Product class
Is a smart home general purpose assistant or security product an important product under the CRA?
Short answer: Yes, as a category. A smart home general purpose assistant or security product can fall under one of 2 entries in Annex III, Class I. Under Article 7(1), a product whose core functionality is that of a listed category is an important product, so whether your product is one depends on its core functionality.
“Smart home general purpose virtual assistants”
“Smart home products with security functionalities, including smart door locks, security cameras, baby monitoring systems and alarm systems”
Technical description
Commission Implementing Regulation (EU) 2025/2392 gives the technical description of each category in the annexes. It says what the category covers, in the Official Journal's words.
“Products with digital elements that communicate on the public Internet, whether directly or via other equipment, that process demands, tasks or questions based on natural language prompts, such as through audio or written input, and that, based on those demands, tasks or questions, provide access to other services or control the functions of connected devices in residential settings.
This category includes but is not limited to smart speakers with an integrated virtual assistant, and standalone virtual assistants that meet this description.”
“Products with digital elements that protect the physical security of consumers in a residential setting and which can be controlled or managed remotely from other systems, as well as hardware and software that centrally control such products.
This category includes but is not limited to smart door locking devices, baby monitoring systems, alarm systems and home security cameras.”
What Class I means for the conformity route
Article 32(2) caveat: self-assessment via internal control remains available only if you apply in full harmonised standards, common specifications or European cybersecurity certification schemes at assurance level at least 'substantial'; where you apply them only in part or not at all, or none exist, EU-type examination followed by production control (module B+C) or full quality assurance (module H) applies.
The wording of Article 32(2) is quoted in the product classes guide.
When it applies
Since 11 June 2026, the rules on notified conformity assessment bodies, Chapter IV (Articles 35 to 51), have applied. The reporting duties of Article 14 have applied since 11 September 2026. The CRA will apply in full from 11 December 2027. The wording of the application clause is quoted in the product classes guide.
Edge cases
- Free and open-source software. Article 32(5) has its own rule for Annex III products. The wording of Article 32(5) is quoted in the product classes guide.
- The core functionality decides. Check your product's core functionality against the annex text quoted above. The wording of Article 7(1) is quoted in the product classes guide.
Questions and answers
Where does a smart home general purpose assistant or security product sit in the CRA annexes?
See the short answer and the annex quote at the top of this page.
Does a smart home general purpose assistant or security product need a notified body?
Not in every case: internal control stays open only where the Article 32(2) conditions are met, as the route section above sets out.
When do the CRA rules for a smart home general purpose assistant or security product apply?
Reporting duties under Article 14 have applied since 11 September 2026, and the CRA will apply in full from 11 December 2027.
Cybiq checks the CRA only. Orientation, not legal advice. Quoted spans come from Regulation (EU) 2024/2847 as published in the Official Journal and are re-verified against the live text by automated tests. Verify before relying on any item; for an assessment of your own product, consult a qualified lawyer.