Short answer: an internet connected toy is an important product of Class I under the Cyber Resilience Act (Regulation (EU) 2024/2847, Annex III, Class I, point 18) when it has social interactive features, such as speaking or filming, or location tracking features. A connected toy without either is a default product and can be self-assessed. Children's wearables are a separate Class I category right next door.
What point 18 covers
Since 21 December 2025 the categories of Annexes III and IV have an official technical description in Commission Implementing Regulation (EU) 2025/2392. For connected toys, three conditions have to be met at the same time:
- It is a toy covered by Directive 2009/48/EC on the safety of toys. That directive defines toys as products designed or intended, whether or not exclusively, for use in play by children under 14. A gadget aimed at adults is not in point 18, whatever it does.
- It communicates on the public internet, directly or via any other equipment. A toy that reaches the internet through a smartphone, a tablet or a home hub counts.
- It has social interactive features or location tracking. Social interactive means embedded technologies that enable inbound and outbound communication, with a keyboard, microphone, speaker or camera given as examples. Location tracking means technologies that enable tracking or inferring the geographical location of the toy or its user.
One exclusion matters to many designers: a toy that merely detects the proximity of the user or of other toys by using sensing technologies does not have location tracking features.
Class I or default: typical cases
| Toy | Class | Why |
|---|---|---|
| Talking doll or robot that listens through a microphone and answers using an online service | Class I | Internet connected, with social interactive features (point 18) |
| Toy with a camera that films or streams to an app | Class I | Filming is a social interactive feature (point 18) |
| Toy with GPS, or that infers its location from the network it uses | Class I | Location tracking (point 18) |
| Remote-controlled car driven from a phone app, no microphone, camera or location | Default | Connected, but none of the features of point 18 |
| Figures that react when another figure is close | Default | Proximity detection is not location tracking |
| Smartwatch or tracker designed for children under 14 | Class I | Wearable intended for children (point 19) |
Borderline designs need a written reason. A toy that only plays content through a speaker and takes no input from the child is the most common one: the description speaks of inbound and outbound communication, so the reasoning should say which the toy does and why.
Is your product Class I, Class II or default?
Classify it in Regulus by its core function, with the exact Annex III or IV reference. The requirements, risk assessment and technical file follow from the answer. Free for manufacturers.
The neighbour category: wearables for children
Point 19 of the same annex covers personal wearable products intended for use by and for children, defined by the implementing regulation as individuals under the age of 14, and it names child safety wearables as an example. Unlike point 18, it requires no internet connection and no particular feature: being worn by a child is enough. Baby monitors are a different category again: smart home products with security functionalities (point 17), also Class I.
Toy safety rules do not replace the CRA
Toys are not among the sector exclusions of Article 2. On the contrary, recital 10 names toys as products intended for vulnerable consumers and lists connected toys among those that need a stricter conformity assessment.
The CRA also covers the toy's remote data processing: the cloud service it needs to perform one of its functions is part of the product (Article 3(2)), so the voice service behind a talking doll is assessed with the doll. And if the toy has a radio, such as Wi-Fi or Bluetooth, the cybersecurity requirements under the Radio Equipment Directive already apply today. How the two regimes fit is explained in CRA vs RED cybersecurity requirements.
What Class I means for a toy manufacturer
- Default: self-assessment under internal control (module A).
- Class I: self-assessment only if harmonised standards, common specifications or a European cybersecurity certificate at assurance level at least "substantial" cover the essential requirements in full. Otherwise EU-type examination by a notified body (modules B and C) or full quality assurance (module H), as set out in Article 32(2).
The differences between the classes are covered in Annex III Class I vs Class II, and the procedures in CRA conformity assessment. The dates are the same for every toy: the reporting obligations of Article 14 apply since 11 September 2026, including to toys already on the market, and the essential requirements and the conformity assessment apply from 11 December 2027.
Whatever the result, write the reasoning down in the technical documentation: which features the toy has, how it reaches the internet, and the technical description it does or does not meet.
Frequently asked questions
Is a Bluetooth toy controlled from a smartphone app Class I?
Only if it meets the description of Annex III, Class I, point 18: it has to communicate on the public internet, directly or via other equipment such as the phone, and have social interactive features (for example a microphone, speaker or camera used to communicate) or location tracking. A toy that the app simply drives, with no communication or location function, is a default product.
Does a toy that detects other toys nearby have location tracking?
No. Implementing Regulation (EU) 2025/2392 says that a toy which merely detects the proximity of the user or of other toys by using sensing technologies is not to be considered to have location tracking features.
Is a children's smartwatch a connected toy under the CRA?
It does not need to be. Personal wearable products intended for use by and for children under 14 are Class I in their own right (Annex III, Class I, point 19), and Implementing Regulation (EU) 2025/2392 names child safety wearables as an example. The class and the conformity assessment are the same as for point 18.
Does complying with the Toy Safety Directive cover cybersecurity?
No. Toys are not among the exclusions of Article 2 of the CRA, and recital 10 names toys as consumer products intended for vulnerable consumers. A connected toy has to meet both sets of rules.
Can I self-assess a Class I connected toy?
Only if you apply harmonised standards, common specifications or a European cybersecurity certification scheme at assurance level at least substantial covering all the essential requirements. Otherwise a notified body has to be involved (Article 32(2)).
Is your product Class I, Class II or default?
Classify it in Regulus by its core function, with the exact Annex III or IV reference. The requirements, risk assessment and technical file follow from the answer. Free for manufacturers.
