Annex IV (2)
Smart meter gateways and advanced security devices
Smart meter gateways are critical product under Regulation (EU) 2024/2847 when the listed function is the product's core functionality. Metering gateways sit inside the energy system and aggregate data from millions of households; their compromise is a grid-stability and privacy problem at national scale.
Updated 2026-09-12 · Operational guidance, not legal advice.
- Classification
- Critical product
- Conformity route
- European certification may become mandatory
- Reference
- Annex IV (2) · Art. 8, Art. 32(4)
What the annex says
Smart meter gateways within smart metering systems and other devices for advanced security purposes, including for secure cryptoprocessing.
Paraphrase of Annex IV (2); the Official Journal text governs.
Typical products in this category
- Smart meter gateways in energy metering systems
- Secure cryptoprocessing devices for utilities and infrastructure
Where the boundary runs
The meter itself and the head-end system are classified separately. National schemes (for example Germany's BSI TR-03109) coexist with the CRA and may become the basis of a recognised certification.
The test is core functionality (Article 8). Record the reasoning and the approver: the category determines the conformity assessment route and market surveillance authorities can challenge it.
Conformity assessment
European certification may become mandatory. Where the Commission adopts a delegated act, a European cybersecurity certificate at assurance level at least 'substantial' is required; until then the Class II routes apply. (Art. 8, Art. 32(4))
What to prepare operationally
- Align the CRA technical documentation with the national protection profile you already maintain.
- Track delegated acts under Article 8 for mandatory certification.
- Design the Article 14 runbook with the utility and the national CSIRT in the loop.
- Maintain an SBOM per released version, match it continuously against vulnerability intelligence, and keep the Article 14 runbook rehearsed — these apply to every product with digital elements, listed or not.
Frequently asked
- Is every smart meter gateways product an critical product?
- Only where the listed function is the product's core functionality (Article 8). The meter itself and the head-end system are classified separately. National schemes (for example Germany's BSI TR-03109) coexist with the CRA and may become the basis of a recognised certification.
- What changes compared with a default product?
- Where the Commission adopts a delegated act, a European cybersecurity certificate at assurance level at least 'substantial' is required; until then the Class II routes apply. The essential requirements of Annex I, the vulnerability-handling duties and Article 14 reporting apply to every product with digital elements regardless of category.
- From when?
- Article 14 reporting obligations have applied to all manufacturers since 11 September 2026. Conformity assessment and CE marking under the CRA apply from 11 December 2027; products placed on the market before that date are not required to be re-assessed unless substantially modified.