EU CRA ComplianceA Malkan Solutions company
Product classifier See the CRA Workbench →Workbench →

Product classifierCriticalRegulation (EU) 2024/2847

Is a smart meter gateway covered by the EU Cyber Resilience Act?

The short answer, the Official Journal text behind it, and the judgment calls an assessor will test.

01
Verdict

smart meter gateway

In scope · Critical

Scope
In scope if it has a direct or indirect data connection to a device or network (Article 2(1)) — almost every modern one does.
Class
Critical — Annex IV.
Route
A European cybersecurity certificate where a delegated act under Article 8(1) requires one; where it does not, the Class II procedures apply — Article 32(4).
Dates
Article 14 reporting has applied since 11 September 2026; the main obligations apply from 11 December 2027 (Article 71).

Smart meter gateways within smart metering systems are critical products (CRA Annex IV).

02
Why

Why it lands in this class

Annex IV point 2 lists ‘smart meter gateways within smart metering systems as defined in Article 2, point (23) of Directive (EU) 2019/944’. The Implementing Regulation describes gateways that control communication between the metering system and authorised third parties such as utilities.

It also notes that gateways in gas or heat metering systems may be included where they meet the same description.

“Smart meter gateways are products with digital elements that control communication between components in or connected to smart metering systems as defined in Article 2(23) of Directive (EU) 2019/944, and authorised third parties, such as utility providers.”

— Implementing Regulation (EU) 2025/2392, Annex II, point 2 (CRA Annex IV, point 2)

Source: Regulation (EU) 2024/2847 — Articles 2(1), 7(1), 32; Annexes III–IV. Implementing Regulation (EU) 2025/2392.

03
Edge cases

When the answer changes

  • The device is a meter with a communication module, not a gateway controlling communication for the metering system: check the description carefully before assuming Annex IV.
  • An Article 8(1) delegated act later requires a European cybersecurity certificate for this category: that becomes the mandatory route.
04
Auditor view

What an assessor will ask you to show

Class decides the route. It doesn’t reduce the work: every product needs the full Annex I evidence, an Article 13 risk assessment and an Annex VII technical file.

  • The current status of any Article 8(1) delegated act and certification scheme for smart meter gateways.
  • Which procedure you will use in the meantime (the Class II procedures under Article 32(4)(b)).
  • Cryptographic key management across the gateway’s service life.

Already developing to IEC 62443-4-1? See which requirements map to which CRA obligations in the IEC 62443 ↔ CRA crosswalk, and check your organisation’s footing with the CRA readiness score.

Classification is step one of six.

The CRA Workbench records your core-functionality reasoning the way an assessor will read it, then carries it through risk, Annex I, conformity route, vulnerability handling and the Annex VII file — with the IEC 62443 bridge built in.

See the CRA Workbench →

This page is general information about Regulation (EU) 2024/2847 and Commission Implementing Regulation (EU) 2025/2392, not legal advice. Quoted text is from the Official Journal; the analysis around it is ours. Classification turns on your product’s actual core functionality — document your own determination and confirm it against the current official texts. The CRA Workbench produces draft documentation for expert review; it indicates the evidence needed and does not, by itself, guarantee compliance.