2Device requirements

2.1 Four device archetypes

We examine obligations, cost and architecture on four device archetypes. An archetype is a typical device that stands for a whole product group and brings that group’s usual combination of radio, path to the cloud and applicable acts. The four archetypes are a battery tool with BLE tracker, a machine with gateway, a building device under § 14a EnWG and a logistics tracker for assets, containers and trailers.

1. Battery tool with BLE tracker. A cordless drill, impact wrench, grinder or saw with a removable battery pack and a Bluetooth Low Energy (BLE) radio. The radio serves configuration and diagnostics through a smartphone app and lets the owner locate the tool. The app relays data to the manufacturer’s cloud. The tool is machinery within the meaning of the Machinery Regulation, a power-driven assembly with moving parts.¹⁶⁸ The pack is a portable battery if it is sealed, weighs 5 kg or less and is not designed specifically for industrial use.¹⁶⁹

2. Machine with gateway. A stationary machine (machine tool, packaging, process or handling machine) whose controller connects through an edge gateway to the operator’s network or a cloud service, via Ethernet, Wi-Fi or a cellular modem. The gateway may be built into the machine and placed on the market with it, or sold separately as a retrofit product. That distinction decides its CRA class.

3. Building device under § 14a EnWG. A heat pump, wallbox, air-conditioning unit or stationary storage battery that the distribution system operator may throttle under § 14a of the German Energy Industry Act.⁶¹ The Bundesnetzagentur’s determination BK6-22-300 of 27 November 2023 governs this grid-oriented control from 1 January 2024.⁷⁴ A throttled device must still be able to draw at least 4.2 kW under direct control.⁷⁴ The device receives a control signal and may report energy data. Some models also connect to an app via Wi-Fi or Ethernet.

4. Logistics tracker for assets, containers and trailers. A battery-powered, sealed device with satellite positioning (GNSS), a cellular radio (LTE-M, NB-IoT or 2G/4G) and often Bluetooth, mounted on equipment, containers or trailers. It reports location and sensor data such as temperature, shock or door state to a platform used by the fleet or asset owner. It is not machinery and carries a small portable battery.

2.2 Eight device functions

None of the five acts prescribes a component or uses the words “secure boot”. They describe outcomes that an engineering team has to translate into eight functions. The CRA asks for all eight, the Machinery Regulation for six (Figure 3).^{168, 171} Firmware integrity, authentication and the update mechanism shape the hardware. The SBOM, vulnerability handling and logging are processes as much as hardware. Data export and product identification concern data leaving the device.

Firmware integrity. The CRA requires products to protect stored, transmitted and processed data, commands, programs and configuration against unauthorised manipulation, to report on corruptions and to mitigate the effects of attacks.¹⁷¹ The Machinery Regulation requires that software and data critical for compliance with the safety requirements are “identified as such” and “adequately protected against accidental or intentional corruption”.¹⁶⁸ Neither text prescribes a mechanism. The term secure boot appears only in Implementing Regulation 2025/2392, in the description of microcontrollers and microprocessors whose security functions protect “other products … such as secure boot chain”.¹⁴⁹ The established engineering answer is a verified boot chain anchored in a hardware root of trust.

Update mechanism and support period. Vulnerabilities must be fixable through security updates, by default automatic, with an opt-out and the option to postpone.¹⁷¹ The manufacturer distributes updates securely, without delay and free of charge, and, where technically feasible, separately from functionality updates.¹⁷¹ The support period must reflect the time the product is expected to be in use and must be at least five years, unless the product is expected to be in use for less.¹⁷¹ Each security update must remain available for at least ten years after its release or for the rest of the support period, whichever is longer.¹⁷¹ The end date of the support period must be stated to the user.¹⁷¹ The maker of a machine that runs fifteen years therefore plans support for its expected use time, not for the minimum of five years.

Software bill of materials (SBOM). Manufacturers must draw up an SBOM “in a commonly used and machine-readable format covering at the very least the top-level dependencies”.¹⁷¹ The Commission may specify format and elements by implementing act.¹⁷¹ Until then, technical guideline TR-03183 Part 2 (version 2.1.0) of the German Federal Office for Information Security (BSI) gives formal and technical SBOM requirements, as non-binding guidance without a presumption of conformity.⁵⁴ The Machinery Regulation adds its own inventory duty. The machine must identify the software necessary for safe operation and “be able to provide that information at all times in an easily accessible form”.¹⁶⁸

Vulnerability handling and reporting. Only the CRA asks for this function. It requires remediation without delay, regular security tests, public disclosure of fixed vulnerabilities, a coordinated vulnerability disclosure policy and a contact address for reports.¹⁷¹ The user information must name a single point of contact.¹⁷¹ Since 11 September 2026, the reporting chain of Article 14 applies on top.¹⁷¹ BSI TR-03183 Part 3 covers the handling of incoming vulnerability reports, again as non-binding guidance.⁵⁴

Authentication. Four of the five acts require authentication. The CRA demands a secure-by-default configuration and protection from unauthorised access.¹⁷¹ Under the RED, none of the three parts of EN 18031 confers a presumption of conformity “if, when applying its clauses 6.2.5.1 and 6.2.5.2, the user is allowed not to set and use any password”.¹⁴⁸ A setup flow that lets the user skip the password is therefore outside the standard. The Data Act and the Machinery Regulation also presuppose protected access.^{168, 170}

Data export interface. The Data Act requires access by design for all products placed on the market after 12 September 2026.¹⁷⁰ Product data and related service data, including the metadata needed to interpret them, must be accessible to the user “by default, easily, securely, free of charge, in a comprehensive, structured, commonly used and machine-readable format, and, where relevant and technically feasible, directly”.¹⁷⁰ Before the sale, the seller states the type, format and estimated volume of data, whether the product generates data continuously and in real time, where it stores data and how the user can access it.¹⁷⁰ The data holder makes readily available data accessible when the user cannot access them directly on the device, where relevant and technically feasible “continuously and in real-time”.¹⁷⁰ At the user’s request, it shares them with a third party.¹⁷⁰ Typical implementations are a Bluetooth service, an OPC UA or Modbus endpoint or an authenticated cloud API, each with a data catalogue that matches the pre-contract information. Under the CRA the device has to secure the transfer.¹⁷¹ For batteries in its scope, the Batteries Regulation requires a passport that combines model data with data specific to the individual battery, including data “resulting from the use of that battery”.¹⁶⁹ The path from device to passport backend becomes a compliance path when the battery management system is the only source of use data.

Logging. The CRA requires products to record and monitor relevant internal activity, including access to or modification of data, services or functions, with an opt-out for the user, and to report possible unauthorised access.¹⁷¹ The Machinery Regulation goes furthest. The machine “shall collect evidence of a legitimate or illegitimate intervention” in safety-relevant hardware, in the software and in its configuration.¹⁶⁸ Its control system keeps a tracing log of intervention data and of the versions of safety software uploaded after placing on the market, “enabled for five years after such upload”, for use on reasoned request of a national authority.¹⁶⁸ Control systems with self-evolving behaviour also keep data on safety-related decisions for one year.¹⁶⁸

Product identification. The product or its software must be identifiable unambiguously under four of the five acts: the CRA in the user information,¹⁷¹ the Data Act in the pre-contract information,¹⁷⁰ the Machinery Regulation for safety-relevant software¹⁶⁸ and the Batteries Regulation with the QR code that every battery carries from 18 February 2027 and, for industrial batteries above 2 kWh, with the battery passport.¹⁶⁹

2.3 A common security baseline

Four of the five acts ask for the same small set of device capabilities, and the CRA says so itself. Its essential requirements “include all the elements” of the RED cybersecurity requirements.¹⁷¹ By its own account, the CRA “could facilitate” compliance with the cybersecurity requirements of the Machinery Regulation, provided the manufacturer demonstrates the overlap through harmonised standards and a risk assessment that covers those risks.¹⁷¹ The Data Act, often read as the opposite of security, requires access “securely” and lets the data holder restrict sharing that could undermine the product’s security.¹⁷⁰ Six capabilities make up this common baseline (Table 3).

A product with a shared default password and unsigned firmware therefore fails four acts at once. Even a simple logistics tracker needs this baseline. Its user, typically the fleet operator, has a Data Act right to the position and sensor data.¹⁷⁰ Trackers in the field are also exactly the installed base for which the CRA reporting duty already applies.¹⁷¹ A device without unique credentials, signed updates and an SBOM can neither be patched nor reported on within 24 hours.

2.4 Obligations by archetype

Every archetype falls under the CRA and the Data Act, and each has one obligation that is easy to miss (Table 4).^{170, 171} Several classifications depend on the design or on a reading the texts do not settle. In these cases the manufacturer has to document its classification explicitly.

Battery tool. Three regimes meet in one housing. As machinery, the tool falls under the cybersecurity sections of the Machinery Regulation from 20 January 2027. The app channel must not create a hazard if it can change safety-relevant parameters such as speed, torque or kickback detection, and the safety firmware must be protected and identifiable.¹⁶⁸ The BLE radio brings in the RED. A tool that reaches the internet only through the user’s phone is internet-connected radio equipment, because the text includes communication via other equipment.¹⁴¹ Location or user data add the privacy requirement.¹⁴¹ The built-in Bluetooth module is itself a Class I network interface, but it does not raise the tool’s CRA class.^{149, 171} Access by design under the Data Act covers usage, battery and location data.¹⁷⁰ The pack gets a QR code, but no passport as long as it is a portable battery.¹⁶⁹ A pack marketed only for professional or industrial use, by contrast, may count as an industrial battery. Its classification therefore has to be documented explicitly.

Machine with gateway. The machine itself stays in the CRA default class, because the core function of a machine tool falls into no category of important or critical products.¹⁷¹ The gateway is where classification becomes delicate. A gateway placed on the market on its own whose core function is to route traffic between the plant network and the internet matches the description of a router and is then a Class I product.¹⁴⁹ A gateway sold only as an integral part of the machine is assessed with the machine, which stays default. The same hardware sold both ways needs two classifications. If the gateway is marketed with the core function of protecting the plant network by monitoring and restricting traffic, it fits the firewall description instead. It is Class II, with a mandatory notified body or certification.¹⁴⁹ In our reading, a routing gateway that merely integrates firewall rules remains a router. For the installed base of long-lived machines, the Data Act’s Article 4 access right matters more than access by design, which only covers newly placed machines.¹⁷⁰ The machine needs a notified body under the Machinery Regulation only if it embeds self-evolving, machine-learning safety functions.¹⁶⁸

Building device. A heat pump or wallbox is not a smart home product with security functions that protect the physical security of consumers, so it stays in the CRA default class.^{149, 171} A home energy manager that routes between home network and internet may itself be a router. A smart meter gateway in the § 14a control path is a critical product.¹⁷¹ It belongs to the metering point operator, not to the device maker, and does not change the class of the device.¹⁷¹ The manufacturer also has to classify and document whether a domestic heat pump falls under the Machinery Regulation or under its household-appliance exclusion.¹⁶⁸ A stationary storage battery above 5 kg counts as an industrial battery and needs a passport above 2 kWh.¹⁶⁹ The battery passport therefore hits this archetype hardest.

Logistics tracker. The tracker is a default CRA product and internet-connected radio equipment that processes location data. Both RED points therefore apply, and with them EN 18031-1 and -2.^{141, 148} It is not a Class I wearable, because it is mounted on goods, not worn on the body.¹⁴⁹ The Commission reads that class as products that collect health data.¹⁴⁹ A badge that only reports position is outside it. A lone-worker badge with fall detection needs checking. The tracker remains a connected product under the Data Act, because it transmits data on behalf of its user, not of third parties.¹⁷⁰ The least noticed obligation is in the Batteries Regulation. From 18 February 2027 a portable battery in a product must be “readily removable and replaceable by the end-user” with commercially available tools, and removal instructions must be published online.¹⁶⁹ A potted, glued or welded tracker does not meet this. The exemption for devices used mainly around water applies only where it is needed for safety.¹⁶⁹ An IP67 tracker on a trailer therefore qualifies only with that justification. Without it, the battery compartment must open with commercially available tools.

2.5 Conformity assessment routes

The CRA classifies a product by its core function, not by the components it contains. A product whose core function matches a category in Annex III is important (Class I or II), one matching Annex IV is critical, everything else is in the default class.¹⁷¹ Implementing Regulation 2025/2392 has described each category since 21 December 2025. It confirms that the product “as a whole” decides. A component with the core function of an important product does not by itself make the host product important.¹⁴⁹ A product that can perform the functions of a category but whose core function is different is not in that category, just as a smartphone is not an operating system.¹⁴⁹ Only the default class can always assess itself, the other classes only under conditions or not at all (Table 5).¹⁷¹

The components inside the four archetypes are full of important and critical products: the Bluetooth or cellular module, the real-time operating system and the microcontroller with secure boot in Class I, the secure element as a critical product. Their makers need their own conformity assessment for them. The tool, machine, heat pump and tracker nonetheless stay in the default class.^{149, 171} Buying CRA-compliant components therefore reduces the work but does not replace the manufacturer’s own assessment of the whole product.

The classification of a gateway is the most expensive. A Class I gateway cannot assess itself and needs a notified body as long as no CRA harmonised standard is cited in the Official Journal.¹⁷¹ No body is yet notified under the CRA.¹⁶¹ The Commission’s standardisation request M/606 schedules the standards for routers, modems and switches and for firewalls, including those specifically intended for industrial use, for 30 October 2026.¹⁴⁷ Citation in the Official Journal follows only after that. BSI TR-03183 Part H describes how a manufacturer can use an ISO/IEC 27001-conformant management system for a Module H assessment.⁵⁴ For a gateway launching in 2028, a notified body is therefore the planning case. A standard cited in the Official Journal by then would be an upside, not a basis for planning.