In scope — reporting from 11 September 2026, CE marking from 11 December 2027

Scope

In scopeA product with digital elements is a software or hardware product and its remote data processing solutions, including components placed on the market separately, whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network.

Your role

Manufacturer

Class

Important, class ISmart home products with security functionalities (smart door locks, security cameras, baby monitoring systems, alarm systems)

Conformity route

Third party, unless harmonised standards are applied in full

Article 14 reporting

AppliesActively exploited vulnerabilities and severe incidents must be reported from 11 September 2026.

CE marking

RequiredRequired when the product is placed on the market, from 11 December 2027.

What this means you must do

• Support period: determined by the manufacturer to reflect the expected use time; at least five years unless the product is expected to be in use for less; the end date (month and year) is stated at purchase. A security update, once issued, remains available for at least ten years or the remainder of the support period, whichever is longer.Art. 13(8), (9), (19)
• Technical documentation (Annex VII) is drawn up before placing on the market and kept, with the EU declaration of conformity, for at least ten years after placing on the market or the support period, whichever is longer.Art. 13(12)–(13), Art. 31
• Annex I Part I — product properties (secure by design and default; see checklist items I.1–I.3m).Annex I Part I
• Annex I Part II — vulnerability handling requirements (checklist items II.1–II.8).Annex I Part II
• Manufacturers identify and document vulnerabilities and components, including by drawing up a software bill of materials in a commonly used machine-readable format covering at the very least the top-level dependencies.Annex I Part II(1), Art. 13(8), (24)
• User information and instructions (Annex II): manufacturer identity and contact; single point of contact for vulnerability reporting; product identification; intended purpose and security environment; circumstances that may lead to significant cybersecurity risks; where fixed-vulnerability information is published; support period end date; update installation and opt-out; secure decommissioning; access to the SBOM where relevant.Annex II, Art. 13(18)
• EU declaration of conformity (Annex V) and simplified declaration (Annex VI).Art. 28, Art. 13(12), (20), Annex V, Annex VI
• Technical documentation contents (Annex VII).Annex VII, Art. 31
• CE marking is affixed visibly, legibly and indelibly to the product, or where not possible to the packaging or the declaration of conformity/accompanying documents; for software, on the declaration of conformity or the website accompanying the product.Art. 29–30
• Actively exploited vulnerability: early warning within 24 hours of awareness; notification within 72 hours; final report within 14 days after a corrective or mitigating measure is available.Art. 14(1)–(2)
• Severe incident having an impact on the security of the product: early warning within 24 hours; incident notification within 72 hours; final report within one month after the incident notification.Art. 14(3)–(4)
• After becoming aware of an actively exploited vulnerability or severe incident, the manufacturer informs impacted users, and where appropriate all users, without undue delay, including risk-mitigating and corrective measures.Art. 14(8)

Also relevant to you

• No harmonised standards for the CRA have been cited in the Official Journal as of the facts date; the Commission’s standardisation request M/606 covers 41 standards, with the first deliverables expected in Q3 2026.Commission / CEN-CENELEC
• Notified bodies for the CRA are being designated; the Commission targets sufficient capacity by December 2026 (best efforts).Commission
• A manufacturer may appoint an authorised representative by written mandate; the representative keeps the declaration of conformity and technical documentation at the disposal of authorities and cooperates with them. Non-EU manufacturers: reporting is routed via the representative's Member State.Art. 18, Art. 3(15), Art. 14(7)
• Notifications are submitted through the ENISA single reporting platform to the CSIRT designated as coordinator in the Member State where the manufacturer has its main establishment; a manufacturer without an EU establishment uses the Member State of its authorised representative, or where the product is made available.Art. 14(7), Art. 16

Keep this result

Save as a product in your CEMarque account — sign in with your email; the classification and dates carry over (you can edit them with a justification).

This permalink is stable and public. It contains your answers and the result, no account and no personal details. Send it to a customer who asked for a CRA statement, or to whoever signs off.

Your answers

Checked 7 September 2026 · rules v2026.09.1 · facts v2026.09.2 · re-run with these answers

CEMarque encodes Regulation (EU) 2024/2847 and the European Commission's published guidance as of 10 September 2026 (Facts v2026.09.4). It is not legal advice. Verify obligations for your product with qualified counsel where the stakes require it.