IoT

The device leaves the factory with a support duty.

CRA wants no known exploitable vulnerability at launch, secure defaults, and updates through a declared period. That hurts more on firmware than on SaaS.

Book a call

A connected device leaves the factory with a duty you cannot “turn on in 2027”. CRA wants no known exploitable vulnerability at placing on the market, secure defaults and updates through a declared support period. That hurts more on firmware and radio than on a cloud slide.

First you decide what the product is: the board, the firmware, the mobile app, the companion cloud. One PDE or several. Without that decision you do not know which SBOM, which CSIRT and which support date goes on the package.

On 11 September 2026 Article 14 does not wait for OTA to “land by itself”. An actively exploited vulnerability in the comms stack is twenty-four hours. Crado AI holds the model catalogue, the firmware SBOM and the queue on-premise, on your network, not in someone else’s device cloud.

What counts as the product in IoT

A device with firmware

Hardware model and revision are the PDE identity. The same radio chip under three SKUs is three rows, or a documented shared base with a difference.

The companion app

If the app is placed on the market under your mark, it does not hide behind the box. It may be its own PDE or part of the product - the decision belongs in the catalogue.

OTA updates

Annex I wants updates, including automatic ones with a clear opt-out. The OTA channel, the key and the rollback policy are evidence, not a marketing feature.

Support period at purchase

Month and year, visible at sale. “We support the device” with no date does not close the file.

Usual friction

Firmware, radio, companion cloud and the mobile app as one product or several.
Automatic updates with a clear opt-out.
The support end date visible at purchase.

What Crado AI holds

A catalogue of hardware models and revisions.
A firmware SBOM plus comms components.
A vulnerability queue with the Article 14 clock.

What usually hurts IoT

Firmware, radio, app and companion cloud: one product or four?
OTA with default auto-update and a lawful opt-out.
Support end printed at sale, not in a lawyer’s PDF.

How CRA lands on a connected device

A catalogue of models, revisions and markets, with placing-on-the-market date and support end.
A firmware SBOM plus the comms stack, matching the build in the device, not the develop branch.
Secure defaults: passwords, open ports, remote diagnostics off or hard to justify.
An Article 14 queue on firmware already in the field, not only on the next release.
The file and CE before the batch leaves the line, including update instructions.

What has to run in the factory and after shipment

01

The model map

SKU, revision, firmware, markets, support date. Without that, OTA and CVE have nothing to attach to.
02

The SBOM of the flashed version

What goes into the programmer must share a digest with the file.
03

Default configuration

An Annex I row on passwords, interfaces and attack surface, not a “secure by design” slide.
04

A clock in the field

An owner who can say in 24 hours which series are hit and whether an early warning goes out.

Questions from an IoT manufacturer

Is the companion cloud in CRA?

CRA applies to a product with digital elements. A cloud service is a separate assessment. If a companion app or software is placed on the market under your mark, do not assume an exemption without a catalogue row.

What about devices already with customers before 2027?

New placing on the market after 11 December 2027 needs Annex I, assessment, declaration and CE. A substantial modification of an older model is treated as a new placing. “Already sold” does not close Article 14 from September 2026 for products you still support as manufacturer.

Is auto-update mandatory?

Annex I talks about updates, including automatic ones where that makes sense, with a clear opt-out. No update channel during the support period is a file gap, not a product choice.

Why not SaaS for IoT?

The firmware SBOM and the series map describe the device in the field. Industrial buyers and retailers do not want that composition on someone else’s tenant.

What 11 September 2026 actually starts ->