Short answer: smart home products with security functionalities, including smart door locks, security cameras, baby monitoring systems and alarm systems, are important products of Class I under the Cyber Resilience Act (Regulation (EU) 2024/2847, Annex III, Class I, point 17). So are the hubs and apps that control them. Self-assessment is possible only if you apply harmonised standards, common specifications or a European cybersecurity certificate in full.
What the category covers
Since 21 December 2025 the category has an official technical description in Commission Implementing Regulation (EU) 2025/2392. A product is in it when three things are true:
- It protects the physical security of consumers.
- It does so in a residential setting.
- It can be controlled or managed remotely from other systems.
The examples given are smart door locking devices, baby monitoring systems, alarm systems and home security cameras. They are illustrative, not exhaustive (recital 7). The CRA explains why consumer products like these are in Annex III: they perform a function that carries a significant risk of adverse effects on the health, security or safety of their users (recital 10).
The hub, the app and the cloud are in too
The description goes beyond the devices. It also covers the hardware and software that centrally control such products: the alarm control panel, the home security hub, a recorder that manages the cameras, and the app from which the user arms the alarm or opens the lock. If you sell the app or the hub separately, it is a Class I product in its own right.
The cloud backend belongs to the product as well. Recital 12 of the CRA uses smart home devices as its example of a remote data processing solution: the cloud functionality that lets the user control the device at a distance is in scope and has to meet the same requirements.
Is your product Class I, Class II or default?
Classify it in Regulus by its core function, with the exact Annex III or IV reference. The requirements, risk assessment and technical file follow from the answer. Free for manufacturers.
What does not make a product Class I
"Smart home" is not a category on its own. A connected product for the home is classified by its core functionality (Article 7(1)), and most of them are default products:
| Product | Category | Why |
|---|---|---|
| Smart thermostat, smart bulb, smart plug, connected appliance | None, default | Does not protect the physical security of consumers |
| Webcam, camera on a robot vacuum, pet camera not sold for home security | None, default | A camera is in point 17 because it is a home security camera, not because it records |
| Camera system sold for offices, shops or warehouses | Not point 17 | Not for consumers in a residential setting |
| Lock or keypad with no data connection at all | Outside the CRA | The CRA only applies to products with a data connection to a device or network (Article 2(1)) |
| Smart speaker with a voice assistant | Point 16, Class I | Smart home general purpose virtual assistants are a separate Class I category |
| Access control reader for a building | Point 1, Class I | Access management systems for physical locations sit in identity management |
Integrating a security-looking component does not change the result either. A doorbell with a camera, a smoke alarm or a garage door opener has to be assessed on what it is for, and that reasoning belongs in the technical documentation. Baby monitors that track breathing or heart rate deserve the same care: depending on their intended purpose they can fall under the medical device rules, which are excluded from the CRA, or, if worn by the baby, be wearables with a health monitoring purpose (point 19), also Class I.
What Class I means for conformity assessment
Under Article 32(2), a Class I product can follow internal control (module A) only where the manufacturer applies in full harmonised standards, common specifications or a European cybersecurity certification scheme at assurance level at least "substantial". If they are not applied, are applied only in part, or do not exist, a notified body is needed, through EU-type examination (module B) followed by conformity to type (module C) or full quality assurance (module H).
Before planning on self-assessment, check whether the harmonised standards you intend to use have been cited in the Official Journal. The essential requirements of Annex I are the same for every class; the class only changes who checks them. Our guides to Class I and Class II and to conformity assessment cover the modules. Most of these products also use Wi-Fi, Bluetooth or Zigbee, so the cybersecurity rules of the Radio Equipment Directive can apply to them as well (CRA vs RED).
Dates that matter for smart home security manufacturers
- 11 June 2026: the rules on notified bodies started to apply.
- 11 September 2026: the reporting obligations of Article 14 apply, including to locks, cameras and alarms already on the market. An actively exploited vulnerability has to be notified within 24 hours.
- 11 December 2027: the essential requirements and the conformity assessment apply to every product placed on the market from that day.
Whatever the route, write the classification down for the whole system: each device, the hub, the app and the cloud service, with the technical description each one meets.
Frequently asked questions
Is the companion app of a smart lock or alarm also Class I?
Yes, when it centrally controls the security product. The technical description in Implementing Regulation (EU) 2025/2392 includes the hardware and software that centrally control smart home products with security functionalities, such as an alarm hub or the app that manages the locks and cameras.
Is a smart thermostat or a smart bulb Class I under the CRA?
No. They do not protect the physical security of consumers, so they do not meet the description of Annex III, Class I, point 17. Unless another category applies, they are default products that can be self-assessed.
Are professional CCTV cameras for offices in this category?
Not under point 17. The description covers products that protect consumers in a residential setting. A camera sold for business premises is classified by its own core function and is often a default product. A camera sold for homes, even if businesses also buy it, falls in point 17.
Is a smart lock for office buildings Class I?
Usually yes, but through a different category. Access management systems that control access to physical locations, including access control and biometric readers, are Class I under point 1 (identity management systems). The conformity route is the same.
Does the cloud service behind my security camera fall under the CRA?
Yes, if it is a remote data processing solution of the product. Recital 12 of the CRA gives this example: cloud functionalities that let users control a smart home device at a distance are in scope, and they are assessed as part of the product.
Is your product Class I, Class II or default?
Classify it in Regulus by its core function, with the exact Annex III or IV reference. The requirements, risk assessment and technical file follow from the answer. Free for manufacturers.
