CRASPACE
Scanning · scope · class · risk
CRASPACE
30 min with a CRA specialist - your classification confirmed against real specs, your open questions closed. Free, no obligation.Rulebook v0.5.1Full compliance 11 Dec 2027
Annex IV, point 2

Is a smart meter gateway a critical product under the CRA?

Yes, as a critical product. Annex IV point 2 covers smart meter gateways within smart metering systems as defined in Directive (EU) 2019/944, and other devices for advanced security purposes including secure cryptoprocessing.

ClassCritical
What that class requiresArt 32(3) procedures (as Class II) - plus an EU cybersecurity certificate at assurance ≥ substantial IF the Commission adopts a delegated act under Art 8(1) for the category

The category, quoted in full:

Smart meter gateways within smart metering systems as defined in Article 2, point (23), of Directive (EU) 2019/944 of the European Parliament and of the Council and other devices for advanced security purposes, including for secure cryptoprocessing

Annex IV, point 2, Regulation (EU) 2024/2847

The category has a second half that is easy to miss: other devices for advanced security purposes, including for secure cryptoprocessing. That reaches beyond metering. On the route, critical does not currently mean a certificate: absent an Article 8(1) delegated act, an Annex IV product takes the Article 32(3) procedures, the same as Class II.

Frequently confused with:

A worked example:

Smart-meter gateway vendorSmart-meter gateways are Annex IV Critical products: notified body plus, potentially, a mandatory EU cybersecurity certificate. Who can and cannot help.

Obligations that apply to every product in scope, whatever its class:

  • Essential requirements (Annex I) - secure by design & default
  • Machine-readable SBOM
  • Coordinated vulnerability disclosure policy
  • Security updates across support period (~5 yrs)
  • Technical documentation (Annex VII)
  • Conformity assessment (route depends on class)
  • CE marking + EU Declaration of Conformity
  • 24h / 72h reporting to ENISA + CSIRT (from Sep 2026)

What a manufacturer is assessed against:

  1. Cybersecurity risk assessment Art 13(2)
  2. Secure-by-design essential requirements Annex I Pt I
  3. Vulnerability-handling process Annex I Pt II
  4. Software bill of materials (SBOM) Annex I Pt II §1
  5. Coordinated vulnerability disclosure policy Art 13 · Annex I Pt II
  6. Security updates & support period Art 13(8)
  7. Technical documentation (Annex VII) Annex VII
  8. Conformity assessment & EU Declaration of Conformity Art 28 · Annex V
  9. CE marking Art 30
  10. Vulnerability & incident reporting readiness Art 14 (from 11 Sep 2026)
  11. Economic-operator & market-surveillance obligations Art 13/19–24 · Annex II

The dates that matter:

  • 11 September 2026 - reporting obligations for actively exploited vulnerabilities and severe incidents apply.
  • 11 December 2027 - full compliance applies.
  • Market-surveillance authorities can order corrective action, withdrawal or recall, and fines reach €15 million or 2.5% of global annual turnover.

Check your own products against this

The same rulebook that produced this page runs the free check. It reads your products, classifies each one against Annex III and IV, and gives you an indicative verdict with the reasoning and citation for every product.

All categories
Smart-home security devicesAnnex III Class I point 17 covers smart home products with security functionalities, naming smart door locks, security cameras, baby monitors and alarms.Product classificationWhich class each Annex III and IV category falls in, quoted from the regulation, with the conformity route it carries and the categories it is most often confused with.MethodologyThe versioned methodology behind every verdict: the six-step scoping flow, the four product classes, the eleven readiness checkpoints, and the Article each rests on.

Indicative assessment - not legal advice and not a conformity assessment.