Smart home hubs, sensors and lighting

• Directive 2014/53/EU — Radio Equipment
• Delegated Regulation (EU) 2022/30 — cybersecurity
• Regulation (EU) 2024/2847 — Cyber Resilience Act
• Regulation (EU) 2016/679 — GDPR
• Directive 2012/19/EU — WEEE

Who has to appoint one

Manufacturers outside the Union placing smart home devices on the EU market. Presence sensors, thermostats and voice-enabled hubs generate data about when people are at home and what they do there, which is personal data even where no camera is involved.

Thresholds and exemptions

None. The cybersecurity requirements under the delegated Regulation apply to internet-connected radio equipment generally, and the CRA will apply to the whole category from December 2027.

What must appear on the label

CE marking, manufacturer and EU representative details, model and serial number, radio parameters, WEEE symbol, battery markings where fitted, and from December 2027 the support period and the vulnerability contact point.

Marketplace fields

Marketplaces require the EU responsible person and, since August 2025, expect the cybersecurity requirements to be met. Devices with default passwords or unauthenticated local APIs have been publicly criticised and delisted.

Documentation you must hold

EU declaration of conformity, technical file, radio and safety test reports, EN 18031 cybersecurity documentation, and from 2026 the CRA vulnerability handling process and SBOM. On the data side, the Article 30 record, the Article 27 designation, retention rules for event histories and the transfer mechanism.

Standards and testing

Radio and EMC testing under the applicable harmonised standards, EN IEC 62368-1 for safety, EN 18031 for the cybersecurity requirements, and IEC 62133 for batteries in sensors.

Language requirements

Instructions and warnings in the national language, and privacy information in the language of the users.

When it applies

Product documentation before placing on the market, cybersecurity requirements since August 2025, CRA reporting from September 2026 and full CRA from December 2027.

How long records are kept

Ten years for technical documentation or the support period if longer. Event histories should have a defined retention rather than accumulating indefinitely.

What happens if you do not comply

Withdrawal and marketplace removal on the product side, and data protection fines on the service side. A hub that stops working when the vendor discontinues the cloud also raises consumer law questions about conformity of the digital element.

Who enforces it

Market surveillance authorities and radio regulators, CSIRTs for CRA reporting, and data protection authorities.

Where the boundary lies

The support period declaration under the CRA has commercial consequences here: many smart home products have been abandoned by their vendors within a few years, and from 2027 the promised period becomes a legal statement rather than a marketing one.

Questions we are asked

Is presence data personal data?

Yes. Records of when a home is occupied identify the people who live there, and authorities treat them accordingly.

What if we discontinue the cloud service?

Under the digital content Directive, a product that stops delivering promised functionality can be non-conforming, giving consumers remedies, in addition to the CRA support period obligations.