Does the CRA apply with USB, Ethernet, RS-485, CAN, radio, JTAG or an SD slot?
The table holds each interface against the wording of Art. 3(9) and against what the Commission has written in its FAQs and guidance. Where the Commission says nothing, the table says so.
| Interface | Reasoning |
|---|---|
| USBYes | If data runs over the socket. USB is an electrical interface with a cable (Art. 3(9)). The FAQs name USB expressly as a direct physical connection (FAQ 1.3). A firmware update over USB is a data connection to another device.Art. 3(9)FAQ 1.3 |
| Ethernet, RJ45Yes | Electrical interface and wires (Art. 3(9)). The FAQs name the Ethernet cable as an example (FAQ 1.3).Art. 3(9)FAQ 1.3 |
| RS-485, RS-232 (Modbus RTU)Yes | A serial line is an electrical interface with wires (Art. 3(9)). Modbus RTU carries encoded data from a sender to a receiver, which is the test the guidance sets for a data connection (paragraph 28). The FAQs name a fieldbus over copper cable between a sensor and a controller as a direct physical connection (FAQ 1.3, example PROFIBUS).Art. 3(9)para. 28FAQ 1.3 |
| CANYes | CAN is a fieldbus over wires as well (Art. 3(9); FAQ 1.3 gives PROFIBUS as its example, CAN is not named). Excluded are two- and three-wheel vehicles and quadricycles under Regulation (EU) No 168/2013 (Art. 2(5) with Delegated Regulation (EU) 2025/1535), and the control unit if Regulation (EU) 2019/2144 on the type-approval of motor vehicles applies to it (Art. 2(2)(c)).Art. 3(9)Art. 2(2)(c)Art. 2(5) |
| Radio: Bluetooth, Wi-Fi, LoRaYes | Art. 3(9) names radio waves literally. The FAQs give Wi-Fi, Bluetooth and NFC as examples (FAQ 1.3). LoRa is not named there; the wording “radio waves” covers it.Art. 3(9)FAQ 1.3 |
| JTAG or SWD, inside the housing onlyCheck | The Regulation does not name debug ports. The test is the wording: an electrical interface between components is a physical connection (Art. 3(9)), and Art. 2(1) asks whether the intended purpose or reasonably foreseeable use includes it. The FAQs treat an enabled debugging interface on a printer's motherboard as a vulnerability for the risk assessment (FAQ 4.3.1). Neither the FAQs nor the guidance say whether the port alone brings a device under the CRA.Art. 3(9)Art. 2(1)FAQ 4.3.1 |
| SD card slotCheck | The Regulation does not name memory cards, and neither do the FAQs or the guidance. The slot is an electrical interface (Art. 3(9)), and recital 9 lists files among the ways of a logical connection. The test remains Art. 2(1): does the use include bringing data from another device into the device, such as firmware or configuration?Art. 3(9)Recital 9Art. 2(1) |
| No interface at allNo | If the use includes no connection to other devices or networks (FAQ 1.3, examples dishwasher and calculator). If the firmware of such a device is placed on the market separately, the firmware itself may fall under the CRA (FAQ 1.3, footnote 1).FAQ 1.3Fn. 1 |
Which devices does Art. 2 exclude?
An interface is not enough if one of these exclusions applies. None of them excludes an industrial controller, a gateway or a sensor as such.
- Para. 2(a) and (b)
- Products to which Regulation (EU) 2017/745 on medical devices or Regulation (EU) 2017/746 on in vitro diagnostic medical devices applies.
- Para. 2(c)
- Products to which Regulation (EU) 2019/2144 on the type-approval of motor vehicles applies.
- Para. 3
- Products that hold a certification under Regulation (EU) 2018/1139 on civil aviation.
- Para. 4
- Equipment within the scope of Directive 2014/90/EU on marine equipment.
- Para. 5 with Delegated Regulation (EU) 2025/1535
- Products within the scope of Regulation (EU) No 168/2013 (two- and three-wheel vehicles, quadricycles), except L1e vehicles designed to pedal (FAQ 1.9).
- Para. 6
- Spare parts that replace identical components and are manufactured according to the same specifications.
- Para. 7
- Products developed or modified exclusively for national security or defence purposes, and products specifically designed to process classified information.
What follows for the manufacturer?
If the device falls under the CRA, it must be designed, developed and produced in accordance with Part I of Annex I (Art. 13(1)). Interfaces have a requirement of their own there: limit attack surfaces, expressly including external interfaces (Annex I, Part I, point (2)(j)).
Then there is the bill of materials. Manufacturers shall “identify and document vulnerabilities and components contained in products with digital elements, including by drawing up a software bill of materials in a commonly used and machine-readable format covering at the very least the top-level dependencies of the products” (Annex I, Part II, point (1)). The technical documentation includes the software bill of materials (Art. 31(1), Annex VII, point 2(b)).
The dates are in Art. 71(2): the Regulation applies from 11 December 2027, Art. 14 already from 11 September 2026. Since then the manufacturer reports every actively exploited vulnerability that it becomes aware of, and every severe incident, with an early warning within 24 hours (Art. 14(1) to (4)). The reporting obligation also applies to devices placed on the market before 11 December 2027 (Art. 69(3)).
- 1
List the interfaces
every socket, every bus, every radio module, including debug ports and card slots.
- 2
Check each interface
does data run over it to another device or network, directly or as part of a larger system?
- 3
Check the exclusions
medical device, type-approved vehicle, two-wheeler or other L-category vehicle, aviation product with a certification under 2018/1139, marine equipment, spare part, defence.
- 4
Record the firmware
components with version and known vulnerabilities per release, as the basis for the bill of materials and the reporting channel.
What does Art. 2(1) say?
The scope is one sentence: “This Regulation applies to products with digital elements made available on the market, the intended purpose or reasonably foreseeable use of which includes a direct or indirect logical or physical data connection to a device or network.”
The Commission reads three cumulative elements into it (FAQ 1.1): the device is a product with digital elements. It is made available on the market. And its use includes a data connection. For a control unit, a gateway or a sensor with firmware, the first two are almost always met. The interface decides the third.
No network is needed. Art. 2(1) says “to a device or network”. A sensor that only talks to a controller and never sees the internet has a data connection to a device.
Which definitions in Art. 3 matter?
Art. 3 defines what a connection is. The five terms that matter, in the original wording:
| Term | Art. 3, wording |
|---|---|
| Point (1), product with digital elements | “a software or hardware product and its remote data processing solutions, including software or hardware components being placed on the market separately” |
| Point (2), remote data processing | “data processing at a distance for which the software is designed and developed by the manufacturer, or under the responsibility of the manufacturer, and the absence of which would prevent the product with digital elements from performing one of its functions” |
| Point (8), logical connection | “a virtual representation of a data connection implemented through a software interface” |
| Point (9), physical connection | “a connection between electronic information systems or components implemented using physical means, including through electrical, optical or mechanical interfaces, wires or radio waves” |
| Point (10), indirect connection | “a connection to a device or network, which does not take place directly but rather as part of a larger system that is directly connectable to such device or network” |
What counts as a data connection under the CRA?
The Regulation does not define “data connection” itself. The Commission's guidance of 27 July 2026 fills the gap (paragraphs 27 and 28): a data connection transmits information in binary form. A sender deliberately encodes it, and a receiver can interpret it as data.
On that reading, an output that only switches on and off is not a data connection by itself. Neither are signals that only trigger or power a function. The FAQs give examples outside the CRA: a dishwasher, a basic calculator or a coffee machine with embedded firmware that cannot connect to any other device or network (FAQ 1.3).
Recital 9 gives the reason for the broad wording. Even less critical hardware can be the first step into a network. The obligation therefore covers “products that can be connected physically via hardware interfaces” and products that are only indirectly connected. The product also includes its remote data processing (Art. 3(1), FAQ 1.2): a cloud backend without which a device function fails falls under the CRA as well.
Questions
Is a USB port for firmware updates enough for the CRA to apply?
Data runs over the port from another device into the device. USB is an electrical interface (Art. 3(9)), and the Commission's FAQs name USB as an example of a physical connection (FAQ 1.3). That meets Art. 2(1), unless an exclusion in Art. 2 applies.
My device only talks to a controller, never to the internet. Does it fall under the CRA?
Yes. Art. 2(1) requires a data connection to a device or network; the internet is not a condition. An indirect connection through a larger system counts as well (Art. 3(10)).
My radio device already falls under the Radio Equipment Directive. Does the CRA apply anyway?
The Commission's FAQs say: the CRA applies to the radio equipment in scope of Delegated Regulation (EU) 2022/30. The Commission aims to repeal that Delegated Regulation as of 11 December 2027. If it does, radio equipment of the categories in 2022/30 placed on the market between 1 August 2025 and 10 December 2027 is subject to the cybersecurity requirements of the Radio Equipment Directive, and from 11 December 2027 to those of the CRA (FAQ 2.6.1).
Does the CRA apply to devices I already sell today?
The reporting obligation under Art. 14 has applied to them since 11 September 2026 (Art. 69(3)). The other requirements apply to products placed on the market before 11 December 2027 only if they are substantially modified from that date (Art. 69(2)).
Does the interface change the product class?
The interface decides whether the CRA applies. Whether the device is an important product depends on its core functionality under Annex III (Art. 7(1)).