Insights · cetome.com
Four CRA drafts for consumer IoT, none you can use
Smart home products, connected toys and wearables are Important Class I under the Cyber Resilience Act, and ETSI is drafting their harmonised standards. We reviewed the four drafts. They cannot handle a new product, they take months on an existing one, and most products will deviate from them anyway. EN 303 645 and its profiles remain the route that works today.
Four standards, one deadline
From 11 December 2027, every product with digital elements placed on the EU market must comply with the CRA. The reporting obligations already apply.
For Important Class I products, the regulation offers two routes:
- Self-assessment, if a harmonised standard is applied in full and grants a presumption of conformity.
- EU-type examination, via a Notified Body, if no harmonised standard exists for the product or if the manufacturer deviates from it.
ETSI holds the four consumer IoT categories of Important Class I, defined in the Commission’s technical descriptions of product categories, and its enquiry drafts are out.
| Important Class I category | Examples | Enquiry draft |
|---|---|---|
| Smart home general purpose virtual assistants | Google Home, Alexa, Homey | EN 304 631 |
| Smart home products with security functionalities | Smart door locks, cameras, baby monitors, alarms | EN 304 632 |
| Internet connected toys with social interactive or location tracking features | Talking dolls, robot pets | EN 304 633 |
| Personal wearable products | Watches, fitness bands | EN 304 634 |
The methodology in the standards
Applying the standards to a product means seven stages, in order, using predefined tables.
- Map the architecture The architectural components: devices, software components, applications and cloud services (Remote Data Processing Solutions in the CRA), their physical operational environments and the interfaces between them.
- Inventory the assets For each component, the data assets with their storage and export interfaces, and the function assets with the interfaces that implement and trigger them.
- Take the risks and their levels from the standard’s tables For each asset, an impact class of none, low, medium or high for confidentiality, integrity, availability and harm potential, read from the standards rather than from a risk assessment of the product.
- Select the applicable requirements A checklist. For each essential requirement of the CRA, the standards say when it applies and which product properties exempt from it. Tick the ones that apply to the product of step 1.
- Derive the protection strength For each component and interface group of step 1, the strength level of each protection mechanism, read from predefined matrices that cross the component’s properties with the impact classes of its assets from step 3.
- Chain the results The standards propagate the classes across the assets of step 2: the impact of a data asset sets the strength of its storage and communication mechanisms, the harm potential of a function sets the strength of its authentication, and the update software sets the strength of version verification.
- Assess and document Verify the implementation against the requirements of step 4, at the strength of steps 5 and 6, and compile the Annex VII documentation.
Four reasons the standards are unworkable
The vertical standards were written before the horizontal one. The four consumer standards came before the generic baseline they build on, EN 40000-1-4, which may not be published before December 2027. Half of their text is boilerplate copied from one to the next, that belongs in the horizontal standard.
Risk assessment cannot be replaced by a lookup table. Impact classes and strength matrices belong to electrical safety and EMC testing, where the physics is deterministic. Cyber security is not: the risk assessment captures the threats, the attackers and the context of use, and no template replaces it.
The standards only work for a product that already exists. They start from a complete list of assets, which exists for a product on the shelf, not for one being conceived, where the assets are an outcome of the architecture. The products placed on the market after December 2027 are being designed now, and the standards have nothing to say to their teams.
The effort is out of proportion. Each generation of standard has taken longer to apply than the last, and the new standards make the duration explode. The expected duration for an existing product, with a team that knows the standard:
| Standard | Method | Expected duration |
|---|---|---|
| EN 303 645 with TS 103 701 | One ICS file and the IXIT tables derived from it | Three to five days |
| EN 18031-1, -2 and -3 | Decision trees and evidence documentation (E.Just, E.Info) | Three to four weeks |
| EN 304 631 to 634 | Asset inventories, impact classes, strength matrices | Weeks to months |
What the standards leave out
The standards never say what to implement. After seven stages, a team holds a strength level per mechanism and no requirement behind it: nothing on how to authenticate, store or update. EN 303 645 says what a product has to do, selected by its features and its conditions of operation, and what to document.
They cover Annex I Part I only. The presumption of conformity also needs EN 40000-1-3 for the vulnerability handling of Part II, a second standard with a different approach. EN 303 645 covers both parts.
The route that works today
Do not wait for the vertical standards. Most products will deviate from them, and every deviation is justified to a Notified Body. If that is the destination either way, bring the evidence you can produce in days rather than months.
Build on existing standards and document the CRA gaps. EN 303 645 and its profiles, or EN 18031 in the worst case for radio products:
| Important Class I category | What manufacturers can use today |
|---|---|
| Virtual assistants | TS 103 927, smart voice-controlled devices |
| Smart home security products | TS 103 815, residential smart door locking devices |
| Connected toys | EN 303 645, baseline requirements for consumer IoT |
| Wearables | EN 303 645, baseline requirements for consumer IoT |
Design the new products from the risk assessment. Threats and risks, security objectives, architecture, and the asset list falls out of them. The product meets the essential requirements by construction.
Book the Notified Body early. Capacity is the bottleneck of 2027, and a complete file on a recognised baseline gets through faster than a deviation list against a vertical standard.
How we get your products there
Start with one product. The CRA assessment of a single product, at a fixed price, gives you its class, its route, its gaps and the budget to close them. One product is ready sooner, and the assessment extends to the portfolio when the board needs it.
Then the programme. Get CRA ready follows, per product type: risk assessment, mapping to the essential requirements, justified deltas, technical file and Notified Body, with your teams. Successfully implement EN 303 645 gives your teams the baseline in two days. A retained advisor follows the standards, helps your teams clarify their questions as the standards change, and briefs your board.
Our tools shorten the mechanical parts: CRAscoping classifies a product, CRAted tracks its gaps against the CRA, FAST produces the threat model, the risk assessment and the applicable requirements, and ICS2IXIT turns an EN 303 645 ICS into the IXIT tables.
We submitted these comments to AFNOR as part of the public consultation on the four standards.
If your consumer products fall in Important Class I, assess one product first, see how we approach CRA readiness, or talk to us.
About cetome
cetome is an independent product cyber security advisory, in London and Lyon since 2017. We help connected-product manufacturers ship secure products on time, in compliance with the Cyber Resilience Act, RED and other regulations, and we publish our research and tools for the community.
This article: https://cetome.com/insights/cra-harmonised-standards-for-consumer-iot/ · More insights: https://cetome.com/insights/ · Talk to us: https://cetome.com/contact/