CRA for IoT Manufacturers: Securing Connected Devices

IoT is the Primary Target of the CRA

Historically, IoT devices (webcams, smart home hubs, routers) have been plagued by hardcoded passwords and unpatchable firmware. The CRA specifically aims to end this era.

Critical Requirements for Hardware

• Secure by Default: Products must be made available with a secure by default configuration where applicable (Annex I Part I, point (2)(b)). Shipping shared default passwords is a classic failure here; unique credentials or a forced change at first use are common ways to meet it.
• Update Mechanisms: Vulnerabilities must be addressable through security updates, with mechanisms to distribute them securely and, where applicable, automatic updates enabled by default (Annex I Part I, point (2)(c); Part II, point (7)). OTA delivery is the usual way to do this.
• Guaranteed Support Windows: The support period must be at least 5 years, or the expected use time if that is shorter (Article 13(8)), and its end date (at least month and year) must be clearly stated at the time of purchase (Article 13(19)).

Classification Risks

Classification follows the device's core functionality, not where it is deployed (Article 7(1)). Smart home security products, internet-connected toys with social or location features and routers are Class I; smart meter gateways are Critical (Annex IV). Class I devices need a notified body unless harmonised standards, common specifications or certification schemes are applied in full.

Explore our comprehensive IoT module.