CRA compliance for IoT sensor
Critical class (Annex IV)
About CRA compliance for IoT sensor
An IoT sensor collects measurement data and transmits it over a network. Its attack surface is small but real: firmware update path, wireless communication, and any stored configuration. The CRA documentation set for a sensor is comparatively light, which makes it a fast demonstration of the motor: SBOM, a short Annex VII file, and the Annex I checklist.
What the Critical class (Annex IV) means for this product
Critical products are listed in Annex IV and are subject to the strictest conformity assessment routes under Article 47 and Annex VIII, always with third-party involvement. The technical documentation and its traceability are central because the notified body's examination and subsequent surveillance rest on them.
Where this device type sits in the Regulation
In the Regulation's own structure, a generic sensing device is NOT named in Annex III or Annex IV, so it would fall in the default class under Art. 32(1)(a) (Regulation (EU) 2024/2847), unless a specific product matches a named category for another reason. Whether THIS specific sensor is actually outside the annexes is the manufacturer's guided questionnaire answer, never an assumption of this site.
Conformity assessment
EU-type examination + conformity based on full quality assurance (Module H), notified body required
Annex III / IV structure
Annex IV (critical) (Regulation (EU) 2024/2847, Art. 47)
The Regulation's own structure names these 3 items in Annex IV:
- hardware devices with security boxes
- smart meter gateways and other advanced security purpose devices for secure cryptographic processing
- smartcards and similar devices, including secure elements
This is the Regulation's own structure (Regulation (EU) 2024/2847, Annex IV), not an assessment of any specific product. Whether a particular product falls within a named item is the manufacturer's guided questionnaire answer, never an assumption of this site.
Key obligations
- Strictest conformity assessment route under Article 47 and Annex VIII
- Notified body examination of the type and full quality assurance of production
- Annex VII technical documentation is the examination basis; traceability is mandatory
- Regular surveillance by the notified body for the certified type
Typical components to document (SBOM)
Sensor driverWireless stack (BLE / Zigbee / LoRa)Low-power MCU firmwareTLS library
Relevant Annex I requirements
I.2(e)— encrypt the transmitted measurement dataI.2(c)— a reliable, user-notified firmware update pathII.1— document components in a machine-readable SBOM
Get the compliance document set
Annex VII technical documentation, EU DoC and the Annex I checklist, generated from your product's SBOM. Leave an email and we will send it when the generator is open.