Answer the questions and see the reasoning.
Map the hardware, software and cloud together
A connected sensor, smart appliance or gateway can include firmware, a companion app and a supplier-operated backend. Define which functions belong to the product and which remote services meet Article 3(2).
A device need not connect directly to the public internet. Local Bluetooth, a gateway or another indirect connection can be relevant. A cloud-dependent function remains relevant even if other device functions continue offline.
IoT is not one CRA category
An ordinary smart appliance may be Default. Defined smart-home security products, internet-connected toys and certain wearable products appear in Class I. A router has a separate Class I description. The product’s actual purpose and functionality matter.
A secure chip inside a device does not automatically make the entire device Critical. Similarly, use of a connected product in a sensitive organisation is not itself an Annex IV category.
Plan support for the expected use
Manufacturers need a reasoned support period based on expected use and the statutory criteria. Durable connected hardware can reasonably be expected to remain in use beyond five years; five years is not a universal maximum.
Keep component inventories and security evidence, design a reliable update process and communicate support information clearly. Where a backend is part of the product, its maintenance and changes also need to be included in the lifecycle assessment.
Dates and next actions
Article 14 reporting for manufacturers applies from 11 September 2026, including to older in-scope products. Most requirements apply from 11 December 2027, subject to the rules for products already placed on the market and subsequent substantial modifications.
If you are the manufacturer of an in-scope product, establish the product risk assessment, support-period decision, vulnerability handling and technical documentation. Select the applicable conformity route before making a compliance claim. A reseller should use the importer and distributor assessment for its distinct duties.
Frequently asked questions
Is every smart device Important Class I?
No. Compare the product’s core functionality with the specific listed categories and implementing descriptions.
Can a hospital’s connected appliance be assumed excluded?
No. The product must meet the conditions of the relevant sectoral exclusion. Its customer or installation location alone does not establish that.