CRA compliance for IoT sensor

Important class I (Annex III)

About CRA compliance for IoT sensor

An IoT sensor collects measurement data and transmits it over a network. Its attack surface is small but real: firmware update path, wireless communication, and any stored configuration. The CRA documentation set for a sensor is comparatively light, which makes it a fast demonstration of the motor: SBOM, a short Annex VII file, and the Annex I checklist.

What the Important class I (Annex III) means for this product

Important class I products are listed in Annex III. Module A (internal control) is available for them ONLY where the manufacturer fully applied harmonised standards, common specifications or a European cybersecurity certification scheme of at least substantial level (Art. 32(2)). The CRA harmonised standards are largely not yet published, so in practice most class I products cannot use Module A today and must use EU-type examination with a notified body (Module B+C) or full quality assurance (Module H). The route is established by the guided classification questionnaire, never assumed.

Where this device type sits in the Regulation

In the Regulation's own structure, a generic sensing device is NOT named in Annex III or Annex IV, so it would fall in the default class under Art. 32(1)(a) (Regulation (EU) 2024/2847), unless a specific product matches a named category for another reason. Whether THIS specific sensor is actually outside the annexes is the manufacturer's guided questionnaire answer, never an assumption of this site.

Conformity assessment

EU-type examination (Module B+C) or full quality assurance (Module H); Module A only with full harmonised standards / ECS scheme (Art. 32(2))

Annex III / IV structure

Annex III, Class I (Regulation (EU) 2024/2847, Art. 32(2))

The Regulation's own structure names these 19 categories in Annex III, Class I:

identity management systems and privileged access management (PAM) software and hardware
standalone and embedded browsers
password managers
software that searches for, removes or quarantines malicious software
virtual private network (VPN) products
network management systems
security information and event management (SIEM) systems
boot managers
public key infrastructure (PKI) and digital certificate issuing software
physical and virtual network interfaces
operating systems
routers, modems and switches intended for connection to the internet
microprocessors with security-related functionalities and microcontrollers
application-specific integrated circuits (ASIC) and field-programmable gate arrays (FPGA) with security-related functionalities
smart home products with security functionalities, including smart home gateways, smart home hubs and smart home central points of control
internet-connected toys
personal wearables for health tracking and smart textiles
internet-connected cameras, smart door locks and baby monitors
smart speakers, smart displays and virtual assistants

This is the Regulation's own structure (Regulation (EU) 2024/2847, Annex III Class I), not an assessment of any specific product. Whether a particular product falls within a named category is the manufacturer's guided questionnaire answer, never an assumption of this site.

Key obligations

All default-class obligations, plus the stricter documentation duties of the important class
Verification against the review criteria of Article 7(2) and the Annex III categories
Notification of the market surveillance authority after placing on the market where required
Conformity assessment route confirmed during the compliance assessment, not assumed

Typical components to document (SBOM)

Sensor driver
Wireless stack (BLE / Zigbee / LoRa)
Low-power MCU firmware
TLS library

Relevant Annex I requirements

I.2(e) — encrypt the transmitted measurement data
I.2(c) — a reliable, user-notified firmware update path
II.1 — document components in a machine-readable SBOM