Connected devices and IoT
The Cyber Resilience Act for connected devices
Connected hardware is the segment the CRA was drafted around, so the interesting question is rarely whether it applies. It is which route you are on, and whether you could survive the reporting clock that starts on 11 September 2026.
This page does not tell you whether the CRA applies to you. It cannot: the answer turns on inputs only you have. What it does is name the questions that decide it, with the article behind each, so the free check takes two minutes instead of an afternoon.
The assumption to check first
“We have until December 2027, when the CRA fully applies.”
The essential requirements apply from 11 December 2027. The Article 14 reporting duty applies from 11 September 2026, fifteen months earlier, and it is the one that needs people and a rota rather than engineering.
What actually decides it
Does intended or reasonably foreseeable use include a data connection?
Article 2(1), Regulation (EU) 2024/2847
A device with a connection it was never meant to use is still caught if that use is reasonably foreseeable.
Is it listed in Annex III as an important product, class I or class II?
Annex III, Regulation (EU) 2024/2847
This decides your conformity assessment route, not whether you are in scope.
Is it a critical product under Annex IV?
Annex IV, Regulation (EU) 2024/2847
The strictest route. Rare, and worth ruling out explicitly rather than assuming.
Does another regime displace the CRA?
Article 2, Regulation (EU) 2024/2847
Medical devices, IVD, vehicles, aviation, marine and defence have their own regimes. A device can look connected and still sit outside.
Is the product placed on the EU market?
Article 2(1), Regulation (EU) 2024/2847
Scope follows the market, not your address. A company outside the EU that sells into it is in; an EU company selling only elsewhere is not.
What to do next
- 1.Run the scope check to get your Annex III or IV position with the article behind it.
- 2.Then do the reporting readiness check, because September arrives before the requirements do.
- 3.Name a reporting owner and a backup before anything else. It is free and it is the step that most often has not happened.