Does the CRA reach a device that connects only to a phone, not the internet?

Yes. The Regulation covers products with digital elements whose intended use includes a direct or indirect data connection to a device or network, which a phone pairing is.

We sell into the EU from outside it. Does that change anything?

No. The duties follow placing the product on the Union market, not where you are. You will need an importer or an authorised representative established in the Union.

What is actually due now, before 11 December 2027?

The reporting duty. Since 11 September 2026 an actively exploited vulnerability or a severe incident has to be notified, first within 24 hours and then within 72.

Is a firmware update a new product?

Not by itself. A substantial modification of an already placed product makes it one, which is the test to apply before a major release.

Cyber Resilience Act: all tools and articles

Regulation (EU) 2024/2847, Annex III

You make a connected consumer device. What does the CRA ask of you?

In scope?: Yes, by default, like every product with digital elements.
Which class?: Default, unless it is one of the five consumer categories in Annex III class I.
Due when?: Reporting since 11 September 2026; everything else from 11 December 2027.

What do you make?

The five consumer categories in Annex III class I

Point	As the Regulation words it
III.I.12	Routers, modems intended for the connection to the internet, and switches
III.I.16	Smart home general purpose virtual assistants
III.I.17	Smart home products with security functionalities, including smart door locks, security cameras, baby monitoring systems and alarm systems
III.I.18	Internet connected toys covered by Directive 2009/48/EC of the European Parliament and of the Council that have social interactive features (e.g. speaking or filming) or that have location tracking features
III.I.19	Personal wearable products to be worn or placed on a human body that have a health monitoring (such as tracking) purpose and to which Regulation (EU) 2017/745 or (EU) 2017/746 do not apply, or personal wearable products that are intended for the use by and for children

Regulation (EU) 2024/2847, Annex III, class I, read from the Official Journal with its corrigenda; reporting duties apply since 11 September 2026.

Two ways to be ready

CRA readiness, €1,500, 10 working days

We scope your product, list the gaps against Annex I, set up the reporting path and draft the technical file with you.

See what it covers

CRA technical file pack, €2,000

The same file, written by you from our template and product record, with no engagement.

See the pack

Questions people ask

Does the CRA reach a device that connects only to a phone, not the internet?: Yes. The Regulation covers products with digital elements whose intended use includes a direct or indirect data connection to a device or network, which a phone pairing is.
We sell into the EU from outside it. Does that change anything?: No. The duties follow placing the product on the Union market, not where you are. You will need an importer or an authorised representative established in the Union.
What is actually due now, before 11 December 2027?: The reporting duty. Since 11 September 2026 an actively exploited vulnerability or a severe incident has to be notified, first within 24 hours and then within 72.
Is a firmware update a new product?: Not by itself. A substantial modification of an already placed product makes it one, which is the test to apply before a major release.

This page in:Deutsch Français Nederlands Español Dansk