CRA Impact on IoT Manufacturers

IoT: The Broadest CRA Impact

IoT devices are arguably the primary target of the CRA. Smart home devices, wearables, industrial sensors, and connected appliances have historically shipped with minimal security. The CRA changes that fundamentally.

What’s Covered

Smart Home (EN 304 631, 632)

• Voice assistants and smart speakers
• Smart thermostats and lighting
• Connected cameras and doorbells
• Smart locks and security systems
• Products with security functionalities (Class I)

Wearables (EN 304 634)

• Smartwatches and fitness trackers
• Medical wearables (may also fall under MDR)
• Connected safety equipment

Industrial IoT

• Sensors and actuators
• PLCs and industrial controllers
• Edge computing devices
• Connected machinery

Connected Toys (EN 304 633)

• Internet-connected toys
• Educational devices
• Gaming peripherals with connectivity

Essential Security Requirements for IoT

# CRA IoT Security Checklist
security_by_default:
  - No default passwords
  - Encrypted communications (TLS 1.3 minimum)
  - Secure boot chain
  - Minimal attack surface (only necessary ports/services)

data_protection:
  - Data minimization (collect only what's needed)
  - Encrypted storage for sensitive data
  - Secure credential storage (hardware-backed when possible)
  - Privacy by design

update_mechanism:
  - Secure OTA update capability
  - Signed firmware updates
  - Rollback protection
  - Update availability for product lifetime (min 5 years)

vulnerability_handling:
  - Coordinated disclosure process
  - security.txt on any web interface
  - SBOM for all firmware components
  - 24-hour ENISA reporting for exploited vulnerabilities

The 5-Year Update Challenge

The CRA requires security updates for the expected product lifetime, with a minimum of 5 years. For IoT manufacturers, this is transformative:

Traditional IoT Model:
  Ship → Forget → New Product

CRA IoT Model:
  Ship → Monitor → Patch → Monitor → Patch → ... (5+ years)
  └── Budget for ongoing security engineering
  └── Maintain build infrastructure for legacy products
  └── Track vulnerabilities in all dependencies

Cost Impact

Based on industry assessments:

• Per-product compliance cost: €50K-500K (depending on complexity)
• Ongoing annual cost: €30K-100K per product line (security updates, monitoring)
• SBOM tooling: €5K-50K/year
• Third-party assessment (if required): €20K-100K per product

Action Items for IoT Manufacturers

1. Eliminate default passwords — this alone will be a common compliance failure
2. Implement secure OTA updates — many IoT devices can’t update at all today
3. Generate SBOMs for firmware — including all embedded libraries and RTOS components
4. Plan for 5-year support — budget, staffing, and build infrastructure
5. Test, test, test — penetration testing, fuzzing, and compliance verification

The CRA will raise the quality bar for IoT. Manufacturers who prepare early will have a competitive advantage.

Manufacturing IoT products for the EU market? I help organizations prepare for CRA compliance. Get in touch.