Free, niche-specific compliance checklists for EU manufacturers of products with digital elements. Covers classification, security requirements, CVD obligations, and Article 14 reporting. Deadline: September 2026.
Consumer routers and modems are high-value targets for attackers and face specific CRA requirements around default credentials, remote management security, and firmware update integrity. Routers marketed for home use are Default class; those marketed for industrial or critical infrastructure use may be Annex III Class II.
Default Class for consumer useSmart home devices — thermostats, smart speakers, lighting controllers, home security cameras — are among the most common products with digital elements in scope for the CRA. Most will fall into the Default class requiring self-assessment, but devices with gateway functionality may be classified as Important Class I.
Default Class (self-assessment)Wearable devices — fitness trackers, smartwatches, and health monitors — collect sensitive biometric and health data and are in scope for the CRA as products with digital elements. Unlike medical devices regulated under MDR, general fitness wearables are not excluded from the CRA and must comply with all Annex I security requirements, including data minimisation, encrypted transmission, and secure update mechanisms.
Default Class (self-assessment)Building automation systems (BAS/BMS) control HVAC, lighting, access, fire safety, and energy management across commercial and industrial buildings. Most BAS components are Default class under the CRA, but those deployed in hospitals, data centres, and other critical facilities may be treated as critical infrastructure components. The BACnet and Modbus protocols widely used in BAS were not designed with security in mind — CRA compliance requires significant attention to protocol security and access control.
Default Class to Important Class IIndustrial controllers, PLCs, and SCADA components are classified as Important Class II under Annex III of the CRA, requiring third-party conformity assessment. These products have long operational lifetimes (10–20+ years), network connectivity, and significant safety implications. CRA compliance must be planned well in advance of the September 2026 deadline.
Important Class II (Annex III)IoT sensors — temperature, humidity, pressure, flow, and motion sensors — are the backbone of industrial and building automation. Most fall into the Default CRA class, but their constrained hardware often makes meeting Annex I security requirements challenging. Manufacturers must plan for secure update mechanisms even on resource-constrained devices.
Default Class (self-assessment)CVD Portal provides a complete vulnerability disclosure programme — submission portal, Article 14 deadline tracking, and CSAF advisory generation. Free for EU manufacturers.
Set up your free portal