CRA compliance for Smart wearable

Important class I (Annex III)

About CRA compliance for Smart wearable

A wearable processes personal data continuously and syncs over a phone connection. That makes data minimisation and confidentiality of stored data (Annex I Part I g and e) central. The documentation set covers the device firmware and the companion-app integration it depends on.

What the Important class I (Annex III) means for this product

Important class I products are listed in Annex III. Module A (internal control) is available for them ONLY where the manufacturer fully applied harmonised standards, common specifications or a European cybersecurity certification scheme of at least substantial level (Art. 32(2)). The CRA harmonised standards are largely not yet published, so in practice most class I products cannot use Module A today and must use EU-type examination with a notified body (Module B+C) or full quality assurance (Module H). The route is established by the guided classification questionnaire, never assumed.

Where this device type sits in the Regulation

In the Regulation's own structure, 'personal wearables for health tracking and smart textiles' are named in Annex III Class I (Regulation (EU) 2024/2847, Art. 32(2)). Whether THIS specific wearable tracks health and therefore falls in that named category is the manufacturer's guided questionnaire answer, never an assumption of this site.

Conformity assessment

EU-type examination (Module B+C) or full quality assurance (Module H); Module A only with full harmonised standards / ECS scheme (Art. 32(2))

Annex III / IV structure

Annex III, Class I (Regulation (EU) 2024/2847, Art. 32(2))

The Regulation's own structure names these 19 categories in Annex III, Class I:

identity management systems and privileged access management (PAM) software and hardware
standalone and embedded browsers
password managers
software that searches for, removes or quarantines malicious software
virtual private network (VPN) products
network management systems
security information and event management (SIEM) systems
boot managers
public key infrastructure (PKI) and digital certificate issuing software
physical and virtual network interfaces
operating systems
routers, modems and switches intended for connection to the internet
microprocessors with security-related functionalities and microcontrollers
application-specific integrated circuits (ASIC) and field-programmable gate arrays (FPGA) with security-related functionalities
smart home products with security functionalities, including smart home gateways, smart home hubs and smart home central points of control
internet-connected toys
personal wearables for health tracking and smart textiles
internet-connected cameras, smart door locks and baby monitors
smart speakers, smart displays and virtual assistants

This is the Regulation's own structure (Regulation (EU) 2024/2847, Annex III Class I), not an assessment of any specific product. Whether a particular product falls within a named category is the manufacturer's guided questionnaire answer, never an assumption of this site.

Key obligations

All default-class obligations, plus the stricter documentation duties of the important class
Verification against the review criteria of Article 7(2) and the Annex III categories
Notification of the market surveillance authority after placing on the market where required
Conformity assessment route confirmed during the compliance assessment, not assumed

Typical components to document (SBOM)

RTOS firmware
BLE stack
Health sensor driver
Data-sync module
TLS library

Relevant Annex I requirements

I.2(g) — data minimisation for continuously collected personal data
I.2(e) — encrypt stored and synced health data
I.2(d) — access control on the pairing and sync channel