Do smartcards and secure elements need a certificate under the CRA?

The category, quoted in full:

Smartcards or similar devices, including secure elements

Annex IV, point 3, Regulation (EU) 2024/2847

Similar devices carries the category well past plastic cards - SIM and eSIM modules, embedded secure elements and trusted platform modules are read against this point. On the route: absent an Article 8(1) delegated act, an Annex IV product takes the Article 32(3) procedures, the same as Class II, and a certificate becomes mandatory only when the Commission adopts one.

Frequently confused with:

• Tamper-resistant microprocessorsImportant - Class II

  Class II points 3 and 4 are parts designed for AVA_VAN level 2 or 3; a secure element is designed for at least AVA_VAN.4. The same silicon can be evaluated to either level, and the level it was designed for decides which category applies - not the product name.

• Hardware Devices with Security BoxesCritical

  Annex IV point 1 is hardware devices with security boxes. Same class and route, different point.

Obligations that apply to every product in scope, whatever its class:

• Essential requirements (Annex I) - secure by design & default
• Machine-readable SBOM
• Coordinated vulnerability disclosure policy
• Security updates across support period (~5 yrs)
• Technical documentation (Annex VII)
• Conformity assessment (route depends on class)
• CE marking + EU Declaration of Conformity
• 24h / 72h reporting to ENISA + CSIRT (from Sep 2026)

What a manufacturer is assessed against:

1. Cybersecurity risk assessment Art 13(2)
2. Secure-by-design essential requirements Annex I Pt I
3. Vulnerability-handling process Annex I Pt II
4. Software bill of materials (SBOM) Annex I Pt II §1
5. Coordinated vulnerability disclosure policy Art 13 · Annex I Pt II
6. Security updates & support period Art 13(8)
7. Technical documentation (Annex VII) Annex VII
8. Conformity assessment & EU Declaration of Conformity Art 28 · Annex V
9. CE marking Art 30
10. Vulnerability & incident reporting readiness Art 14 (from 11 Sep 2026)
11. Economic-operator & market-surveillance obligations Art 13/19–24 · Annex II

The dates that matter:

• 11 September 2026 - reporting obligations for actively exploited vulnerabilities and severe incidents apply.
• 11 December 2027 - full compliance applies.
• Market-surveillance authorities can order corrective action, withdrawal or recall, and fines reach €15 million or 2.5% of global annual turnover.