Data connection under the CRA: which interfaces count?

Why the interface helps decide the scope

Whether a device falls under the Cyber Resilience Act (Regulation (EU) 2024/2847, CRA) is not settled by asking whether it contains a microcontroller. Article 2(1) also requires a data connection: the Regulation “applies to products with digital elements made available on the market, the intended purpose or reasonably foreseeable use of which includes a direct or indirect logical or physical data connection to a device or network”.

This results in two steps: is the item a product with digital elements within the meaning of Article 3, and does its intended purpose or reasonably foreseeable use include a data connection? The second step turns on the interfaces. A single interface over which data flows as intended or foreseeably is enough. This article classifies common interfaces technically and is not legal advice.

What the Regulation defines

The relevant terms are in Article 3. Verbatim, the following definitions apply:

• Point (1) ‘product with digital elements’ “means a software or hardware product and its remote data processing solutions, including software or hardware components being placed on the market separately”;
• Point (2) ‘remote data processing’ “means data processing at a distance for which the software is designed and developed by the manufacturer, or under the responsibility of the manufacturer, and the absence of which would prevent the product with digital elements from performing one of its functions”;
• Point (5) ‘hardware’ “means a physical electronic information system, or parts thereof capable of processing, storing or transmitting digital data”;
• Point (7) ‘electronic information system’ “means a system, including electrical or electronic equipment, capable of processing, storing or transmitting digital data”;
• Point (8) ‘logical connection’ “means a virtual representation of a data connection implemented through a software interface”;
• Point (9) ‘physical connection’ “means a connection between electronic information systems or components implemented using physical means, including through electrical, optical or mechanical interfaces, wires or radio waves”;
• Point (10) ‘indirect connection’ “means a connection to a device or network, which does not take place directly but rather as part of a larger system that is directly connectable to such device or network”.

The physical connection is defined in a technology-neutral way: cables, connectors, optical interfaces and radio are all covered. A device attached only to a gateway or controller can be indirectly connected under point (10). Recital 9 gives the reason: attack chains across several products.

‘Intended purpose’ (Article 3, point (23)) is the use stated in the instructions for use, promotional or sales materials and statements, and the technical documentation. ‘Reasonably foreseeable use’ (Article 3, point (24)) goes further and also covers use which “is likely to result from reasonably foreseeable human behaviour or technical operations or interactions”.

How the draft Commission guidance reads ‘data connection’

The CRA does not define ‘data connection’ itself. This is where the draft Commission guidance on the application of the CRA comes in, whose content the Commission approved on 27 July 2026 (C(2026) 5252, so far in English only; formal adoption is pending). According to the accompanying communication, the guidance will be formally adopted once all language versions are available and will only apply from that moment. Even then it is, by its own account, not binding, and an authoritative interpretation can only be given by the Court of Justice of the European Union (para. 8).

According to the draft Commission guidance, in substance: the scope is anchored in the capacity to exchange digital information; electronics alone are not enough (paras. 26, 27). Under para. 28, a data connection transmits information in binary form. Simply switching an output on and off does not by itself constitute a data connection if those states are not intended to represent data or are not read by a digital input. There must be a sender that deliberately generates digital symbols according to a defined scheme, and a receiver capable of interpreting them as data. Where signals are used solely to trigger or power a function, no data connection exists and the product does not fall within Article 2(1).

Interfaces at a glance

The table is an initial technical assessment based on Article 2(1), Article 3, points (8) to (10), and paras. 26 to 28 of the draft guidance. It does not replace an assessment of the individual product.

The interfaces in detail

Ethernet and RJ45

An Ethernet interface is a physical connection through wires within the meaning of Article 3, point (9). Where data is transmitted over it according to a protocol, the data connection under Article 2(1) is established. What counts is what runs over the contacts; RJ45 connectors are also used for other signals.

USB

If a device can be configured, read out or flashed with new firmware over USB, there is a data connection. If, on the other hand, only energy flows through the socket and no states are encoded and read as data, according to the draft Commission guidance (para. 28) there is no data connection. Three points can change the answer:

• Firmware update: if the instructions or technical documentation provide that service staff or users load new firmware through the same socket, the data connection is part of the intended purpose (Article 3, point (23)).
• Connected data lines: if the data lines are routed to a controller that enumerates on the host as a device, data exchange may be reasonably foreseeable even if the instructions only mention charging. Article 3, point (24) expressly includes “technical operations or interactions”.
• Negotiation while charging: with some charging methods, for example USB Power Delivery, power supply and device negotiate voltage and current through messages. Whether that alone is a data connection within the meaning of Article 2(1) is not answered expressly by either the Regulation or the draft guidance. Such a device should therefore be checked separately.

Radio: Wi-Fi, Bluetooth, NFC, cellular

Article 3, point (9) expressly names radio waves as a physical means of connection. A radio interface over which a device sends or receives data is therefore a data connection, for Wi-Fi and cellular as much as for short-range Bluetooth and NFC. How the CRA relates to radio equipment law is covered on our page on telecoms, radio equipment and the RED delegated act.

Serial interfaces, service and diagnostic access

Serial interfaces and field buses transmit data between sender and receiver according to a defined scheme and thus match the description in para. 28. If a device sits only on a bus behind a controller or gateway that is itself connectable to a network, an indirect connection under Article 3, point (10) comes into consideration.

With service and diagnostic interfaces, the obvious objection is that only technicians use them. Article 2(1), however, asks only about intended purpose and foreseeable use, and not about who makes the connection. Where the instructions or technical documentation describe a service access, it is part of the intended purpose. A production-only access is a more open case; whether it remains reachable in the delivered device should be documented technically. If the product is within the CRA anyway, such an access counts among the external interfaces for which Annex I, Part I, point (2)(j) requires limited attack surfaces, and service access is subject to protection from unauthorised access under point (2)(d).

Charging and switching contacts

A volt-free contact, a relay output or charging contacts that only transfer energy do not in themselves establish a data connection according to the draft guidance (para. 28); the CRA itself does not define the term. Where a controller evaluates the contact as status information, however, a closer look is needed at whether the state is intended to represent data. A product whose only connection is such a contact is likely not to fall within Article 2(1) on this reading; if it has another interface as well, that interface decides.

Cables, routers and Wi-Fi signals are means of communication

In section 8.3.5, the draft guidance discusses remote data processing under Article 3, point (2) using the example of a cellular network. According to the draft Commission guidance, an Ethernet cable, a router or a Wi-Fi signal is not data processing whose absence would prevent the product from performing one of its functions; the draft treats them as enablers of communication and connectivity. The network your product is attached to therefore does not become its remote data processing solution. A cloud function whose software you develop yourself or under your responsibility, and without which the product could not perform one of its functions, on the other hand, can be one.

A constructed example

The following example is invented. A manufacturer places a charging station for power tool batteries on the market. A microcontroller controls charging, a USB-C socket supplies power to the station, and otherwise there are only indicator lights. The technical documentation, however, provides that service partners load new firmware through the same socket. The intended purpose therefore includes a physical data connection, and the station is likely to fall within Article 2(1). Had the manufacturer left the data lines unconnected and provided no update through the socket, the assessment would differ; it would then only depend on whether data is exchanged during charging itself.

What the interface does not decide

The product class depends on the core functionality: important products are those “which have the core functionality of a product category set out in Annex III” (Article 7(1)). According to the draft Commission guidance, core functionality comprises the main features and technical capabilities without which a product would not be able to meet its intended purpose (para. 139). A built-in radio or network module therefore does not in itself determine the class of the device; for integrated products with an Annex III core functionality, the second sentence of Article 7(1) expressly states that their integration does not in itself make the overall product subject to the procedures under Article 32(2) and (3). The technical descriptions of the categories are set out in Implementing Regulation (EU) 2025/2392; more on this in the article on product classes.

The exclusions do not depend on the interface either. Article 2(2) to (4) excludes products to which Regulations (EU) 2017/745 (medical devices), (EU) 2017/746 (in vitro diagnostic medical devices) or (EU) 2019/2144 (motor vehicle type-approval) apply, products certified under Regulation (EU) 2018/1139, and marine equipment under Directive 2014/90/EU. Paragraph 6 concerns identical spare parts, paragraph 7 products developed or modified exclusively for national security or defence purposes and products specifically designed to process classified information. For the overall picture of roles and exclusions, see the article Cyber Resilience Act: Am I Affected?.

Deadlines and next steps

Where there is a data connection and no exclusion applies, the reporting obligation under Article 14 has applied since 11 September 2026, including for products placed on the market before 11 December 2027 (Article 69(3)). The other obligations apply from 11 December 2027 (Article 71(2)); products placed on the market before that date are then covered only if they undergo a substantial modification (Article 69(2)).

1. List all interfaces for each product and variant, including service and production access, with what the documentation provides for and what is technically possible over them.
2. Check borderline cases such as charging sockets and switching contacts against Article 2(1) and para. 28 of the draft guidance and document the reasoning.
3. Clarify core functionality and exclusions separately.

The free scope check gives a first orientation. In the CRA gap analysis we assess the scope and role of your products technically and flag open questions for review by your legal department.