Does the EU Cyber Resilience Act apply to my IoT device?

Short answer (it depends): Connected hardware sold in the EU is the core CRA case: hardware + its software + remote data processing it relies on. Some categories (e.g. routers, smart-home security devices) are ‘important’ and face stricter conformity routes.

What it means for an IoT device

• Check Annex III/IV categories: important/critical products need more than self-assessment in some classes.
• The companion app and cloud the device needs can be part of the product.
• Importers and distributors have their own duties; the manufacturer carries most.
• Products already on the market before 11 Dec 2027 still fall under reporting from 11 Sep 2026.

Key dates

• 11 Sep 2026: reporting of actively exploited vulnerabilities and severe incidents (ENISA Single Reporting Platform) — applies to products already on the market.
• 11 Dec 2027: main obligations (security requirements, vulnerability handling, support period, CE marking).

FAQ

• I’m based outside the EU? Making your IoT device available to EU users can still bring you in scope.
• What docs would I need? Typically a CVD policy, security.txt, intake page, reporting runbook, support-period statement, risk assessment.

Related: 24h reporting for IoT devices · CVD policy

Not legal advice. Templates + software. Verify against the CRA text (Regulation (EU) 2024/2847), Commission guidance C(2026)5252 or a qualified advisor.

Last reviewed: 2026-10-30