EU CRA for wallboxes and charging stations
Your wallbox is default class. App, back end and updates still count.
A wallbox or charging station with an app, an OCPP connection or RFID authorisation falls under the Cyber Resilience Act. It does not need a notified body, because charge points are listed in neither Annex III nor Annex IV.
Last reviewed:
- Applies in full
- 11 December 2027
- Early warning
- 24 hours · Art. 14(2)(a)
- Support period
- at least 5 years · Art. 13(8)
- Most common class here
- Default product
Does the Cyber Resilience Act apply to wallboxes?
Yes, once the charger can connect to an app, back end, energy manager or network (Art. 2(1) of the Cyber Resilience Act). Charge points are not listed in Annex III or IV, and Implementing Regulation (EU) 2025/2392 does not mention them. Wallboxes and charging stations are therefore default-class products, self-assessed under module A.
Product classes
When is a charging station in scope of the EU CRA?
Three questions decide. Does the charger have a data connection, direct or indirect, including LAN, Wi-Fi, cellular, Modbus to an energy manager or a service port? Is it placed on the EU market? Do none of the Art. 2 exclusions apply? Then the charger is in scope. The manufacturer's own app is part of the product as software (EU Commission guidance, section 2.4). The manufacturer's OCPP back end is part of it if the wallbox needs it for a function (remote data processing, Art. 3(2)).
Spread in this sector
Pick a product
AC wallbox for homes or company car parks
Why this class
No category in Annex III or IV; self-assessment under Art. 32(1) EU CRA.
Conformity route
- 1Risk assessment
- 2Self-assessment (module A)
- EU declaration of conformity + CE
Self-assessment by the manufacturer, Art. 32(1) EU CRA.
An assessment based on typical core functions. Your product's intended purpose and design decide.
All product examples as a table+
| Product | EU CRA class | Why |
|---|---|---|
| AC wallbox for homes or company car parks | Default product | No category in Annex III or IV; self-assessment under Art. 32(1) EU CRA. |
| DC fast charger for public charging parks | Default product | Core function is charging; no category in Annex III or IV. |
| Wallbox with an RFID reader for charge authorisation | Default product | The reader starts a charging session; the core function stays charging (Art. 7(1) EU CRA). |
| Wallbox with a built-in MID meter | Default product | A billing meter is not a smart meter gateway under Annex IV item 2. |
| Load management controller for several charge points | Default product | Distributes charging power; no security or routing core function, so default class in our assessment. |
| Bought-in payment terminal in a public DC charger | Critical product (Annex IV) | Annex IV item 1; the obligation sits with the terminal maker, see below. |
| Router or VPN gateway for remote access to charging parks, sold separately | Important product, class I (Annex III) | Annex III class I item 12 or item 5 EU CRA. |
| Smart meter gateway in a smart metering system | Critical product (Annex IV) | Annex IV item 2 EU CRA. In Germany a separate device of the metering point operator, not part of the wallbox. |
Your product isn't listed? The maturity assessment gives a first classification for your own product. Start the EU CRA assessment →
Chargers with no data connection at all are outside the Cyber Resilience Act. The vehicle itself is excluded by Art. 2(2); the wallbox is not. Placing on the market counts per unit: units of a series first supplied to distributors or customers from 11 December 2027 on must comply. Units placed on the market earlier only become subject to the requirements after a substantial modification (Art. 69(2)); Art. 14 covers them as well (Art. 69(3)).
Default class
What does the default class mean for a wallbox manufacturer?
Default class means the manufacturer assesses conformity itself. The class does not reduce the Annex I requirements of the Cyber Resilience Act. The risk assessment for charger, app and back end decides which product requirements of Annex I Part I(2) apply (Art. 13(3)); vulnerability handling under Part II always applies.
Conformity assessment under module A
The manufacturer checks whether the charger and its vulnerability handling meet the requirements (internal control, Annex VIII Part I EU CRA). No notified body is required.
Art. 32(1)(a) EU CRA
Technical documentation per device generation
Risk assessment, software bill of materials, a description of app and back end and the reasoned support period go into the technical documentation. It stays available for ten years or for the support period, whichever is longer.
Art. 31, Art. 13(13), Annex VII EU CRA
One EU declaration of conformity and CE marking
Where other acts apply alongside the Cyber Resilience Act, such as the Low Voltage, EMC and Radio Equipment Directives, the manufacturer issues a single EU declaration of conformity covering all of them. A copy or the simplified declaration comes with the device, and the device carries the CE marking.
Art. 13(20), Art. 28(3) and Art. 30 EU CRA
Exceptions
When does part of the charging infrastructure become class I or critical?
The class follows the product's core functionality (Art. 7(1) and Art. 8(1) EU CRA), and Implementing Regulation (EU) 2025/2392 holds the technical descriptions. Charge points do not appear in it, but devices built into them or installed next to them do.
An RFID reader does not change the core function
Annex III class I item 1 names authentication and access control readers as part of identity management systems. An RFID reader in a wallbox only starts a charging session; the core function stays charging. In our assessment the wallbox therefore remains default class.
Annex III class I item 1, Art. 7(1) EU CRA
Payment terminal (critical, at the terminal maker)
The implementing regulation names physical payment terminals that meet its description as an example of Annex IV item 1 (hardware devices with security boxes). A charger maker that buys in a terminal and builds it in checks it under the due diligence duty of Art. 13(5); by its core function the charger stays default class (EU Commission guidance, section 6.2, example 63).
Annex IV item 1 EU CRA, Implementing Regulation (EU) 2025/2392
Router or VPN as a product of its own (class I)
A router sold separately for a charging park is class I under Annex III item 12, a VPN gateway under item 5. For class I, module A remains possible where a harmonised standard, common specification or certification scheme at assurance level 'substantial' or higher is applied in full; otherwise a notified body is involved.
Annex III class I items 5 and 12, Art. 32(2) EU CRA
Smart meter gateway (critical)
A MID meter is not a smart meter gateway; the gateway is a separate device.
Annex IV item 2 EU CRA
Later reclassification: where appropriate with a transition period
The Commission can amend Annex III by delegated act. Where appropriate, such an act provides a transition period of at least twelve months, shorter only on imperative grounds of urgency (Art. 7(3) EU CRA). There is no such category for charge points today.
Art. 7(3) EU CRA
Obligations
What does a wallbox manufacturer have to do?
The manufacturer is whoever places the wallbox on the market under its own name or brand, even when a contract manufacturer builds it (Art. 3(13) EU CRA). For a typical wallbox with app and back end, that means:
- 01
Risk assessment for charger, app and back end
Art. 13(2) and (3) EU CRA
Every control path is assessed: OCPP connection, app, RFID authorisation, interface to the energy manager, installer remote access, update path.
- 02
Secure default configuration and access control
Annex I Part I(2)(b) and (d) EU CRA
The wallbox ships securely configured and is protected against unauthorised access, implemented for instance through individual credentials for the web interface and service level and an authenticated, encrypted back-end connection. The wallbox reports possible unauthorised access.
- 03
Availability and limited impact on other networks
Annex I Part I(2)(h) and (i) EU CRA
Essential functions stay available after a security incident, and the wallbox keeps its impact on services of other devices and networks to a minimum. Where thousands of charge points share one back end, the risk assessment also covers what a simultaneous attack on all of them would mean for the grid.
- 04
Support period that matches the service life
The support period follows the expected use time, weighed with the other factors in Art. 13(8); five years is the floor. For a wallbox that stays in use for ten years or more, the expected use time is what counts, not the floor (EU Commission guidance, section 5).
- 05
Reporting exploited vulnerabilities and severe incidents
Art. 14(1) to (4) EU CRA
An actively exploited vulnerability requires an early warning within 24 hours and a notification within 72 hours to the coordinating CSIRT and ENISA; severe incidents follow the same deadlines. The obligation has applied since 11 September 2026, including for wallboxes already installed.
Related regulation
Which other rules apply to wallboxes alongside the Cyber Resilience Act?
Radio Equipment Directive 2014/53/EU and Delegated Regulation (EU) 2022/30
Delegated Regulation (EU) 2022/30 applies cybersecurity requirements from Art. 3(3)(d), (e) and (f) of the Radio Equipment Directive to certain radio equipment, mainly equipment that connects to the internet; point (f) only concerns equipment that enables money transfers. According to recital 30 of the Cyber Resilience Act, Annex I covers every element of those requirements; existing EU type-examination certificates for them remain valid for a transition period (Art. 69(1)). RED evidence is a starting point; the process obligations of Articles 13 and 14 come on top.
Metrology law
A built-in billing meter follows the Measuring Instruments Directive and national metrology law. Those rules concern measurement accuracy and protection of the metering data against tampering, not the cybersecurity of the wallbox as a whole.
In practice
Where wallbox manufacturers typically get stuck
Back end and firmware built by different teams
The OCPP back end is often built by another department or a service provider. Software the manufacturer develops or commissions belongs to the product if the wallbox needs it for a function; a third party's standard back end is checked like a bought-in component (EU Commission guidance, section 8.1).
Own brand on a contract-manufactured charger
Putting your logo on an wallbox built by a contract manufacturer makes you its manufacturer (Art. 3(13) EU CRA). SBOMs, vulnerability notices and updates have to be agreed with the contract manufacturer in the contract.
Installer service access
Installers configure load management and authorisation through a web interface. One shared service password for every device is a typical finding. In our assessment, a shared password does not meet Annex I Part I(2)(b) and (d); it has to go at the latest for units placed on the market from 11 December 2027. For internet-connected radio equipment, Delegated Regulation (EU) 2022/30 already applies today.
Long service life, short platform support
A wallbox stays on the wall for ten years or more, while its Linux kernel or radio module is often maintained for less. That belongs in the support period decision and in the purchasing terms.
With Kunnus
How Kunnus supports wallbox manufacturers
Kunnus covers the Cyber Resilience Act layer: classification, SBOMs, vulnerabilities and reports per device generation and firmware version. Electrical safety, EMC and metrology stay in your existing testing and approval processes.
Worked example
Example: AC wallbox with app, RFID and OCPP
A manufacturer sells an 11 kW wallbox with Wi-Fi and LAN, RFID authorisation, a MID meter, an app for private customers and its own OCPP back end for company fleets.
- 1Classdefault (see above)
- 2Proceduremodule A, internal control; no notified body
- 3The product coverswallbox, app (software of the product), own OCPP back end (remote data processing)
- 4Not part of the productthe vehicle (excluded) and the metering operator's smart meter gateway
- 5Support periodbased on expected use, end date stated with month and year
- 6At the endrisk assessment, technical documentation, SBOM per firmware version, EU declaration of conformity, CE marking, reporting process
Illustrative assumptions. The classification of a specific product depends on its intended purpose and design.
Sectors and legal text
Which sectors does this product belong to, and where is it in the regulation?
Frequently asked questions
Is the OCPP back end part of the wallbox?+
A back end the manufacturer develops for its wallbox that supports a function, such as authorisation, billing, configuration or update rollout, is remote data processing and part of the product (Art. 3(2) of the Cyber Resilience Act; EU Commission guidance, section 8.1). A back end that a charging park operator buys from a third party is not part of the wallbox maker's product.
What applies to a wallbox with Wi-Fi, Bluetooth or LTE?+
The radio module brings the wallbox into scope of the Cyber Resilience Act. As radio equipment, the wallbox is also subject to the requirements under Delegated Regulation (EU) 2022/30; Annex I covers every element of them (recital 30).
Is a wallbox with no app, only Modbus to an energy manager, covered by the Cyber Resilience Act?+
A Modbus link to an energy manager is a data connection to another device, which is enough for scope (Art. 2(1) of the Cyber Resilience Act); internet access is not required. The wallbox stays default class.
Is a remote firmware update a substantial modification?+
A modification is substantial if it affects compliance with the Annex I Part I requirements or changes the intended purpose (Art. 3(30) of the Cyber Resilience Act). Under the EU Commission guidance (section 4.3), security updates generally are not. An update that creates new, unassessed risks, such as bidirectional charging with grid control, can be.
Does the Cyber Resilience Act apply to manufacturers based in Switzerland?+
The Cyber Resilience Act does not apply to wallboxes sold only in Switzerland. A Swiss manufacturer that sells wallboxes in the EU has the same obligations as an EU manufacturer. It may appoint an EU authorised representative but does not have to (Art. 18). Whoever imports the product into the EU carries the importer obligations of Art. 19 either way.
Does the Cyber Resilience Act apply to medical devices and vehicles?+
Medical devices and in-vitro diagnostics (Regulations (EU) 2017/745 and 2017/746) and type-approved vehicles (Regulation (EU) 2019/2144) are excluded by Art. 2(2) of the Cyber Resilience Act. The electric car is therefore out of scope, the wallbox is not. An on-board charger intended exclusively for installation in the vehicle can fall under the vehicle exclusion, according to the EU Commission guidance (section 9.3).
Is your wallbox ready for the Cyber Resilience Act?
The EU CRA assessment classifies your charging stations in a few minutes and shows what is still missing, as a first, non-binding estimate.
Further reading
Other products
More products under the EU CRA
Source: Regulation (EU) 2024/2847 (Cyber Resilience Act), Official Journal of the EU. https://eur-lex.europa.eu/eli/reg/2024/2847/oj
This page is an orientation on the Cyber Resilience Act for this kind of product, not legal advice. Whether and how the regulation applies to a specific product depends on its intended purpose and design.