apply to connected appliances alongside the Cyber Resilience Act?
Radio Equipment Directive 2014/53/EU and Delegated Regulation (EU) 2022/30
Delegated Regulation (EU) 2022/30 applies Art. 3(3)(d), (e) and (f) of the Radio Equipment Directive (network harm, privacy, fraud) to certain radio equipment. Recital 30 EU CRA states that the essential requirements of the Cyber Resilience Act include every element of those three, and manufacturers subject to both acts are due Commission guidance during the transition.
General Data Protection Regulation (EU) 2016/679
Usage data, account data and camera images from the home are personal data. The GDPR continues to apply in full (recital 32 EU CRA); Annex I Part I(2)(e) and (g) EU CRA add confidentiality and data minimisation as product requirements.
In practice
Where appliance manufacturers typically get stuck
One radio module in many models
The same Wi-Fi module and software stack sit in washing machines, dryers and dishwashers across several model years. One flaw in it reaches half the range, and both report and fix depend on knowing which version runs in which appliance.
Support period shorter than the appliance
A washing machine runs for ten years or more. Under the EU Commission guidance (section 5), five years is a floor, not a default: a product used for longer needs longer support (Art. 13(8) EU CRA).
App and cloud from different hands
The manufacturer builds the appliance, an agency the app, a platform provider runs the cloud. For app and cloud made on its behalf, the manufacturer is responsible itself. For bought-in parts such as the radio module and SDK, it needs SBOMs and vulnerability notices from its suppliers to meet the due diligence duty of Art. 13(5) EU CRA.
Retailer own brands
Whoever sells a contract manufacturer's appliance under its own name is the manufacturer under Art. 3(13) EU CRA, and needs technical documentation, SBOM and updates secured by contract.
With Kunnus
How Kunnus supports appliance manufacturers
Kunnus covers the Cyber Resilience Act layer: classification, SBOMs, vulnerabilities and reports per model and model year. Electrical safety, EMC, radio and ecodesign stay in your existing CE process.
Worked example
Example: a washing machine platform with an app
A manufacturer builds three washing machine models on one platform with a Wi-Fi module, an app for remote start and consumption data, a cloud account and optional voice control through a built-in assistant.
- 1Classdefault (see above)
- 2Proceduremodule A, internal control; no notified body
- 3The product coverswashing machine, firmware, app, plus the cloud account for remote start (remote data processing)
- 4Support period10 years based on expected use, end date stated at purchase with month and year
- 5Shared componentWi-Fi module in all three models; a flaw in it affects the whole platform
- 6At the endrisk assessment, technical documentation, SBOM per firmware version, EU declaration of conformity, CE marking, reporting process
Illustrative assumptions. The classification of a specific product depends on its intended purpose and design.
Sectors and legal text
Which sectors does this product belong to, and where is it in the regulation?
Frequently asked questions
Are app and cloud part of the appliance?+
An app needed for a function of the appliance is part of the product, even from an app store; the EU Commission guidance shows this with a wearable and its companion app (section 2.4, example 9). The cloud counts as remote data processing if the appliance cannot perform a function without it; telemetry alone does not (section 8.1).
Is a Bluetooth-only appliance in scope of the Cyber Resilience Act?+
An appliance with Bluetooth is in scope of the Cyber Resilience Act even without Wi-Fi or internet access. Art. 2(1) covers any direct or indirect data connection to a device or network, the link to a smartphone included. The class stays the same.
What about the service port and updates by the service engineer?+
A service port is a physical connection under Art. 3(9) of the Cyber Resilience Act and belongs in the risk assessment, for instance on who can load firmware through it. A security update installed by the service engineer is in principle not a substantial modification under the EU Commission guidance (section 4.3).
What happens when the manufacturer switches off the cloud?+
During the support period, the product and the cloud it needs for its functions have to meet the Annex I requirements of the Cyber Resilience Act. The regulation sets no obligation to keep the cloud running after support ends. Where technically feasible, the manufacturer notifies users that support has ended (Art. 13(19)).
What applies to spare parts such as a new Wi-Fi module?+
A spare part built to the same specifications as the original is outside the Cyber Resilience Act under Art. 2(6). According to the EU Commission guidance (section 4.1), the repair purpose has to be evident from the supply, for example through the after-sales channel. A module with different security functions is not an identical spare part.
What applies to manufacturers based in Switzerland?+
The Cyber Resilience Act does not apply in Switzerland. A Swiss manufacturer that supplies appliances to the EU has the same manufacturer obligations as an EU manufacturer. It may appoint an EU authorised representative but does not have to (Art. 18). Whoever imports the product into the EU carries the importer obligations of Art. 19 either way.
Does the Cyber Resilience Act apply to medical devices and vehicles?+
No. Medical devices and in-vitro diagnostics under Regulations (EU) 2017/745 and 2017/746, and vehicles under Regulation (EU) 2019/2144, are excluded by Art. 2(2) of the Cyber Resilience Act. A bathroom scale with an app that is not a medical device is in scope, though.
Is your appliance ready for the Cyber Resilience Act?
The EU CRA assessment classifies your appliance in a few minutes and shows what is still missing, as a first, non-binding estimate.
Further reading
Other products
More products under the EU CRA
Source: Regulation (EU) 2024/2847 (Cyber Resilience Act), Official Journal of the EU. https://eur-lex.europa.eu/eli/reg/2024/2847/oj
This page is an orientation on the Cyber Resilience Act for this kind of product, not legal advice. Whether and how the regulation applies to a specific product depends on its intended purpose and design.