Product class
Is a smart meter gateway or network interface an important or critical product under the CRA?
Short answer: It depends on the function. A smart meter gateway or network interface can fall under Annex III, Class I (item 10), or under Annex IV (item 2). The entry that matches what the product does decides the class.
“Physical and virtual network interfaces”
“Smart meter gateways within smart metering systems as defined in Article 2, point (23) of Directive (EU) 2019/944 of the European Parliament and of the Council (1) and other devices for advanced security purposes, including for secure cryptoprocessing”
Technical description
Commission Implementing Regulation (EU) 2025/2392 gives the technical description of each category in the annexes. It says what the category covers, in the Official Journal's words.
“Physical network interfaces are products with digital elements that directly connect a device to a network via an application programming interface (API) provided by the interface drivers, typically operating at the data link layer, and that feature hardware adapters to transmission media with corresponding firmware, typically operating at the physical and data link layer.
Virtual network interfaces are products with digital elements that directly or indirectly connect a device to a network via an API that emulates that of drivers of physical network interfaces, typically operating at the data link layer.
This category includes but is not limited to wired and wireless network interface cards, controllers and adapters, such as for Wi-Fi, Ethernet, IrDA, USB, Bluetooth, NearLink, Zigbee, or Fieldbus, as well as purely virtual standalone products, such as virtual network interface cards, container network interfaces and VPN interfaces.”
“Smart meter gateways are products with digital elements that control communication between components in or connected to smart metering systems as defined in Article 2(23) of Directive (EU) 2019/944, and authorised third parties, such as utility providers. Smart meter gateways collect, process and store meter or personal data, protect data and information flows by supporting specific cryptographic needs, such as encryption and decryption of data, incorporate firewalling functionalities and provide the means to control other devices.
This category includes but is not limited to smart meter gateways related to smart metering systems measuring electricity as defined in Article 2(23) of Directive (EU) 2019/944. It may also include smart meter gateways used in other smart metering systems measuring consumption of other sources of energy such as gas or heat, provided that the gateway meets this description.”
What this means for the conformity route
Annex III, Class I. Article 32(2) caveat: self-assessment via internal control remains available only if you apply in full harmonised standards, common specifications or European cybersecurity certification schemes at assurance level at least 'substantial'; where you apply them only in part or not at all, or none exist, EU-type examination followed by production control (module B+C) or full quality assurance (module H) applies.
The wording of Article 32(2) is quoted in the product classes guide.
Annex IV. Annex IV entries follow Article 32(4).
The wording of Article 32(4) is quoted in the product classes guide.
When it applies
Since 11 June 2026, the rules on notified conformity assessment bodies, Chapter IV (Articles 35 to 51), have applied. The reporting duties of Article 14 have applied since 11 September 2026. The CRA will apply in full from 11 December 2027. The wording of the application clause is quoted in the product classes guide.
Edge cases
- Free and open-source software. Article 32(5) has its own rule for Annex III products. The wording of Article 32(5) is quoted in the product classes guide.
- Annex IV entries. A product that matches an entry in Annex IV (item 2) follows the Annex IV route, not the Annex III, Class I route.
- The core functionality decides. Check your product's core functionality against the annex text quoted above. The wording of Article 7(1) is quoted in the product classes guide.
Questions and answers
Where does a smart meter gateway or network interface sit in the CRA annexes?
See the short answer and the annex quote at the top of this page.
Does a smart meter gateway or network interface need a notified body?
It depends on the entry. For Annex III, Class I entries: Article 32(2) caveat: self-assessment via internal control remains available only if you apply in full harmonised standards, common specifications or European cybersecurity certification schemes at assurance level at least 'substantial'; where you apply them only in part or not at all, or none exist, EU-type examination followed by production control (module B+C) or full quality assurance (module H) applies. For Annex IV entries: Article 32(4) applies: a European cybersecurity certification scheme in accordance with Article 8(1) or, where the conditions in Article 8(1) are not met, any of the Article 32(3) procedures.
When do the CRA rules for a smart meter gateway or network interface apply?
Reporting duties under Article 14 have applied since 11 September 2026, and the CRA will apply in full from 11 December 2027.
Cybiq checks the CRA only. Orientation, not legal advice. Quoted spans come from Regulation (EU) 2024/2847 as published in the Official Journal and are re-verified against the live text by automated tests. Verify before relying on any item; for an assessment of your own product, consult a qualified lawyer.