CRA for connected toys and children's products

Why connected toys fall under the Cyber Resilience Act

Talking dolls, learning robots and children's smartwatches all exchange data with other devices or networks. The Cyber Resilience Act (Regulation (EU) 2024/2847, CRA) applies to products with digital elements whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network (Article 2(1)). A toy car that receives commands from an app via Bluetooth has such a data connection. In addition, the draft Commission guidance on the application of the CRA, whose content the Commission approved on 27 July 2026 (C(2026) 5252, so far only in English; formal adoption is pending), interprets the term as turning on the exchange of digital information, with signals that merely trigger a function not being enough (paragraphs 26 to 28). According to the Commission’s accompanying communication, the guidance will only apply from its formal adoption, and even then it is not binding; an authoritative interpretation can only be given by the Court of Justice of the European Union (paragraph 8). We do not base any statement on the draft alone.

Under Article 3(1), a product also includes its remote data processing solutions: software for data processing at a distance, designed and developed by the manufacturer or under its responsibility, without which the product could not perform one of its functions (Article 3(2)), such as the cloud speech service of a talking doll. Include device and back end together in the risk assessment and reporting. The draft guidance also treats a manufacturer's companion app as part of the product if the device cannot fulfil its purpose without it (paragraph 25 and Example 9); as a precaution, plan the app in as well.

Annex III points 18 and 19: two class I categories for children's products

Annex III class I names children's products explicitly; the technical description is set out in Annex I to Implementing Regulation (EU) 2025/2392. The core functionality is what counts (Article 7(1) CRA).

Point 18: internet-connected toys

Annex III class I point 18 covers "Internet connected toys covered by Directive 2009/48/EC […] that have social interactive features (e.g. speaking or filming) or that have location tracking features". The Implementing Regulation clarifies three points:

• Internet link: the toy communicates via the public internet, directly or through other devices. A Bluetooth toy that reaches a server via a smartphone can be covered.
• Social interaction: embedded technologies enabling incoming and outgoing communication, such as a keyboard, microphone, loudspeaker or camera.
• Location tracking: technologies that enable locating, or drawing conclusions about the geographical location of, the toy or its users. A toy that merely detects the proximity of the user or of other toys by means of sensors is not considered to have location tracking features.

The category presupposes that the product is a toy within the meaning of the Toy Safety Directive: a product designed or intended, whether or not exclusively, for use in play by children under 14 years of age (Article 2(1) of Directive 2009/48/EC).

Point 19: wearables for children

Point 19 names, among others, "personal wearable products that are intended for the use by and for children". Under the Implementing Regulation these are products with digital elements that can be worn by, or attached to the body of, persons under 14, directly or via clothing or accessories; body-worn products for the safety of children are named explicitly. No play function is required, so a children's smartwatch is likely to fall under point 19.

The draft guidance assumes that a product has only one core functionality for the choice of procedure (paragraph 144). If a children's watch with play functions, a camera and an internet connection fits both descriptions, the procedure does not change because both categories belong to class I; the allocation should still be documented with reasons in the technical documentation.

Delineation: baby monitors

Baby monitoring systems belong to a different category, Annex III class I point 17 (smart home products with security functionalities). We cover their classification and the related smart-home questions on the page Consumer IoT and smart home.

Typical products and their likely classification

The table is an initial technical assessment based on typical features; the binding classification depends on the specific product and needs legal review. An overview of all classes is given in the article CRA product classes.

If a default product later gains an internet feature with speech, camera or location tracking, you should reassess its classification.

What class I means for the conformity assessment

For default products, the internal control procedure based on module A is sufficient (Article 32(1)). For class I, module A is only possible if the manufacturer has fully applied harmonised standards, common specifications or a European cybersecurity certification scheme at assurance level at least "substantial". Otherwise, Article 32(2) requires EU-type examination followed by conformity to type (module B+C) or full quality assurance (module H), each involving a notified body. On 1 November 2026, no harmonised standard for the CRA had been published in the Official Journal. Plan for both routes: implement and evidence Annex I so that it can later be mapped to a standard, and keep a notified body as an option. See Conformity assessment and CE.

Toy law: Directive 2009/48/EC and Regulation (EU) 2025/2509

Toy safety is currently governed by Directive 2009/48/EC. Regulation (EU) 2025/2509 on the safety of toys was published in the Official Journal on 12 December 2025. It applies from 1 August 2030; certain articles (Articles 28 to 44 and 49 to 55) already apply from 1 January 2026 (Article 59). The Directive is repealed with effect from 1 August 2030; references to it shall then be construed as references to the new Regulation and read in accordance with the correlation table in Annex VIII (Article 56). On its wording, this is likely to cover the reference in Annex III point 18 CRA as well; we flag this point for review by your legal department.

For cybersecurity, the new Regulation refers to the other legal acts: toys with digital elements are to comply with the CRA, and the Toy Safety Regulation itself should therefore not lay down particular safety requirements regarding cybersecurity (recital 14). From 1 August 2030, the safety assessment for toys falling within the scope of the CRA, the AI Act or the Radio Equipment Directive must take account of the particular vulnerabilities of children (Article 25(2)(c)).

Radio Equipment Directive: RED DA until 10 December 2027, then the CRA

Toys with radio functions are already subject to cybersecurity law. Delegated Regulation (EU) 2022/30 expressly applies the essential requirement in Article 3(3)(e) of Directive 2014/53/EU (protection of personal data and privacy) to radio equipment covered by the Toy Safety Directive, to radio equipment designed or intended exclusively for childcare and to radio equipment worn on the body, if it is capable of processing personal data, traffic data or location data (Article 1(2)(b) to (d)). For internet-connected radio equipment, point (d) applies as well (Article 1(1)). These requirements have applied since 1 August 2025; Delegated Regulation (EU) 2023/2444 moved the original date of application (1 August 2024) to that date.

Delegated Regulation (EU) 2026/339 repeals Regulation (EU) 2022/30 with effect from 11 December 2027, so that radio equipment is not regulated twice. Until then the RED DA remains authoritative. EN 18031-2:2024 has been published as the harmonised standard for it, with restrictions: for toy and childcare radio equipment, the standard does not confer a presumption of conformity if parental or guardian access control is not ensured, and for all equipment it confers none if, under clauses 6.2.5.1 and 6.2.5.2 of the standard, the user is allowed not to set and use any password (Implementing Decision (EU) 2025/138, Annex, entry 165, notices 2 and 3). Under Article 69(1) CRA, EU-type examination certificates and approval decisions issued regarding cybersecurity requirements under other Union harmonisation legislation remain valid until 11 June 2028, unless they expire earlier or unless otherwise specified in such other Union harmonisation legislation. The provision covers only such certificates and approval decisions. A manufacturer that met the RED DA with EN 18031-2 through internal production control (Article 17(3)(a) and Annex II of Directive 2014/53/EU) holds no certificate and cannot rely on Article 69(1). The draft guidance reads the provision as covering only the risks addressed by a RED certificate; risks outside the RED, such as vulnerability handling or data minimisation, would have to be addressed in addition (paragraphs 248 to 254). See also Telecom and radio equipment and EN 18031.

Deadlines and legacy products

• Since 11 September 2026: reporting obligation under Article 14. Actively exploited vulnerabilities and severe incidents go through the single reporting platform, the early warning without undue delay and in any event within 24 hours of becoming aware. This also applies to products placed on the market before 11 December 2027 (Article 69(3)). More in the article Reporting obligation from September 2026.
• From 11 December 2027: all other obligations, including Annex I, technical documentation, conformity assessment and CE marking (Article 71(2)).
• Legacy products: products placed on the market before 11 December 2027 are subject to the other requirements only if they undergo a substantial modification from that date (Article 69(2)).

What matters technically for children's products

For children's products these Annex I points come first:

• Access protection and default configuration: protection from unauthorised access by appropriate control mechanisms (Annex I Part I point 2(d)) and a secure by default configuration (point 2(b)), for example during pairing and in the parent app.
• Confidentiality and data minimisation: process voice, image and location data encrypted (point 2(e)) and only as much data as the purpose requires (point 2(g)).
• Deletion: users must be able to remove all data and settings permanently, securely and easily (point 2(m)), relevant when a toy is passed on.
• Updates and SBOM: security updates (point 2(c)), a software bill of materials in a commonly used and machine-readable format (Annex I Part II point 1) and a coordinated vulnerability disclosure policy (Part II point 5).
• Support period: it reflects the length of time the product is expected to be in use (Article 13(8), second subparagraph) and is at least five years; where the product is expected to be in use for less time, it corresponds to the expected use time (Article 13(8), third subparagraph). See Support period and update duty.

A constructed example: a learning toy with a speech function

The example is invented. A manufacturer develops a learning figure for primary-school children with microphone and loudspeaker. It connects via Wi-Fi to a speech service the manufacturer runs at a cloud provider and is set up through a parent app. Technically, much points to Annex III point 18; the speech service is likely to be remote data processing within the meaning of Article 3(2) and, together with the app, part of the product.

The manufacturer first puts the reporting process into operation, because Article 14 already applies, including to the predecessor figure still on sale. It then maps EN 18031-2 to Annex I, defines parental access control, generates the SBOM from the build and documents the support period. Whether the figure is a toy within the meaning of toy law is flagged for review by its legal department, and it provides for a notified body in case no suitable harmonised standard is available by the time of placing on the market.

Next steps

A first step is the applicability check. In the CRA gap analysis we assess the product class and conformity route for each product technically and flag legal questions for review by your legal department. Related services are Reporting process and PSIRT and SBOM consulting. To talk to us: Get in touch. (This text provides schematic classification and is not legal advice.)