CRA for connected home appliances

Why connected home appliances fall under the CRA

Washing machines started by app, ovens with cloud recipes, robot vacuums mapping homes on a phone: all exchange data with a network or device. The Cyber Resilience Act (Regulation (EU) 2024/2847, CRA) applies to products with digital elements “the intended purpose or reasonably foreseeable use of which includes a direct or indirect logical or physical data connection to a device or network” (Article 2(1)). Devices that exchange data via Wi-Fi or Bluetooth are therefore likely to be in scope. Devices without radio can be in scope where a service or diagnostic interface transmits data; electrical and optical interfaces also count as a physical connection (Article 3(9)). The exclusions in Article 2(2) to (4) concern medical devices, in vitro diagnostic medical devices, motor vehicles, civil aviation and marine equipment and are likely not to fit home appliances.

We also draw on the draft Commission guidance on the application of the CRA, whose content the Commission approved on 27 July 2026 (C(2026) 5252, so far in English only; formal adoption is pending). Under the accompanying communication it applies only from formal adoption and does not bind economic operators (para 8). We do not base any statement on it alone.

Typical products and their likely classification

The conformity assessment procedure depends on the product's core functionality (Article 7(1); Implementing Regulation (EU) 2025/2392 (CIR 2025/2392), recital 2); the draft guidance assumes exactly one core functionality per product (para 144). Washing, dishwashing, cooling, baking, coffee making, vacuuming and air conditioning appear in neither Annex III nor Annex IV. An appliance whose core functionality is one of these tasks therefore likely stays in the default category with internal control under Module A (Article 32(1)(a)). The table is an initial technical assessment, not a binding classification and not legal advice.

For class I, internal control is only allowed where harmonised standards, common specifications or a European certification scheme at assurance level at least “substantial” are fully applied; otherwise a notified body is involved (Article 32(2)). On 1 November 2026, no harmonised standard for the CRA had been published in the Official Journal; check the current status. More on CRA product classes.

When an Annex III core functionality could apply

Integrating a product with an Annex III core functionality “shall not in itself” subject the product it is integrated into to the stricter procedures (Article 7(1), second sentence). A product that can perform the functions of a category but whose core functionality differs does not correspond to that category's technical description (CIR 2025/2392, recital 5; likewise draft guidance para 141).

General purpose voice assistant in the appliance

Annex III class I No. 16 lists “smart home general purpose virtual assistants”: products that communicate via the public internet, process requests in natural language and, on that basis, provide access to other services or control connected devices in residential settings (CIR 2025/2392, Annex I No. 16).

• Voice control for the appliance's own functions only: the general purpose is missing. Likely default.
• General purpose assistant as a built-in component, for example in a refrigerator: cooling remains the core functionality (Article 7(1), second sentence); the assistant's security still counts in assessing the whole product (CIR 2025/2392, recital 3).
• Assistant as the main purpose, such as a kitchen display answering questions and controlling other appliances: much points to No. 16, hence class I.

The technical documentation describes the intended purpose (Annex VII point 1(a)); the draft guidance treats clear inconsistencies with marketing and instructions as a warning sign (para 143).

Camera in the robot vacuum

No. 17 covers products that “protect the physical security of consumers in a residential setting” and can be remotely controlled or managed, including home surveillance cameras (CIR 2025/2392, Annex I No. 17). A robot vacuum with live view can do something similar, but its core functionality likely remains cleaning. This may differ for a model designed and marketed as mobile home surveillance with patrol runs and alarms.

Radio module

A Wi-Fi or Bluetooth module can be a physical network interface under Annex III class I No. 10 (CIR 2025/2392, Annex I No. 10). This concerns the module maker; once built in, the module does not change the appliance's classification (Article 7(1), second sentence).

Manufacturer app and cloud back end as remote data processing

Under Article 3(1), the product includes its remote data processing solutions. Remote data processing is “data processing at a distance for which the software is designed and developed by the manufacturer, or under the responsibility of the manufacturer, and the absence of which would prevent the product with digital elements from performing one of its functions” (Article 3(2)).

This gives two questions, both to be answered yes: would an appliance function fail without the remote processing? Did the manufacturer develop the software itself or under its responsibility? Section 8 of the draft guidance agrees (paras 188 and 202), counts commands, onboarding, configuration and updates as functions (para 190) and confirms remote data processing for a smart thermostat with app and cloud (Section 8.3.2). Our assessment:

• Own back end for remote start, status, pairing and updates, including on rented IaaS or PaaS: likely remote data processing (Article 3(2); draft guidance paras 198 and 199).
• Telemetry purely for statistics: not remote data processing, because no appliance function fails, but part of the risk assessment (Article 13(2); draft guidance paras 192 and 193).
• Ready-made third-party SaaS: not developed by or on behalf of the manufacturer, but to be treated like a third-party component with due diligence (Article 13(5); draft guidance paras 200 to 202).

The technical documentation describes the system architecture, including how the back end integrates into the overall processing (Annex VII point 2(a)); for a cloud shared by many models, the draft guidance allows this description to be reused (para 204). Where the back end is part of the product, our initial assessment is that the Article 14 reporting obligation covers it too. When an appliance changes owner, reset to the original state (Annex I Part I(2)(b)) and secure removal of all data (point (m)) matter, coordinated between device and cloud account.

Delineation from smart home, building technology and radio equipment law

Routers, cameras, door locks, alarm systems and voice speakers are covered under consumer IoT and smart home, fixed building automation with KNX or BACnet under building automation and BMS. We cover room air conditioners here.

Radio equipment that can itself communicate over the internet is subject to Delegated Regulation (EU) 2022/30 (Article 1(1)), whose requirements have applied since 1 August 2025 (Delegated Regulation (EU) 2026/339, recital 5). Delegated Regulation (EU) 2026/339 repeals it with effect from 11 December 2027 (Article 1); for radio equipment placed on the market between 1 August 2025 and 10 December 2027, market surveillance and conformity checks remain unaffected (recital 5). More under telecom, radio equipment and RED-DA.

Deadlines, existing devices and support period

Since 11 September 2026, Article 14 has required reporting of actively exploited vulnerabilities and severe incidents via the single reporting platform: early warning within 24 hours, notification within 72 hours at the latest (Article 14(1) to (4)). The remaining obligations apply from 11 December 2027 (Article 71(2)). More on the reporting obligation since September 2026.

Reporting also covers devices placed on the market before 11 December 2027; other requirements reach them only after a later substantial modification (Article 69(2) and (3)). Placing on the market is the first making available of a product (Article 3(21)); the draft guidance applies this to each individual unit (para 11). A model range built beyond December 2027 must therefore comply unit by unit. Spare parts that replace identical components to the same specifications are not subject to the CRA (Article 2(6)).

The support period reflects the expected use time and is at least five years, unless the product is expected to be in use for less (Article 13(8)). Plan back-end maintenance for the same period. More on the support period and update duty.

A constructed example: a maker of dishwashers and ovens

This example is invented. A mid-sized manufacturer sells dishwashers and ovens with Wi-Fi, its own app and a self-developed back end on a rented cloud; a new oven model receives a general purpose voice assistant from a third party. Initial assessment: both appliance families are likely to remain default, including the model with the assistant, because the core functionality remains baking (Article 7(1), second sentence). The back end is likely remote data processing, the voice service a third-party component. The Article 14 reporting path comes first, including for appliances sold; SBOMs per release and the documented delineation from Annex III No. 16 follow. Its legal department carries out the legal assessment.

Next steps

1. List connected appliance lines and record each model's core functionality.
2. For voice assistants or cameras, document the delineation from Annex III No. 16 and 17.
3. Classify app, back end and bought-in services under Article 3(2) and assess their risks.
4. Set up the Article 14 reporting path and plan the support period for device and back end.

The free exposure check gives a first overview. We assess the classification of your appliances technically and mark open points for review by your legal department. More: threat modeling, SBOM consulting, reporting and PSIRT, contact.