EU CRA for heat pumps and heating controllers
Your heat pump is default class. Its support period follows the life of the unit.
A heat pump or heating controller with an app, remote service or a network port falls under the Cyber Resilience Act. It usually needs no notified body, but it does need a long support period.
Last reviewed:
- Applies in full
- 11 December 2027
- Early warning
- 24 hours · Art. 14(2)(a)
- Support period
- at least 5 years · Art. 13(8)
- Most common class here
- Default product
Does the Cyber Resilience Act apply to heat pumps?
Yes, once the heat pump or its controller runs software and connects to a device or network, through an app, remote service or Modbus (Art. 2(1) of the Cyber Resilience Act). Heat pumps and heating controllers are not listed in Annex III or IV, so they are default class. The manufacturer self-assesses under module A, without a notified body.
Product classes
When is a heat pump in scope of the EU CRA?
Three questions decide. Does the device have a data connection, direct or indirect, including Modbus, BACnet, KNX, a service port or the installer's laptop? Is it placed on the EU market? Do none of the Art. 2 exclusions apply? Then the heat pump is in scope. The app belongs to the product as software. The manufacturer's cloud belongs to it if the device needs that cloud for a function, such as remote service (remote data processing, Art. 3(2)).
Spread in this sector
Pick a product
Air-to-water or ground-source heat pump with controller, app and remote service
Why this class
No category in Annex III or IV; self-assessment under module A, Art. 32(1) EU CRA.
Conformity route
- 1Risk assessment
- 2Self-assessment (module A)
- EU declaration of conformity + CE
Self-assessment by the manufacturer, Art. 32(1) EU CRA.
An assessment based on typical core functions. Your product's intended purpose and design decide.
All product examples as a table+
| Product | EU CRA class | Why |
|---|---|---|
| Air-to-water or ground-source heat pump with controller, app and remote service | Default product | No category in Annex III or IV; self-assessment under module A, Art. 32(1) EU CRA. |
| Controller for a gas, oil or pellet boiler with an internet module | Default product | Its core functionality is controlling heat, not a security function listed in Annex III. |
| Ventilation or air-conditioning controller with Modbus, BACnet or KNX | Default product | The fieldbus link brings the device into scope but does not change its class. |
| Room thermostat or room control unit as part of the heating system | Default product | A comfort and control function; Annex III has no category for it. |
| Control input for grid operators and energy management (SG Ready, EEBus) | Default product | The control input is part of the heat pump. Control box and smart meter gateway are separate devices of the metering operator; the gateway is critical (Annex IV item 2). |
| Internet gateway sold separately whose core function is routing | Important product, class I (Annex III) | Router under Annex III class I item 12 EU CRA. |
| Network or fieldbus adapter sold separately that works purely as a network interface | Important product, class I (Annex III) | Physical network interface under Annex III class I item 10; Implementing Regulation (EU) 2025/2392 names Ethernet, Wi-Fi and fieldbus adapters. Modules with their own logic and cloud link are default class in our assessment. |
Your product isn't listed? The maturity assessment gives a first classification for your own product. Start the EU CRA assessment →
Heat pumps and controllers with no data connection at all are outside the Cyber Resilience Act. Placing on the market counts per unit: units of a series first supplied to distributors or customers from 11 December 2027 must comply. Units placed on the market before that date only become subject to the requirements after a substantial modification (Art. 69(2)). Art. 14 covers them as well (Art. 69(3)).
Default class
What does the default class mean for a heat pump manufacturer?
Default class means the manufacturer may assess conformity itself. The class does not reduce the Annex I requirements of the Cyber Resilience Act; the risk assessment decides which product requirements of Annex I Part I(2) apply to device, app and cloud (Art. 13(3)); vulnerability handling under Part II always applies.
Conformity assessment under module A
Module A is internal control without a notified body: the manufacturer checks whether the device and its vulnerability handling meet the requirements (Annex VIII Part I EU CRA).
Art. 32(1)(a) EU CRA
Technical documentation per product line
Risk assessment, a description of the security functions, the software bill of materials and the support period with its rationale go into the technical documentation. It stays available for ten years or for the support period, whichever is longer.
Art. 31, Art. 13(13), Annex VII EU CRA
One EU declaration of conformity and CE marking
Where several EU acts require a declaration of conformity for the heat pump, the manufacturer must issue a single declaration covering all of them, the Cyber Resilience Act included. A copy or the simplified declaration comes with the unit, which carries the CE marking.
Art. 13(20), Art. 28(3) and Art. 30 EU CRA
Exceptions
When does part of a heating system become class I or critical?
The class follows the product's core functionality (Art. 7(1) EU CRA), and Implementing Regulation (EU) 2025/2392 holds the technical descriptions. In heating technology that only concerns network components sold as products in their own right, and the smart meter gateway.
Integration does not change the class
A built-in Wi-Fi module or a microcontroller with security functions does not make the heat pump an important product. Art. 7(1), second sentence, of the Cyber Resilience Act states that integration alone does not trigger a stricter procedure.
Art. 7(1) EU CRA
Internet gateway sold on its own
If the manufacturer sells a gateway separately whose core function is routing between home network and internet, it is a class I product under Annex III item 12, or item 5 as a VPN product for remote service. Self-assessment is then only open with a fully applied harmonised standard, common specification or certification at assurance level 'substantial' or higher; otherwise a notified body assesses it.
Annex III class I items 5 and 12, Art. 32(2) EU CRA
Retrofit interface module
An Ethernet, Wi-Fi or fieldbus module sold as a product for retrofitting is only class I under Annex III item 10 if it works purely as a network interface, through a driver API at the data link layer. Modules with their own logic and cloud link are default class in our assessment. A spare part built to the same specifications as the original is outside the regulation under Art. 2(6).
Annex III class I item 10, Art. 2(6) EU CRA
Smart meter gateway
The smart meter gateway in a smart metering system is a critical product under Annex IV item 2 of the Cyber Resilience Act. It is a separate device run by the metering operator; the heat pump connected to it through a control input stays default class.
Annex IV item 2 EU CRA
Obligations
What does a heat pump manufacturer have to do?
The manufacturer is responsible for the whole product, app and cloud included. For bought-in controllers, radio modules and software libraries, the due diligence duty of Art. 13(5) EU CRA applies on top. For a typical heat pump that means:
- 01
Risk assessment before series release
Art. 13(2) and (3) EU CRA
The cybersecurity risks are assessed and documented: app access, installer remote service, the grid operator's control input, the service port, the update path. The assessment shows which Annex I requirements apply and how they are met.
- 02
Protected access for installers and remote service
Annex I Part I(2)(b) and (d) EU CRA
Annex I requires a secure default configuration and protection from unauthorised access, implemented for example through individual credentials per unit and remote service that the owner approves. The device reports possible unauthorised access.
- 03
Security updates during the support period
Annex I Part I(2)(c), Part II EU CRA
Vulnerabilities in controller firmware, app and cloud are fixed through security updates, automatically where that makes sense. A software bill of materials of the components is the basis.
- 04
Support period that matches the service life
Art. 13(8) and (19) EU CRA
The support period follows the expected use time, weighed with the other factors in Art. 13(8); five years is the floor. For a unit that runs 15 to 20 years, it lies well above that. The end date is stated at purchase with month and year.
- 05
Reporting exploited vulnerabilities and severe incidents
Art. 14(1) to (4) EU CRA
An actively exploited vulnerability requires an early warning within 24 hours and a notification within 72 hours to the coordinating CSIRT and ENISA; severe incidents follow the same deadlines. The obligation has applied since 11 September 2026, including for units already running in basements and plant rooms.
Related regulation
Which other rules apply to heat pumps alongside the Cyber Resilience Act?
Radio Equipment Directive 2014/53/EU and Delegated Regulation (EU) 2022/30
If the heat pump has a Wi-Fi or radio module, Delegated Regulation (EU) 2022/30 can apply Art. 3(3)(d), (e) and (f) of the Radio Equipment Directive. Recital 30 EU CRA states that the essential requirements of the Cyber Resilience Act include every element of those three.
General Data Protection Regulation (EU) 2016/679
Consumption and presence data from app and cloud are often personal data. The GDPR continues to apply in full (recital 32 EU CRA); Annex I Part I(2)(e) and (g) EU CRA add confidentiality and data minimisation as product requirements.
In practice
Where heat pump manufacturers typically get stuck
Support period shorter than the unit
A heat pump runs for 15 to 20 years, while its radio module and software stack often get updates for far less. The support period has to match the service life, not the life cycle of the bought-in module.
Remote access for many installers
Hundreds of installation firms reach units through a portal. Who may see and control which unit, and how access ends when a firm changes, belongs in the risk assessment.
Controller, module and cloud from different hands
The controller comes from an OEM supplier, the internet module from another, the app from an agency. To meet the due diligence duty of Art. 13(5) EU CRA, the manufacturer in practice needs SBOMs and vulnerability notices from its suppliers.
Control by third parties
Grid operators and energy management systems switch the heat pump through SG Ready contacts or EEBus. The risk assessment has to show what happens when control signals are tampered with or stop arriving (Annex I Part I(2)(f) and (h) EU CRA).
With Kunnus
How Kunnus supports heat pump manufacturers
Kunnus covers the Cyber Resilience Act layer: classification, SBOMs, vulnerabilities and reports per product line and firmware version. Electrical safety, EMC, radio and energy efficiency stay in your existing CE process.
Worked example
Example: a line of air-to-water heat pumps
A manufacturer sells air-to-water heat pumps in four capacities with its own controller, a built-in Wi-Fi module, an app for owners, a portal for installers and an SG Ready input.
- 1Classdefault (see above)
- 2Proceduremodule A, internal control; no notified body
- 3The product coversheat pump, controller firmware, app, plus installer portal and cloud (remote data processing)
- 4Support period18 years based on expected use, end date stated at purchase with month and year
- 5From the module supplierSBOM, vulnerability notices, a support commitment covering the manufacturer's support period
- 6At the endrisk assessment, technical documentation, SBOM per firmware version, EU declaration of conformity, CE marking, reporting process
Illustrative assumptions. The classification of a specific product depends on its intended purpose and design.
Sectors and legal text
Which sectors does this product belong to, and where is it in the regulation?
Frequently asked questions
Is a heat pump with Modbus but no internet in scope of the Cyber Resilience Act?+
A heat pump with a Modbus, BACnet or KNX port is in scope of the Cyber Resilience Act even without internet access. Art. 2(1) covers any direct or indirect data connection to a device or network. The port does not change the class.
Are app and cloud part of the heat pump?+
An app needed for a function of the heat pump is part of the product, even from an app store (EU Commission guidance, section 2.4, example 9). The cloud is remote data processing under Art. 3(2) of the Cyber Resilience Act if the device cannot perform a function without it; telemetry alone does not qualify (section 8.1).
Is a firmware update by the installer a substantial modification?+
A substantial modification affects compliance with the Annex I Part I requirements or changes the intended purpose (Art. 3(30) of the Cyber Resilience Act). Under the EU Commission guidance (section 4.3), security updates are in principle not substantial, whether they install automatically or through the installer.
How long does a heat pump manufacturer have to provide security updates?+
The support period follows the expected use time (Art. 13(8) of the Cyber Resilience Act); five years is the floor. With 15 to 20 years of use, a short period is hard to justify (EU Commission guidance, section 5). Each security update stays available for ten years or the rest of the support period, whichever is longer (Art. 13(9)).
What applies to replacement controllers for older systems?+
A replacement controller built to the same specifications as the original is outside the Cyber Resilience Act under Art. 2(6). According to the EU Commission guidance (section 4.1), the repair purpose has to be evident from the supply. A new controller with different security functions is not an identical spare part.
What applies to manufacturers based in Switzerland?+
The Cyber Resilience Act does not apply in Switzerland. A Swiss manufacturer that supplies heat pumps to the EU has the same manufacturer obligations as an EU manufacturer. It may appoint an EU authorised representative but does not have to (Art. 18). Whoever imports the product into the EU carries the importer obligations of Art. 19 either way.
Does the Cyber Resilience Act apply to medical devices and vehicles?+
No. Medical devices and in-vitro diagnostics under Regulations (EU) 2017/745 and 2017/746, and vehicles under Regulation (EU) 2019/2144, are excluded by Art. 2(2) of the Cyber Resilience Act. None of these exclusions applies to heat pumps and heating controllers in buildings.
Is your heat pump ready for the Cyber Resilience Act?
The EU CRA assessment classifies your device in a few minutes and shows what is still missing, as a first, non-binding estimate.
Further reading
Other products
More products under the EU CRA
Source: Regulation (EU) 2024/2847 (Cyber Resilience Act), Official Journal of the EU. https://eur-lex.europa.eu/eli/reg/2024/2847/oj
This page is an orientation on the Cyber Resilience Act for this kind of product, not legal advice. Whether and how the regulation applies to a specific product depends on its intended purpose and design.