IoT sensor

Network-connected sensing device (temperature, motion, air quality) reporting to a gateway or cloud.

An IoT sensor collects measurement data and transmits it over a network. Its attack surface is small but real: firmware update path, wireless communication, and any stored configuration. The CRA documentation set for a sensor is comparatively light, which makes it a fast demonstration of the motor: SBOM, a short Annex VII file, and the Annex I checklist.

Where this device type sits in the Regulation

In the Regulation's own structure, a generic sensing device is NOT named in Annex III or Annex IV, so it would fall in the default class under Art. 32(1)(a) (Regulation (EU) 2024/2847), unless a specific product matches a named category for another reason. Whether THIS specific sensor is actually outside the annexes is the manufacturer's guided questionnaire answer, never an assumption of this site.

CRA importance classes for this product type

All other products (default class) Important class I (Annex III) Important class II (Annex III) Critical class (Annex IV)

Typical components

• Sensor driver
• Wireless stack (BLE / Zigbee / LoRa)
• Low-power MCU firmware
• TLS library

Most relevant Annex I requirements

• I.2(e) — encrypt the transmitted measurement data
• I.2(c) — a reliable, user-notified firmware update path
• II.1 — document components in a machine-readable SBOM

Examples

• Temperature / humidity sensor
• Motion detector
• Air quality monitor