Are Smart Meter Gateways Critical Products Under the CRA?

Short answer: smart meter gateways within smart metering systems are critical products under the Cyber Resilience Act (Regulation (EU) 2024/2847, Annex IV, point 2). It is one of only three critical categories, and it rules out self-assessment: the gateway needs a European cybersecurity certificate or a notified body before it can carry the CE marking.

What counts as a smart meter gateway

Annex IV refers to smart metering systems as defined in Article 2(23) of Directive (EU) 2019/944, the electricity market directive. Since 21 December 2025 the category also has an official technical description in Commission Implementing Regulation (EU) 2025/2392 (Annex II, point 2). A smart meter gateway:

• controls communication between components in or connected to the smart metering system and authorised third parties, such as utility providers;
• collects, processes and stores meter data or personal data;
• protects data and information flows with cryptography, such as encryption and decryption;
• incorporates firewalling functionalities;
• and provides the means to control other devices.

A gateway that does all of this has firewalling built in, but it is not a Class II firewall. Its core functionality is that of a smart meter gateway, and that is the category that applies.

Electricity first, gas and heat if the description fits

The category includes gateways in smart metering systems measuring electricity. The implementing regulation adds that it may also include gateways in smart metering systems for other sources of energy, such as gas or heat, provided the gateway meets the description. A gas or district heating gateway is therefore assessed against the same five characteristics, not excluded because it is not electrical.

Water is not a source of energy. Our reading is that a gateway serving only water metering does not fit this extension and is classified by its own core function. The examples in the regulation are illustrative, not exhaustive (recital 7), so record the reasoning in the technical documentation.

What is not a smart meter gateway

The CRA classifies a product by its core functionality (Article 8(1) and recital 2 of the implementing regulation). Several devices around a metering system do not meet the description:

• A meter without gateway functions. A meter that measures and sends its readings through a separate gateway does not control third-party communication. It is usually a default product.
• A generic data concentrator or logger. Concentrators are not named in the description. One that only collects and forwards readings, without managing third-party access, firewalling or controlling devices, is classified by what it does. If its core function is a cellular modem or a router, that is Class I (Annex III, Class I, point 12); otherwise it is usually default. See how to classify an IoT gateway.
• Displays and apps that show consumption to the household without controlling the communication flows.

Meters with an integrated communication module are the grey zone. Integrating a component that meets a category description does not in itself make the host product subject to that category (recital 3). But when one device performs every function the description lists, it is hard to argue that its core function is only metering.

Annex IV, point 2, also mentions "other devices for advanced security purposes, including for secure cryptoprocessing". The implementing regulation gives no separate description for them. Hardware security modules are named under point 1, hardware devices with security boxes, and secure elements, including TPMs, under point 3.

What critical means for conformity assessment

Article 32(4) gives critical products two possible routes:

• A European cybersecurity certificate, at assurance level at least "substantial", where the Commission has required one by delegated act under Article 8(1). That requires an adopted certification scheme covering the category and, as a rule, a transitional period of at least six months.
• Where no such act applies, the Class II procedures of Article 32(3): EU-type examination by a notified body followed by conformity to type (modules B and C), full quality assurance (module H), or a European cybersecurity certificate at assurance level at least "substantial" where an applicable scheme is available.

Either way there is no self-assessment. The procedures are explained in CRA conformity assessment, and the difference with important products in Class I vs Class II.

Dates that matter for gateway manufacturers

• 11 June 2026: the rules on notified bodies started to apply.
• 11 September 2026: the reporting obligations of Article 14 apply, including to gateways already installed. An actively exploited vulnerability has to be notified within 24 hours.
• 11 December 2027: the essential requirements and the conformity assessment apply to every gateway placed on the market from that day.

A gateway that is critical will spend time with a third party before that date. A complete technical file, with the risk assessment, the evidence for each essential requirement and a written classification that quotes the technical description, is what the assessor will ask for first.

Frequently asked questions

Is a smart electricity meter a critical product under the CRA?

Not as such. Annex IV, point 2, covers the smart meter gateway, the device that controls communication between the smart metering system and authorised third parties. A meter that only measures and passes its readings on is classified by its own core function, usually the default category. A device that performs the gateway functions itself has to be checked against the technical description.

Are gas and heat meter gateways critical too?

They can be. Implementing Regulation (EU) 2025/2392 says the category may also include gateways used in smart metering systems for other sources of energy, such as gas or heat, provided the gateway meets the description.

Is a water meter gateway covered?

The extension in Implementing Regulation (EU) 2025/2392 refers to other sources of energy, and water is not one. Our reading is that a gateway serving only water metering falls outside this category and is classified by its own core function. A multi-utility gateway that also serves electricity, gas or heat metering is a different case.

Can a smart meter gateway be self-assessed?

No. Critical products follow Article 32(4): a European cybersecurity certificate where a delegated act under Article 8(1) requires one, and otherwise the Class II procedures of Article 32(3), all of which involve a notified body or a certificate.

Is a data concentrator a smart meter gateway?

Not automatically. Data concentrators are not named in the technical description. A device that only collects and forwards readings, without controlling third-party access, firewalling or controlling other devices, does not match the description and is classified by its own core function. The closer it comes to doing everything the description lists, the stronger the case that it is a gateway.