Is an internet-connected toy with social interactive or location tracking features an important product under the Cyber Resilience Act, and what does it still have to do?

By the Annex wording, internet-connected toy with social interactive or location tracking features points to the important class I class (Annex III, class I, point 18: "Internet connected toys covered by Directive 2009/48/EC of the European Parliament and of the Council that have social interactive features (e.g. speaking or filming) or that have location tracking features"). Internal control (module A) only where harmonised standards, common specifications or a European cybersecurity certification scheme at assurance level at least substantial are applied in full; otherwise EU-type examination (module B then C) or full quality assurance (module H) (Art. 32(2)). The class rests on the product's core function (Art. 7(1)); the Commission's technical descriptions of each category are named, not quoted.

What does an internet-connected toy with social interactive or location tracking features sold to UK consumers or in California have to show?

Under the UK PSTI rules: no universal default password, a published point of contact for security issues, a published defined support period, and a statement of compliance with the product. Under California Civil Code 1798.91.04: a reasonable security feature, and for authentication outside a local area network a password unique to each device or one the user sets before first access.

important class I · product function

Internet-connected toy with social interactive or location tracking features

By the Annex wording, an internet-connected toy with social interactive or location tracking features points to the important class I class (Annex III, class I, point 18). The route that class asks for: internal control (module A) only where harmonised standards, common specifications or a European cybersecurity certification scheme at assurance level at least substantial are applied in full; otherwise EU-type examination (module B then C) or full quality assurance (module H) (Art. 32(2)).

The Annex wording

Annex III, class I, point 18

Internet connected toys covered by Directive 2009/48/EC of the European Parliament and of the Council that have social interactive features (e.g. speaking or filming) or that have location tracking features

Cited to the held text of Regulation (EU) 2024/2847. By the Annex wording; the Commission's technical descriptions of each category (Commission Implementing Regulation (EU) 2025/2392) are named, not quoted.

Where the match turns

Class I covers toys under Directive 2009/48/EC that have social interactive features (speaking or filming) or location tracking; a toy without them is read as default.

A line that places here

example

TY-1 | connected toy with a camera | EU, UK | consumers | harmonised standard

Check this line

What the finder reads on these lines

11 of the 14 notes

3. Important class I function with self-assessment planned: Which harmonised standard, common specification or certification scheme does the self-assessment apply in full, and is it cited for this category?
4. No process to report an actively exploited vulnerability or a severe incident: Who notifies the CSIRT and ENISA within 24 hours when this product carries an actively exploited vulnerability, and where is the process written down?
5. No support period stated, or under five years with no reason recorded: What is the support period, how was it set, and where is its end date shown to buyers?
6. A universal default password: When will each unit ship with a unique password, or require the user to set one at first use?
7. No published vulnerability contact: Where does a researcher report a vulnerability in this product, and is that address published?
8. No security update mechanism, or unsigned updates: How does a security fix reach units already sold, and how does the device check the update is genuine?
9. No software bill of materials kept, or partial: Where is the machine-readable SBOM for this product, and does it cover at least the top-level dependencies?
10. Sold to UK consumers with no statement of compliance: Where is the statement of compliance for this product, and does it travel with every unit sold to UK consumers?
11. Manufacturer outside the EU with no authorised representative: Will the company appoint an EU authorised representative, and if not, which importer holds the documentation for the market surveillance authorities?
12. Still on sale for 11 December 2027 with no conformity route planned: Which route will this product take, and by when, so units made available from 11 December 2027 carry the declaration?
13. Sold in California with no reasonable security feature recorded: Which reasonable security feature does this device carry for California, and is it unique per device or set by the user at first use?

Clauses

13 cited

Regime	Clause	Applies when
CRA	CRA Art. 7(1) Classifying a product as important (Annex III, class I or II)	sold in the EU
CRA	CRA Art. 32(2) Conformity assessment for important class I products	sold in the EU
CRA	CRA Annex VIII Part II Module B: EU-type examination application and manufacturer duties	sold in the EU
CRA	CRA Art. 13(1) Design, development and production to Annex I Part I	sold in the EU
CRA	CRA Annex I Part I(1) Appropriate level of cybersecurity based on the risks	sold in the EU
UK PSTI	UK PSTI R.1 No universal default passwords	sold to UK consumers
UK PSTI	UK PSTI R.2 Published point of contact for security issues	sold to UK consumers
UK PSTI	UK PSTI R.3 Published defined support period	sold to UK consumers
ETSI EN 303 645	ETSI EN 303 645 5.1 (provision group) No universal default passwords	sold to UK consumers
ETSI EN 303 645	ETSI EN 303 645 5.2 (provision group) Implement a means to manage reports of vulnerabilities	sold to UK consumers
ETSI EN 303 645	ETSI EN 303 645 5.3 (provision group) Keep software updated	sold to UK consumers
California	California 1798.91.04(a) Reasonable security feature or features	sold in California, as the manufacturer
California	California 1798.91.04(b) Authentication outside a local area network: unique password or forced new credential	sold in California, as the manufacturer

The route clause, set out

CRA Art. 32(2)Conformity assessment for important class I products

For an Annex III class I product, internal control is available only where the manufacturer has applied in full harmonised standards, common specifications or a certification scheme at assurance level at least substantial. Where it has applied them in part, not at all, or none exist, the product and processes must go, for the uncovered requirements, through module B plus C or module H.

What a notified body or authority asks to see: Record of which harmonised standards were applied and whether in full; Notified body certificate where standards were not fully applied

Where lists usually fall short: Internal control used for a class I product while harmonised standards were only partly applied

Source: EU Cyber Resilience Act (Regulation (EU) 2024/2847)

Internet-connected toy with social interactive or location tracking features

The Annex wording

Where the match turns

A line that places here

What the finder reads on these lines

Clauses

The route clause, set out

Other functions in important products, class i (annex iii)