Short answer: under the Cyber Resilience Act (Regulation (EU) 2024/2847), two kinds of wearable are important products of Class I (Annex III, Class I, point 19): wearables with a health monitoring purpose that are not medical devices, and wearables intended for children. A fitness tracker, a smartwatch with health sensors and a kids' GPS watch are all Class I. A wearable regulated as a medical device is outside the CRA.
What counts as a health monitoring wearable
Since 21 December 2025 the category has an official technical description in Commission Implementing Regulation (EU) 2025/2392. A health monitoring wearable is a product that:
- is worn on the body, directly or via clothing or accessories;
- can, regularly or continuously, sense and further process information, including body metrics, relevant to the user's health;
- does not fall within the scope of the Medical Devices Regulation (EU) 2017/745 or the In Vitro Diagnostic Regulation (EU) 2017/746.
The examples are fitness trackers, smartwatches, smart jewellery, smart clothing and sports apparel that meet the description. They are illustrative, not exhaustive (recital 7). A smart ring that tracks sleep and heart rate fits; so do earbuds that measure heart rate. Earbuds that only play audio do not.
Wearables for children: no health purpose needed
The second half of point 19 does not depend on health at all. Any wearable intended for use by and for individuals under the age of 14 is Class I, and the description names child safety wearables, the GPS watches with calling and SOS functions sold to parents. A wearable aimed at teenagers of 14 and over is not caught by this half, but can still be Class I through health monitoring.
Is your product Class I, Class II or default?
Classify it in Regulus by its core function, with the exact Annex III or IV reference. The requirements, risk assessment and technical file follow from the answer. Free for manufacturers.
Medical devices are outside the CRA
The CRA does not apply to products covered by the Medical Devices Regulation or the In Vitro Diagnostic Regulation (Article 2(2), points (a) and (b)), because those regulations already set cybersecurity requirements (recital 25). Point 19 repeats the exclusion. So the first question for a health wearable is whether it is placed on the market as a medical device.
The exclusion follows the product, not the company. A manufacturer of certified medical wearables that also sells a consumer wellness band has that band inside the CRA, and in Class I.
The grey areas
| Product | Class | Why |
|---|---|---|
| Fitness tracker or smartwatch measuring heart rate, sleep or activity | Class I | The textbook example of point 19 |
| Children's GPS or SOS watch | Class I | Intended for children under 14 |
| Smartwatch with no health sensing, not aimed at children | Default, unless another category applies | Neither half of point 19 is met |
| Fall detection pendant that senses nothing else | Arguably default | See below |
| Wearable certified as a medical device | Outside the CRA | Article 2(2) |
| Wristband with an integrated payment secure element | Critical | Named under smartcards and similar devices (Annex IV, point 3) |
Fall detection is the hardest case. A pendant or watch that detects a fall and raises an alarm senses movement, not body metrics, and it is defensible to read that as a safety function rather than health monitoring, which would leave it outside point 19. That is our interpretation, not a settled answer, and it should be argued in the technical documentation. It stops holding as soon as the device also measures heart rate or similar metrics, is intended for children, or is placed on the market as a medical device.
The app and the cloud are part of the product
A wearable rarely works alone. The backend that processes its data is part of the product when the wearable cannot perform one of its functions without it (Article 3(2)), so it falls under the same essential requirements. More in remote data processing solutions under the CRA.
Most wearables also carry Bluetooth, Wi-Fi or a cellular modem, and the cybersecurity requirements of the Radio Equipment Directive have applied to radio equipment since 1 August 2025. The CRA's essential requirements include all the elements of those radio requirements (recital 30). See CRA vs RED cybersecurity requirements.
What Class I means for a wearable maker
Self-assessment is available only if harmonised standards, common specifications or a European cybersecurity certificate at assurance level at least "substantial" cover the essential requirements in full. Otherwise a notified body has to be involved, through EU-type examination followed by conformity to type, or full quality assurance (Article 32(2)). The reporting obligations of Article 14 have applied since 11 September 2026, including to wearables already on the market, and the full requirements apply from 11 December 2027.
More on the two classes in Annex III Class I vs Class II and on the routes in CRA conformity assessment. If you are not sure which side of the line your product sits on, the CRA Scope Wizard walks through it.
Frequently asked questions
Is a fitness tracker or smartwatch Class I under the CRA?
Yes, if it senses and processes information relevant to the user's health, such as heart rate, sleep or activity. Implementing Regulation (EU) 2025/2392 names fitness trackers, smartwatches, smart jewellery, smart clothing and sports apparel as examples of Annex III, Class I, point 19, provided they meet the description.
Is a children's GPS watch Class I?
Yes. Wearables intended for use by and for children are Class I whether or not they monitor health. Implementing Regulation (EU) 2025/2392 defines children as individuals under the age of 14 and names child safety wearables as an example.
Does the CRA apply to a wearable that is a medical device?
No. Products to which the Medical Devices Regulation (EU) 2017/745 or the In Vitro Diagnostic Regulation (EU) 2017/746 apply are excluded from the CRA (Article 2(2)), and point 19 itself excludes them. The exclusion follows the product, not the company: a consumer wellness band sold by a medical device maker is inside the CRA.
Is a fall detection pendant a health monitoring wearable?
It is not settled. Detecting a fall is arguably a safety function rather than monitoring of health information, which would leave a device that senses nothing else outside point 19. That is an interpretation, not a certainty. If the device also measures heart rate or similar metrics, or is intended for children under 14, it is Class I.
Can I self-assess a Class I wearable?
Only if you apply harmonised standards, common specifications or a European cybersecurity certificate at assurance level at least substantial that cover the essential requirements in full. Otherwise a notified body has to be involved, through EU-type examination or full quality assurance (Article 32(2)).
Is your product Class I, Class II or default?
Classify it in Regulus by its core function, with the exact Annex III or IV reference. The requirements, risk assessment and technical file follow from the answer. Free for manufacturers.
