CRA compliance for Smart home gateway / hub
Important class I (Annex III)
About CRA compliance for Smart home gateway / hub
A smart home gateway aggregates a local network of connected devices, runs the firmware that brokers control commands, and often exposes a remote access surface. Because it sits between the local network and the internet, its security posture directly affects every device behind it. CRA documentation for a gateway therefore starts from the gateway's own components and update mechanism, and covers the remote-access surface explicitly.
What the Important class I (Annex III) means for this product
Important class I products are listed in Annex III. Module A (internal control) is available for them ONLY where the manufacturer fully applied harmonised standards, common specifications or a European cybersecurity certification scheme of at least substantial level (Art. 32(2)). The CRA harmonised standards are largely not yet published, so in practice most class I products cannot use Module A today and must use EU-type examination with a notified body (Module B+C) or full quality assurance (Module H). The route is established by the guided classification questionnaire, never assumed.
Where this device type sits in the Regulation
In the Regulation's own structure, 'smart home products with security functionalities, including smart home gateways, smart home hubs and smart home central points of control' are named in Annex III Class I (Regulation (EU) 2024/2847, Art. 32(2)). Whether THIS specific gateway has such security functionalities and therefore falls in that named category is the manufacturer's guided questionnaire answer, never an assumption of this site.
Conformity assessment
EU-type examination (Module B+C) or full quality assurance (Module H); Module A only with full harmonised standards / ECS scheme (Art. 32(2))
Annex III / IV structure
Annex III, Class I (Regulation (EU) 2024/2847, Art. 32(2))
The Regulation's own structure names these 19 categories in Annex III, Class I:
- identity management systems and privileged access management (PAM) software and hardware
- standalone and embedded browsers
- password managers
- software that searches for, removes or quarantines malicious software
- virtual private network (VPN) products
- network management systems
- security information and event management (SIEM) systems
- boot managers
- public key infrastructure (PKI) and digital certificate issuing software
- physical and virtual network interfaces
- operating systems
- routers, modems and switches intended for connection to the internet
- microprocessors with security-related functionalities and microcontrollers
- application-specific integrated circuits (ASIC) and field-programmable gate arrays (FPGA) with security-related functionalities
- smart home products with security functionalities, including smart home gateways, smart home hubs and smart home central points of control
- internet-connected toys
- personal wearables for health tracking and smart textiles
- internet-connected cameras, smart door locks and baby monitors
- smart speakers, smart displays and virtual assistants
This is the Regulation's own structure (Regulation (EU) 2024/2847, Annex III Class I), not an assessment of any specific product. Whether a particular product falls within a named category is the manufacturer's guided questionnaire answer, never an assumption of this site.
Key obligations
- All default-class obligations, plus the stricter documentation duties of the important class
- Verification against the review criteria of Article 7(2) and the Annex III categories
- Notification of the market surveillance authority after placing on the market where required
- Conformity assessment route confirmed during the compliance assessment, not assumed
Typical components to document (SBOM)
Zigbee / Matter stackMQTT brokerLinux kernel / RTOSWeb/control APITLS library
Relevant Annex I requirements
I.2(d)— protect the remote access surface and the local devices behind itI.2(c)— automated, user-notified security updates for the gateway firmwareI.2(e)— encrypt control traffic and stored configurationII.7— secure distribution of updates to the gateway fleet
Get the compliance document set
Annex VII technical documentation, EU DoC and the Annex I checklist, generated from your product's SBOM. Leave an email and we will send it when the generator is open.