EU CRA for smart home devices
Thermostat, bulb, actuator: default class. Class I is mainly security devices and voice assistants.
Most connected devices in the home fall under the Cyber Resilience Act but do not need a notified body. The stricter route applies to locks, cameras, baby monitors, alarm systems and voice assistants.
Last reviewed:
- Applies in full
- 11 December 2027
- Early warning
- 24 hours · Art. 14(2)(a)
- Support period
- at least 5 years · Art. 13(8)
- Most common class here
- Default product
Does the Cyber Resilience Act apply to smart home devices?
Yes, once the device connects to an app, hub, Wi-Fi or bus (Art. 2(1) of the Cyber Resilience Act). Thermostats, bulbs, smart plugs and KNX actuators are not listed in Annex III or IV, so they are default-class products, self-assessed under module A. Class I mainly covers remotely controllable security devices, voice assistants and routers.
Product classes
When is a smart home device in scope of the EU CRA?
Three questions decide. Does the device have a data connection, direct or indirect, including Zigbee, Thread, KNX or Bluetooth to an app? Is it placed on the EU market? Do none of the Art. 2 exclusions apply? Then the device is in scope. The manufacturer's own app is part of the product as software (EU Commission guidance, section 2.4). The manufacturer's cloud is part of it if the device needs it for a function (remote data processing, Art. 3(2)); the guidance works through this with a smart thermostat (section 8.3).
Spread in this sector
Pick a product
Radiator or room thermostat with app
Why this class
A comfort function with no security functionality; no category in Annex III or IV, self-assessment under Art. 32(1) EU CRA.
Conformity route
- 1Risk assessment
- 2Self-assessment (module A)
- EU declaration of conformity + CE
Self-assessment by the manufacturer, Art. 32(1) EU CRA.
An assessment based on typical core functions. Your product's intended purpose and design decide.
All product examples as a table+
| Product | EU CRA class | Why |
|---|---|---|
| Radiator or room thermostat with app | Default product | A comfort function with no security functionality; no category in Annex III or IV, self-assessment under Art. 32(1) EU CRA. |
| Smart bulb, lamp or lighting control | Default product | No category in Annex III or IV. |
| Smart plug or in-wall switch actuator | Default product | Switching and metering do not protect physical security in the sense of Annex III class I item 17. |
| KNX actuator, push-button sensor or blind control | Default product | Building system technology without a security function; the bus brings the device into scope, not into a higher class. |
| Hub for lighting, heating and shading | Default product | Controls no security devices, so item 17 does not apply. If the hub mainly works as a Thread border router or IP gateway, check Annex III class I item 12. |
| Door lock, security camera, baby monitor or alarm system | Important product, class I (Annex III) | Annex III class I item 17, including a hub that controls such devices (Implementing Regulation (EU) 2025/2392). |
| Smart speaker with a general-purpose voice assistant | Important product, class I (Annex III) | Annex III class I item 16: communicates over the internet, processes natural-language requests and provides access to services or controls connected devices in the home. |
| Wi-Fi router or mesh system for the internet connection | Important product, class I (Annex III) | Annex III class I item 12; network equipment rather than a smart home end device. |
Your product isn't listed? The maturity assessment gives a first classification for your own product. Start the EU CRA assessment →
Devices with no data connection at all, such as a classic dial thermostat, are outside the Cyber Resilience Act. Placing on the market counts per unit: units of a series first supplied to distributors or customers from 11 December 2027 on must comply. Units placed on the market earlier only become subject to the requirements after a substantial modification (Art. 69(2)); Art. 14 covers them as well (Art. 69(3)).
Default class
What does the default class mean for a smart home manufacturer?
Default class means the manufacturer assesses conformity itself. The class does not reduce the Annex I requirements of the Cyber Resilience Act. The risk assessment for device, app and cloud decides which product requirements of Annex I Part I(2) apply (Art. 13(3)); vulnerability handling under Part II always applies.
Conformity assessment under module A
The manufacturer checks whether the device and its vulnerability handling meet the requirements (internal control, Annex VIII Part I EU CRA). No notified body is needed, so there is no test slot to book before launch.
Art. 32(1)(a) EU CRA
Technical documentation per device generation
Risk assessment, software bill of materials, a description of app and cloud and the reasoned support period go into the technical documentation. It stays available for ten years or for the support period, whichever is longer.
Art. 31, Art. 13(13), Annex VII EU CRA
End of support on the device, box or product page
At purchase, the end of the support period is shown with at least month and year, on the product, its packaging or by digital means.
Art. 13(19) EU CRA
One EU declaration of conformity and CE marking
Where several acts apply, such as the Radio Equipment Directive as well, the manufacturer issues a single EU declaration of conformity covering all of them. A copy or the simplified declaration comes with the device, and the device carries the CE marking.
Art. 13(20), Art. 28(3) and Art. 30 EU CRA
Exceptions
When does a smart home device become class I?
The class follows the device's core functionality (Art. 7(1) EU CRA). In the smart home, mainly the following Annex III categories come into play, plus radio and network adapters sold separately, such as a Zigbee USB stick (item 10). The technical descriptions are in Implementing Regulation (EU) 2025/2392.
Protecting physical security at home (item 17)
Item 17 covers devices that protect the physical security of consumers in a residential setting and can be controlled or managed remotely from other systems: door locks, security cameras, baby monitors, alarm systems. The list is open. Hardware and software that centrally control such devices, such as an alarm hub, are covered too.
Annex III class I item 17 EU CRA, Implementing Regulation (EU) 2025/2392
General-purpose voice assistant (item 16)
A speaker or display that processes natural-language requests, spoken or typed, communicates over the internet and provides access to services or controls devices in the home is class I. A thermostat with simple voice control stays default class, because its core function is heating.
Annex III class I item 16, Art. 7(1) EU CRA
Routers and mesh systems (item 12)
A Wi-Fi router or mesh system for the internet connection is class I. Self-assessment under module A remains possible here too where the manufacturer fully applies a harmonised standard, a common specification or a certification scheme at assurance level 'substantial' or higher; otherwise a notified body is involved.
Annex III class I item 12, Art. 32(2) EU CRA
Integration does not change the class
A radio module or a microcontroller with security functions inside the thermostat does not make the thermostat an important product. Art. 7(1), second sentence, of the Cyber Resilience Act states that integration alone does not trigger a stricter procedure.
Art. 7(1) EU CRA
Obligations
What does a smart home device manufacturer have to do?
The manufacturer is whoever places the device on the market under its own name or brand, even if a contract manufacturer builds it (Art. 3(13) EU CRA). For a typical device with an app, that means:
- 01
Risk assessment for device, app and cloud
Art. 13(2) and (3) EU CRA
The whole product is assessed: radio link, pairing with the app, cloud account, update path. The assessment shows which Annex I requirements apply and how they are met.
- 02
Secure default configuration and access control
Annex I Part I(2)(b) and (d) EU CRA
The device ships securely configured, can be reset to its original state and is protected against unauthorised access, implemented for instance through individual credentials instead of a shared default password and pairing only after confirmation. The device reports possible unauthorised access.
- 03
Automatic security updates
Annex I Part I(2)(c) EU CRA
Where appropriate, security updates install automatically by default. Users are told, can postpone them and have a clear way to opt out.
- 04
Wiping data when the owner changes
Annex I Part I(2)(m) EU CRA
Users can delete all data and settings permanently, securely and easily, such as schedules, presence data and the link to the cloud account.
- 05
Reporting exploited vulnerabilities and severe incidents
Art. 14(1) to (4) and (8) EU CRA
An actively exploited vulnerability requires an early warning within 24 hours and a notification within 72 hours to the coordinating CSIRT and ENISA; severe incidents follow the same deadlines. The obligation has applied since 11 September 2026, including for devices already installed in homes. Users then learn what they can do themselves.
Related regulation
Which other rules apply to smart home devices alongside the Cyber Resilience Act?
Radio Equipment Directive 2014/53/EU and Delegated Regulation (EU) 2022/30
Delegated Regulation (EU) 2022/30 applies cybersecurity requirements from Art. 3(3)(d), (e) and (f) of the Radio Equipment Directive to certain radio equipment, mainly equipment that connects to the internet. According to recital 30 of the Cyber Resilience Act, Annex I covers every element of those requirements. RED evidence is a basis for the Cyber Resilience Act assessment, not a replacement for it.
General Data Protection Regulation (EU) 2016/679
The GDPR continues to apply in full (recital 32 EU CRA). Confidentiality and data minimisation are also product requirements under Annex I Part I(2)(e) and (g), for example for presence data from thermostats.
In practice
Where smart home manufacturers typically get stuck
Radio module and SDK from the chip vendor
The Zigbee, Thread or Wi-Fi stack comes ready-made from the chip vendor. One SDK flaw reaches many device lines, and the manufacturer needs an SBOM and vulnerability notices from the supplier to handle it.
App from an agency, cloud from a platform provider
A cloud the manufacturer has built for its device belongs to the product if the device needs it for a function. A third party's standard service is not remote data processing under the EU Commission guidance (section 8.1), but it is checked like a bought-in component.
Own brand on a contract-manufactured device
Selling a finished device under your own logo makes you the manufacturer with every obligation (Art. 3(13) EU CRA). The documents for that have to come from the contract manufacturer and be agreed in the contract.
End of support for a low-cost line
A 15-euro smart plug can stay in the socket for ten years. The support period follows the expected use time, weighed with the other factors in Art. 13(8) EU CRA; five years is the floor (EU Commission guidance, section 5).
With Kunnus
How Kunnus supports smart home manufacturers
Kunnus covers the Cyber Resilience Act layer: classification, SBOMs, vulnerabilities and reports per device line and generation. Radio, EMC and safety testing stay in your existing CE process.
Worked example
Example: a radiator thermostat with app and cloud
A manufacturer sells a radiator thermostat with Zigbee radio, a hub for lighting and heating, its own app and a cloud for schedules and remote access.
- 1Classdefault for thermostat and hub (see above)
- 2Proceduremodule A, internal control; no notified body
- 3The product coversthermostat, hub, app (software of the product), own cloud (remote data processing)
- 4Support periodbased on expected use, at least five years; end date with month and year on the box
- 5From the chip vendorSBOM and vulnerability notices for radio stack and SDK
- 6At the endrisk assessment, technical documentation, SBOM per firmware version, EU declaration of conformity, CE marking, reporting process
Illustrative assumptions. If the hub later integrates a door lock or alarm system, the classification needs a fresh look.
Sectors and legal text
Which sectors does this product belong to, and where is it in the regulation?
Frequently asked questions
Is the app part of the smart home device?+
An app the manufacturer provides for its device is part of the product as software; the EU Commission guidance treats a fitness wearable with its companion app as one product (section 2.4, example 9). The thermostat stays default class, and the app is assessed and documented with it. A cloud only counts if the device needs it for a function.
Do Zigbee, Thread or Matter change the class?+
The radio protocol decides whether a device falls under the Cyber Resilience Act, not its class. A Zigbee thermostat and a Matter smart plug stay default class. A radio module sold as a product of its own can be a network interface under Annex III class I item 10; that concerns the module maker.
Are KNX devices without internet access covered by the Cyber Resilience Act?+
A KNX actuator is covered by the Cyber Resilience Act, because the bus is a data connection to other devices (Art. 2(1)); internet access is not required. The actuator stays default class. Whether a KNX IP router with routing as its core function falls under Annex III class I item 12 needs to be checked case by case.
Are smart smoke detectors or video doorbells class I?+
Annex III class I item 17 of the Cyber Resilience Act names locks, cameras, baby monitors and alarm systems only as examples. In our assessment a video doorbell is a security camera, so class I. Whether fire safety counts as 'physical security' for a connected smoke detector is open; as part of an alarm system, item 17 is more likely. Document the reasoning.
May the installer access the device remotely?+
Remote access for an installer or service team is allowed, but it has to be in the risk assessment and protected against unauthorised access (Annex I Part I(2)(d) EU CRA), implemented for instance through authentication, approval by the user and logging. A service login with one fixed password for every device does not meet that.
Does the Cyber Resilience Act apply to devices sold only in Switzerland?+
The Cyber Resilience Act does not apply to devices sold only in Switzerland. A Swiss manufacturer that supplies the EU has the same obligations as an EU manufacturer. It may appoint an EU authorised representative but does not have to (Art. 18). Whoever imports the product into the EU carries the importer obligations of Art. 19 either way.
Does the Cyber Resilience Act apply to medical devices and vehicles?+
No. Medical devices and in-vitro diagnostics (Regulations (EU) 2017/745 and 2017/746) and type-approved vehicles (Regulation (EU) 2019/2144) are excluded by Art. 2(2) of the Cyber Resilience Act. A connected emergency button for the home is in scope, though, unless it is placed on the market as a medical device.
Which class do your smart home devices fall into?
The EU CRA assessment classifies your devices in a few minutes and shows what is still missing, as a first, non-binding estimate.
Further reading
Other products
More products under the EU CRA
Source: Regulation (EU) 2024/2847 (Cyber Resilience Act), Official Journal of the EU. https://eur-lex.europa.eu/eli/reg/2024/2847/oj
This page is an orientation on the Cyber Resilience Act for this kind of product, not legal advice. Whether and how the regulation applies to a specific product depends on its intended purpose and design.