Does the CRA apply to IoT devices?
Likely yes
Likely yes. Connected hardware with embedded software is the paradigm product with digital elements, and it is in scope once placed on the EU market commercially, unless a listed sectoral exclusion applies [[F-005]] [[F-010]].
The deciding factors
| Factor | If true | If false | Source |
|---|---|---|---|
| Made available on the EU market | Scope questions continue | Likely out of scope | F-101 |
| Supplied in the course of a commercial activity | Scope questions continue | Likely out of scope (or the open-source light regime) | F-007 |
| Has a direct or indirect connection to a device or network | It is a product with digital elements | Likely out of scope | F-005 |
| Covered by a listed sectoral exclusion | Likely out of scope | Scope questions continue | F-010 |
Check your own product
Start the short scope check with the product type pre-selected. Every legally material fact — EU availability, commercial activity, exclusions, your role — is asked, never assumed.
Example scenarios
-
Wi-Fi environmental sensor sold to EU businesses
Likely in scope · role: _
Connected hardware with embedded firmware, sold in the EU: a product with digital elements in scope.
Deciding fact: Art. 3(1), Art. 2(1)
-
Device useless without your cloud service
Likely in scope · role: _
The device is in scope; where it cannot perform a function without your own backend, that remote processing is part of the product as well.
Deciding fact: Art. 3(1), Art. 2(1)
-
Connected glucose monitor certified as a medical device
Likely out of scope · role: _
Medical devices are excluded from this Regulation and follow Regulation (EU) 2017/745 instead.
Deciding fact: Art. 2(2)–(4), (6)–(7)
-
Device with no wired or wireless interface at all
Likely out of scope · role: _
Without a direct or indirect connection to a device or network it is not a product with digital elements.
Deciding fact: Art. 3(1), Art. 2(1)
Each scenario is a fixture: the shared CEMarque rules engine evaluates its inputs at build time and the page cannot be served if the outcome shown here differs from the engine's.
Edge cases
- _
- _
- _
- _
Why
Hardware with software is the core case
The Regulation defines a product with digital elements as a software or hardware product, including its remote data processing solutions, with a direct or indirect connection to a device or network [1]. A device with firmware and a radio or a port is exactly that. It is in scope when made available on the EU market in the course of a commercial activity [2] [3].
Exclusions are sectoral, not technical
Products already regulated by the medical devices and in vitro diagnostics regulations, type-approved motor-vehicle products, and certain aviation, marine, defence, national-security and spare-part cases are excluded [4]. The exclusion follows the product's regulatory home, not its technology: a certified medical device is excluded, while a sensor module sold for building automation is not [4]. A component sold separately to a medical-device maker is a harder case for the full check on CEMarque.
Cloud-dependent devices
Where a device is designed to depend on your own remote data processing, and cannot perform a function without it, that remote processing is part of the product with digital elements [5] [6]. The device and its backend then form one product for the Regulation's purposes.
Timing
The Regulation applies in full from 11 December 2027, so hardware first placed on the market from that date must meet it from day one [7]. Run the check with your launch date for both clocks.
Timing
Article 14 reporting applies from 2026-09-11; full requirements and CE marking apply from 2027-12-11. Dates come from the Facts Table entries cited below, evaluated for the first example; run the check for your own product's dates.
What to do next
CRARequired only answers applicability. CEMarque carries your answers forward and adds your role, class, conformity route, dates, obligations, and a permanent cited verdict.
Check my product Run the full cited determination on CEMarque
Related applicability questions
Sources
- F-005 A product with digital elements is a software or hardware product and its remote data processing solutions, including components placed on the market separately, whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. Art. 3(1), Art. 2(1) EUR-Lex ↩
- F-007 The Regulation applies to products made available on the market in the course of a commercial activity; charging a price, charging for support, monetising via advertising or data, or otherwise intending to monetise are commercial activity. Art. 2(1), Art. 3(22), Recitals EUR-Lex ↩
- F-101 Made available on the market means supply for distribution or use on the EU market in the course of a commercial activity. Art. 3(22) EUR-Lex ↩
- F-010 Excluded: medical devices (Regulation (EU) 2017/745) and in vitro diagnostics (2017/746) and motor-vehicle type-approved products (2019/2144) (Art. 2(2)); civil aviation products certified under Regulation (EU) 2018/1139 (Art. 2(3)); marine equipment under Directive 2014/90/EU (Art. 2(4)); spare parts made to identical specifications (Art. 2(6)); products developed or modified exclusively for national security or defence, or designed exclusively to process classified information (Art. 2(7)). Art. 2(2)–(4), (6)–(7) EUR-Lex ↩
- F-006 Remote data processing means data processing at a distance for which the software is designed and developed by the manufacturer, or under the responsibility of the manufacturer, and the absence of which would prevent the product from performing one of its functions. Art. 3(2) EUR-Lex ↩
- F-107 Where a product depends on your own remote data processing (a backend or API without which it cannot perform one of its functions), that remote processing is part of the product: it is covered by the essential requirements, the technical documentation and market surveillance alongside the client software or device. Art. 3(1)–(2), Annex I, Annex VII EUR-Lex ↩
- F-003 The Regulation applies in full from 11 December 2027. Art. 71(2) EUR-Lex ↩
CRARequired answers applicability only, using scope logic and cited regulatory facts maintained by CEMarque, which encodes Regulation (EU) 2024/2847 and published guidance as of Facts v2026.09.4 (10 September 2026). Results are "likely" or "conditional" readings of your answers, not a legal opinion and not a conformity assessment. Run the full cited determination on CEMarque before you act. Methodology.