01Typical products
- Wi-Fi or Bluetooth connected washing machines, dishwashers, fridges, ovens, air conditioners
- Smart locks, security cameras, baby monitors, alarm systems
- Smart home assistants and hubs
- Suppliers: Wi-Fi and Bluetooth modules, control boards, embedded software
02Likely CRA class
Most connected appliances are default class; conformity can be assessed through internal control (Module A).
Annex III Class I lists "smart home products with security functionalities, including smart door locks, security cameras, baby monitoring systems and alarm systems" and "smart home general purpose virtual assistants". These are Class I; until harmonised standards are published, third-party assessment is needed.
Software and hardware components placed on the market separately are also "products with digital elements" under the CRA (Article 3(1)). A Wi-Fi module sold separately may have CRA obligations of its own.
03Other rules that apply
- RED and EN 18031: Cybersecurity requirements for wireless home devices have been mandatory since 1 August 2025. See the EN 18031 and RED guide.
- CRA Article 13: Manufacturers must exercise due diligence when integrating third-party components. That is why brands will ask their suppliers for evidence.
- GDPR: Products that collect camera, microphone or usage data also carry personal data obligations.
04Challenges specific to this industry
- Suppliers providing evidence: suppliers of Wi-Fi modules, control boards or firmware should provide an SBOM, vulnerability information and an update commitment.
- Many models and versions: one module is used in dozens of product models; you need to see quickly which models a vulnerability affects.
- Long use: appliances are used for many years; the support period should reflect that and be stated at the point of sale.
- Getting updates to users: devices that are offline or were never connected need an update strategy.
05What the platform does here
- Imports supplier SBOMs and scans them continuously for new vulnerabilities; you see the models that share a component together.
- Produces the SBOM from the firmware image; prioritises vulnerabilities with CISA KEV and EPSS.
- Collects tampering and memory corruption events reported by devices; critical device events automatically open an assessment record and your team decides whether they must be reported.
- Signed OTA updates with A/B slots and anti-rollback protection.
- CSAF 2.0 and OpenVEX output: machine-readable evidence for the brand or the supplier.
- A signed, RFC 3161 timestamped evidence archive kept unaltered for 10 years.
06Frequently asked questions
Which class is a Wi-Fi washing machine?
Most likely default class. Its core function is washing; it does not fall into an Annex III or IV category. Conformity can be assessed through internal control (Module A).
I only make boards as a supplier. Does the CRA concern me?
If you place the board on the market as a product of its own, you may have obligations yourself. Even if you do not, the brand will ask you for an SBOM, vulnerability information and update support because of its due diligence duty under the CRA.
We make smart locks. What changes?
Smart locks are in Annex III Class I. Until harmonised standards are published, third-party assessment by a notified body is needed, so preparing the technical documentation early matters.
Let's talk about your product
We run a free CRA pre-scan of a firmware you choose: components, priority vulnerabilities, likely class and the three biggest gaps.
Other industries
- Network and telecom equipmentRouters, modems and switches are important products; until harmonised standards are published, third-party assessment is needed.
- Industrial automation and electronicsCustomers under NIS2 ask their suppliers for evidence, and the Machinery Regulation starts to apply in 2027.
General information, not legal advice. A product's class follows its core functionality; the technical descriptions of the categories are in Implementing Regulation (EU) 2025/2392.