Smart home and IoT devices under the CRA

Which devices are important

Smart home products with security functionalities – such as door locks, security cameras, baby monitors and alarm systems – and smart home general-purpose virtual assistants are important products of class I. The same applies to connected toys with social interaction or location tracking and to wearables for health monitoring or intended for children. Other devices such as plugs, thermostats or lights without a security function generally fall into the default category.

What matters in practice

No universal default passwords, secure settings out of the box, security updates – automatic where appropriate, with an easy opt-out –, data minimisation and a support period that reflects the expected period of use. The vulnerability contact point belongs in the user information.

Radio Equipment Directive

Devices with Wi-Fi, Bluetooth or cellular connectivity have already had to meet cybersecurity requirements under the Radio Equipment Directive (EN 18031) since 1 August 2025. The CRA is added from December 2027; the evidence can be reused.