The CRA is directly relevant to connected smart-home products. Scope comes first, then classification. Smart-home security products and general-purpose virtual assistants are expressly listed as important Class I products, while manufacturer-controlled cloud functions necessary for remote control can form part of the product as remote data processing.
Smart-Home Devices Can Be Products With Digital Elements
Smart-home products commonly combine electronic hardware, embedded software and network connectivity, placing many of them squarely within the CRA scope analysis. Devices such as connected cameras, controllers, locks, alarms, monitors and assistants can qualify as products with digital elements where the Regulation's market, connection and other scope conditions are met.
Some Smart-Home Products Are Expressly Listed in Annex III
The CRA does more than merely acknowledge smart-home products. Annex III Class I expressly lists smart-home general-purpose virtual assistants and smart-home products with security functionalities. The listed examples of security-function products include smart door locks, security cameras, baby monitoring systems and alarm systems. Products whose core functionality matches these categories are important products with digital elements and are subject to the corresponding conformity assessment rules.
Not Every Smart-Home Device Is Automatically an Important Product
The fact that a product is used in a smart home does not automatically put it into Annex III. A connected light, appliance, irrigation controller or other household device may still fall within the general CRA product framework without having the core functionality of a listed important category. Manufacturers should separate the scope question from the later classification question.
Security Functionality Is Particularly Important
Smart-home products whose core functionality protects access, monitors security or provides alarm functions receive explicit attention in the CRA because exploitation can have significant consequences for user security and safety. Manufacturers should define the product's core function carefully and compare it with the applicable Annex III category and current technical classification material rather than relying only on the retail product name.
Cloud-Based Remote Control Can Be Part of the Product
Recital 12 expressly uses smart-home devices as an example of remote data processing. Manufacturer-provided cloud functionality that enables a user to control a smart-home device remotely falls within CRA scope where it meets the Regulation's definition. Product cybersecurity analysis can therefore need to cover both the physical device and necessary manufacturer-controlled remote software.
An Unrelated Website Is Not Automatically Part of the Device
The Regulation also draws a boundary around remote functionality. A website that does not support the functionality of the product, or a cloud service designed and developed outside the manufacturer's responsibility, does not become part of the product simply because the manufacturer or user accesses it. Teams should document which services actually support product functions.
Companion Apps May Also Be Part of the Product Architecture
Many smart-home products depend on mobile applications for setup, control, authentication, configuration and security updates. The manufacturer should map the relationship between the device, companion software and necessary remote processing rather than treating each layer as unrelated. The exact CRA product boundary depends on how the software is supplied and which functions are necessary for the product.
Smart-Home Products Need Long-Term Vulnerability Visibility
A household device can remain deployed for years after purchase. Manufacturers should therefore maintain visibility into supported firmware, companion-app versions, remote-service changes and integrated components throughout the support period. A vulnerability affecting an old device version can remain relevant even when newer models have replaced it commercially.
Classify the Product Before Choosing the Conformity Route
Once scope is established, determine whether the product falls within the general CRA framework or an Annex III important category. Smart-home products with security functionalities and general-purpose virtual assistants require particular attention. Classification affects which conformity assessment routes are available, so this decision should be made early enough to plan testing and external assessment where required.
Official sources
Read the full legal text and Commission material for precise wording, qualifications and updates.