Use ETSI EN 303 645 as technical evidence for consumer Internet of Things (IoT) controls, then map it to the EU CRA's separate legal scope, lifecycle duties, technical documentation, and conformity route.
The CRA reporting duties apply from 11 September 2026 and most other provisions from 11 December 2027. An ETSI assessment is supporting evidence, not automatic CRA conformity.
ETSI EN 303 645 V3.1.3 and the EU do different jobs. EN 303 645 is a voluntary baseline for network-connected consumer IoT devices; the CRA is binding EU law for products with digital elements made available on the EU market. A consumer IoT product may fall under both, but an EN 303 645 assessment does not establish CRA scope, satisfy every Annex I requirement, select the conformity-assessment route, or authorize CE marking. Reuse the ETSI control and test evidence only after mapping it to the same product version and the applicable CRA requirement.
Side-by-side comparison
ETSI EN 303 645 vs EU CRA: controls, evidence, and legal duties
The two instruments overlap on product-security controls but differ in scope, legal force, responsible actors, lifecycle duties, reporting, and conformity assessment.
A consumer IoT baseline standard covering high-level security and data-protection provisions for network-connected consumer IoT devices and their interactions with associated services.
Second framework
EU Cyber Resilience Act
Binding EU law for products with digital elements, with manufacturer, importer, distributor, conformity-assessment, CE-marking, vulnerability-handling, and reporting duties.
ETSI EN 303 645 vs EU CRA: controls, evidence, and legal duties
EN 303 645 V3.1.3 applies to consumer IoT devices connected to network infrastructure, such as the Internet or a home network, and to their interactions with associated services, which it defines as part of the overall consumer IoT product.
Grounds the consumer IoT scope and associated-services boundary.
their interactions with associated services
The CRA covers products with digital elements made available on the EU market when their intended or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. Article 2 excludes specified sectors and non-commercial free and open-source software; product-specific exclusions still need checking.
EN 303 645 addresses manufacturers and other relevant entities involved in developing or operating consumer IoT devices. It does not allocate legal duties; it describes baseline security behaviors that product teams, procurement functions, and assurance programs should verify.
Clause 4 identifies the device manufacturer and other relevant entities, and separates baseline requirements from testing and certification methods.
device manufacturer and/or other relevant entities
The CRA assigns the main design, risk-assessment, documentation, conformity, CE-marking, support, and vulnerability-handling duties to the manufacturer. Importers and distributors must verify specified compliance elements and act when they believe a product is non-compliant; an importer or distributor can become the manufacturer when marketing under its own name or making a substantial modification.
Articles 13, 19, 20 and 21 allocate manufacturer, importer, distributor, and deemed-manufacturer duties.
Assign ETSI evidence to product and security owners, but record the CRA manufacturer, importer, and distributor separately. Contracting out development or testing does not transfer the manufacturer's CRA duties.
EN 303 645 applies as a voluntary baseline whenever a product is a consumer IoT device connected to a network. No formal regulatory trigger is required; teams may apply the standard at design time, procurement, or assurance review for any network-connected consumer product.
Clause 1 defines the consumer IoT product scope; clause 4 explains its use as a technical baseline.
consumer IoT devices
The main CRA product requirements apply from 11 December 2027 to in-scope products placed on the EU market. Article 14 reporting applies from 11 September 2026, including to in-scope products already placed on the market. A pre-11 December 2027 product otherwise becomes subject to the substantive requirements when it undergoes a substantial modification after that date.
Articles 69 and 71 establish the transitional treatment and the 11 September 2026 and 11 December 2027 application dates.
Confirm CRA product-type classification before deciding how EN 303 645 evidence will be used, because the CRA may require different or additional conformity routes beyond what a voluntary EN 303 645 assessment covers.
Clauses 5.1-5.13 and 6 set the selected V3.1.3 security and data-protection topics.
No universal default passwords
CRA Annex I requires products to be designed, developed, and produced for an appropriate level of cybersecurity based on risk, made available without known exploitable vulnerabilities, securely configured by default where applicable, protected against unauthorized access, and supported by vulnerability-handling processes. Article 13 also requires a cybersecurity risk assessment, technical documentation, conformity assessment, an EU declaration of conformity, CE marking, and user information.
Article 13 and Annex I establish manufacturer duties and essential product-security and vulnerability-handling requirements.
Map EN 303 645 provisions to CRA essential requirements row by row if evidence reuse is intended, because the standard structure and the CRA requirement categories do not align one-to-one.
TS 103 701 structures ETSI assessment work around the Device Under Test, Supplier Organization, Test Laboratory, ICS, IXIT, test groups, and verdicts. Evidence should show the assessed product boundary, software version, tested provisions, test method, and a conformance claim that names the EN 303 645 edition used; this page uses V3.1.3.
Current edition used on this page for the consumer IoT baseline and provision references.
CRA Annex VII technical documentation must describe the product, design and development, vulnerability-handling processes, the cybersecurity risk assessment, applied standards or specifications, test reports, the EU declaration of conformity, and the support-period determination. ETSI records can support relevant entries only where the tested product boundary and requirement match.
Article 31 and Annex VII specify the CRA technical documentation and supporting material.
Tag each evidence item by source obligation: EN 303 645 assessment record, CRA technical documentation requirement, or shared supporting evidence. Do not treat a TS 103 701 compliance claim as a CRA conformity assessment without a separate review.
EN 303 645 expects all software components in consumer IoT devices that are not immutable for security reasons to be securely updateable. Teams should track support timelines and plan reassessment when key components reach end-of-life or when the assessed product configuration changes significantly.
Provision 5.3-1 qualifies updateability for components not immutable for security reasons; 5.3-13 requires publication of the defined support period.
defined support period
Manufacturers must notify an actively exploited vulnerability through the CRA reporting system with an early warning within 24 hours and a fuller notification within 72 hours, followed by a final report no later than 14 days after a corrective or mitigating measure is available. For a severe incident affecting product security, the deadlines are a 24-hour early warning, a 72-hour incident notification, and a final report within one month after that notification. These Article 14 duties apply from 11 September 2026.
Articles 14 and 71 establish the reporting events, staged notification clocks, and 11 September 2026 application date.
Use EN 303 645 support-timeline guidance as a design input and as evidence for the CRA product-lifecycle claim, but record the CRA deadline obligations separately and tie them to the legal entity responsible for market-surveillance cooperation.
EN 303 645 is a voluntary baseline standard. TS 103 701 supplies a conformance-assessment method and does not define a certification scheme or enforcement regime. A CRA enforcement decision depends on the applicable legal requirement and product facts, rather than an ETSI assessment result alone.
TS 103 701 provides the conformance assessment methodology for EN 303 645 claims without enforcement authority.
Member State market-surveillance authorities enforce the CRA and can require corrective action, prohibit or restrict a product, or order withdrawal or recall. The CRA sets maximum administrative fines by infringement category, including up to EUR 15 million or 2.5% of total worldwide annual turnover for breaches of the essential cybersecurity requirements.
Articles 53-58 and 64 establish market-surveillance measures and maximum administrative fines.
Do not describe an EN 303 645 compliance claim as CRA market-access conformity. Maintain a CRA conformity record identifying the selected Article 32 route, supporting standards, EU declaration, CE-marking basis, and responsible market-surveillance contacts.
TS 103 701 conformance assessment work for EN 303 645 can be reused in a CRA technical file if the product boundary, tested provisions, and methodology are documented and the CRA requirement mapping is explicit.
Grounds conceptual and functional tests and verdict assignment for ETSI assessment.
conceptual and functional
CRA technical documentation may include EN 303 645 and TS 103 701 records as supporting evidence. That reuse does not create a presumption of conformity unless an applicable harmonised standard or common specification covers the CRA requirement and the manufacturer meets the conditions for the chosen Article 32 route.
Articles 27, 28 and 32 govern presumptions of conformity and the conformity-assessment procedures.
When reusing EN 303 645 evidence for CRA, write a bridge document that lists: each CRA essential requirement, the EN 303 645 provision used, the test result, the product boundary match, and any gap requiring additional CRA-specific work.
Grounds TS 103 701 as the assessment method for baseline requirements.
assessment procedure
Use official CRA materials when the question is who is legally obligated, when obligations apply, which conformity route is required, or what public legal claim can be made.
Supports an evidence-first approach using structured assessment artifacts.
derive a test plan
Scope
ETSI EN 303 645
EN 303 645 V3.1.3 applies to consumer IoT devices connected to network infrastructure, such as the Internet or a home network, and to their interactions with associated services, which it defines as part of the overall consumer IoT product.
Grounds the consumer IoT scope and associated-services boundary.
their interactions with associated services
EU Cyber Resilience Act
The CRA covers products with digital elements made available on the EU market when their intended or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. Article 2 excludes specified sectors and non-commercial free and open-source software; product-specific exclusions still need checking.
Clause 1 defines the selected V3.1.3 consumer-device and associated-service boundary.
network infrastructure
Who must act
ETSI EN 303 645
EN 303 645 addresses manufacturers and other relevant entities involved in developing or operating consumer IoT devices. It does not allocate legal duties; it describes baseline security behaviors that product teams, procurement functions, and assurance programs should verify.
Clause 4 identifies the device manufacturer and other relevant entities, and separates baseline requirements from testing and certification methods.
device manufacturer and/or other relevant entities
EU Cyber Resilience Act
The CRA assigns the main design, risk-assessment, documentation, conformity, CE-marking, support, and vulnerability-handling duties to the manufacturer. Importers and distributors must verify specified compliance elements and act when they believe a product is non-compliant; an importer or distributor can become the manufacturer when marketing under its own name or making a substantial modification.
Articles 13, 19, 20 and 21 allocate manufacturer, importer, distributor, and deemed-manufacturer duties.
Operational implication
Assign ETSI evidence to product and security owners, but record the CRA manufacturer, importer, and distributor separately. Contracting out development or testing does not transfer the manufacturer's CRA duties.
Clause 4 identifies the device manufacturer and other relevant entities, and separates baseline requirements from testing and certification methods.
device manufacturer and/or other relevant entities
Trigger or threshold
ETSI EN 303 645
EN 303 645 applies as a voluntary baseline whenever a product is a consumer IoT device connected to a network. No formal regulatory trigger is required; teams may apply the standard at design time, procurement, or assurance review for any network-connected consumer product.
Clause 1 defines the consumer IoT product scope; clause 4 explains its use as a technical baseline.
consumer IoT devices
EU Cyber Resilience Act
The main CRA product requirements apply from 11 December 2027 to in-scope products placed on the EU market. Article 14 reporting applies from 11 September 2026, including to in-scope products already placed on the market. A pre-11 December 2027 product otherwise becomes subject to the substantive requirements when it undergoes a substantial modification after that date.
Articles 69 and 71 establish the transitional treatment and the 11 September 2026 and 11 December 2027 application dates.
Operational implication
Confirm CRA product-type classification before deciding how EN 303 645 evidence will be used, because the CRA may require different or additional conformity routes beyond what a voluntary EN 303 645 assessment covers.
Clauses 5.1-5.13 and 6 set the selected V3.1.3 security and data-protection topics.
No universal default passwords
EU Cyber Resilience Act
CRA Annex I requires products to be designed, developed, and produced for an appropriate level of cybersecurity based on risk, made available without known exploitable vulnerabilities, securely configured by default where applicable, protected against unauthorized access, and supported by vulnerability-handling processes. Article 13 also requires a cybersecurity risk assessment, technical documentation, conformity assessment, an EU declaration of conformity, CE marking, and user information.
Article 13 and Annex I establish manufacturer duties and essential product-security and vulnerability-handling requirements.
Operational implication
Map EN 303 645 provisions to CRA essential requirements row by row if evidence reuse is intended, because the standard structure and the CRA requirement categories do not align one-to-one.
Supports converting ETSI topics into assessment artifacts and test evidence.
test scenarios for consumer IoT
Evidence and records
ETSI EN 303 645
TS 103 701 structures ETSI assessment work around the Device Under Test, Supplier Organization, Test Laboratory, ICS, IXIT, test groups, and verdicts. Evidence should show the assessed product boundary, software version, tested provisions, test method, and a conformance claim that names the EN 303 645 edition used; this page uses V3.1.3.
Current edition used on this page for the consumer IoT baseline and provision references.
EU Cyber Resilience Act
CRA Annex VII technical documentation must describe the product, design and development, vulnerability-handling processes, the cybersecurity risk assessment, applied standards or specifications, test reports, the EU declaration of conformity, and the support-period determination. ETSI records can support relevant entries only where the tested product boundary and requirement match.
Article 31 and Annex VII specify the CRA technical documentation and supporting material.
Operational implication
Tag each evidence item by source obligation: EN 303 645 assessment record, CRA technical documentation requirement, or shared supporting evidence. Do not treat a TS 103 701 compliance claim as a CRA conformity assessment without a separate review.
Supports maintaining structured, reusable ETSI assessment evidence.
Implementation Conformance Statement
Timing and cadence
ETSI EN 303 645
EN 303 645 expects all software components in consumer IoT devices that are not immutable for security reasons to be securely updateable. Teams should track support timelines and plan reassessment when key components reach end-of-life or when the assessed product configuration changes significantly.
Provision 5.3-1 qualifies updateability for components not immutable for security reasons; 5.3-13 requires publication of the defined support period.
defined support period
EU Cyber Resilience Act
Manufacturers must notify an actively exploited vulnerability through the CRA reporting system with an early warning within 24 hours and a fuller notification within 72 hours, followed by a final report no later than 14 days after a corrective or mitigating measure is available. For a severe incident affecting product security, the deadlines are a 24-hour early warning, a 72-hour incident notification, and a final report within one month after that notification. These Article 14 duties apply from 11 September 2026.
Articles 14 and 71 establish the reporting events, staged notification clocks, and 11 September 2026 application date.
Operational implication
Use EN 303 645 support-timeline guidance as a design input and as evidence for the CRA product-lifecycle claim, but record the CRA deadline obligations separately and tie them to the legal entity responsible for market-surveillance cooperation.
Provision 5.3-1 qualifies updateability for components not immutable for security reasons; 5.3-13 requires publication of the defined support period.
defined support period
Enforcement and assurance route
ETSI EN 303 645
EN 303 645 is a voluntary baseline standard. TS 103 701 supplies a conformance-assessment method and does not define a certification scheme or enforcement regime. A CRA enforcement decision depends on the applicable legal requirement and product facts, rather than an ETSI assessment result alone.
TS 103 701 provides the conformance assessment methodology for EN 303 645 claims without enforcement authority.
EU Cyber Resilience Act
Member State market-surveillance authorities enforce the CRA and can require corrective action, prohibit or restrict a product, or order withdrawal or recall. The CRA sets maximum administrative fines by infringement category, including up to EUR 15 million or 2.5% of total worldwide annual turnover for breaches of the essential cybersecurity requirements.
Articles 53-58 and 64 establish market-surveillance measures and maximum administrative fines.
Operational implication
Do not describe an EN 303 645 compliance claim as CRA market-access conformity. Maintain a CRA conformity record identifying the selected Article 32 route, supporting standards, EU declaration, CE-marking basis, and responsible market-surveillance contacts.
Clause 4 states that the standard defines neither a testing nor a certification method.
does not define a testing or certification
Overlap and reuse
ETSI EN 303 645
TS 103 701 conformance assessment work for EN 303 645 can be reused in a CRA technical file if the product boundary, tested provisions, and methodology are documented and the CRA requirement mapping is explicit.
Grounds conceptual and functional tests and verdict assignment for ETSI assessment.
conceptual and functional
EU Cyber Resilience Act
CRA technical documentation may include EN 303 645 and TS 103 701 records as supporting evidence. That reuse does not create a presumption of conformity unless an applicable harmonised standard or common specification covers the CRA requirement and the manufacturer meets the conditions for the chosen Article 32 route.
Articles 27, 28 and 32 govern presumptions of conformity and the conformity-assessment procedures.
Operational implication
When reusing EN 303 645 evidence for CRA, write a bridge document that lists: each CRA essential requirement, the EN 303 645 provision used, the test result, the product boundary match, and any gap requiring additional CRA-specific work.
Grounds TS 103 701 as the assessment method for baseline requirements.
assessment procedure
EU Cyber Resilience Act
Use official CRA materials when the question is who is legally obligated, when obligations apply, which conformity route is required, or what public legal claim can be made.
Supports an evidence-first approach using structured assessment artifacts.
derive a test plan
Practical decision rule
How to decide what controls the work
Use ETSI EN 303 645 when the task is to define or evidence consumer IoT baseline security controls.
Use ETSI TS 103 701 when the task is to assess those controls with DUT, ICS, IXIT, tests, verdicts, and external evidence.
Use official CRA analysis when the task is legal scope, economic-operator duty, conformity route, application timing, enforcement, or a public CRA compliance claim.
Grounds the conformance-assessment role of TS 103 701.
Conformance Assessment of Baseline Requirements
1
Section 1
How do the technical controls and legal duties overlap?
EN 303 645 V3.1.3 covers connected consumer IoT devices and their interactions with associated services, which it defines as part of the overall consumer IoT product. The CRA instead covers products with digital elements whose intended or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network, subject to exclusions in Article 2.
The strongest overlap is technical: vulnerability reporting, secure updates, protection of security parameters, secure communications, attack-surface reduction, software integrity, resilience, telemetry, deletion, and input validation. The CRA adds binding manufacturer duties, a cybersecurity risk assessment, technical documentation, instructions, CE marking, conformity assessment, post-market vulnerability handling, and regulatory reporting.
Use EN 303 645 to define the consumer IoT product-security baseline and the device-to-associated-service boundary.
Use TS 103 701 to shape assessment evidence around Device Under Test (DUT), Supplier Organization, Test Laboratory, Implementation Conformance Statement (ICS), Implementation eXtra Information for Testing (IXIT), test plans, verdicts, and external evidence.
Do not present ETSI EN 303 645 evidence as CRA compliance. Record the matching CRA provision, any uncovered condition, and the conformity route before relying on it in the EU declaration of conformity.
Articles 2, 13, 14, 28-32, 69 and 71 and Annexes I and VII establish CRA scope, manufacturer and reporting duties, conformity assessment, transitional rules, application dates, and technical documentation.
2
Section 2
How to use ETSI evidence in a CRA workstream
Treat EN 303 645 as an evidence-producing standard for consumer IoT. Reuse requires the CRA obligation and product boundary to match the ETSI evidence boundary; associated services identified under EN 303 645 may also form part of the CRA product's remote data-processing solution and risk assessment.
The bridge matrix should show the CRA Annex I requirement, the ETSI provision, the evidence artifact, the product release or DUT boundary, the owner, and the remaining gap. It should also identify whether the product is outside the listed important and critical classes, important class I, important class II, or critical because that classification can change the permitted conformity route.
Start with the ETSI product boundary: consumer IoT device, software, user interface, update mechanism, telemetry path, and interactions with associated services.
Name the evidence artifact: provision map, ICS declaration, IXIT entry, conceptual test, functional test, software update record, vulnerability disclosure record, telemetry review, or deletion-function proof.
For each CRA row, record scope, responsible economic operator, Annex I requirement, support period, conformity route, application date, and whether additional evidence is needed.
Articles 2, 7, 8, 13 and 32 and Annexes I, III and IV support the CRA scope, product classification, manufacturer, essential-requirement, and conformity-route columns.
Recommended next step
Separate standard evidence from legal conclusions
Use Sorena to turn EN 303 645 provisions and TS 103 701 assessment records into a traceable evidence pack before mapping it to EU CRA duties.
The ETSI controls most likely to help a CRA readiness project are the ones that already produce product-specific proof. Generic policies are weaker than release-specific evidence tied to the DUT, software version, support period, update process, interfaces, telemetry, and user-data lifecycle.
For example, EN 303 645 expects software components in consumer IoT devices to be securely updateable, expects manufacturers to publish the defined support period, and describes telemetry examination for security anomalies when telemetry data is collected. The CRA requires manufacturers to determine a support period that generally lasts at least five years, unless the product is expected to be used for less than five years, and to handle vulnerabilities effectively throughout that period. The CRA rule is not replaced by the ETSI support-period statement.
Secure updates: capture the update mechanism, authenticity and integrity controls, user notification flow, support-period publication, and update evidence.
Vulnerability handling: keep the reporting channel, triage process, affected component list, remediation decision, and disclosure records.
Personal data and telemetry: record what personal data and telemetry are processed, why they are used, who uses them, and how users receive clear information.
Deletion and lifecycle: prove that users can remove user data from the device and personal data from associated services in the relevant scenarios.
Article 13 and Annex I Part II establish the manufacturer's support-period and vulnerability-handling duties that must be mapped separately from ETSI evidence.
4
Section 4
Where ETSI evidence should not be overclaimed
EN 303 645 is not a CRA compliance manual. It does not allocate CRA duties among manufacturers, importers, and distributors; establish CRA reporting clocks; classify important or critical products; select conformity-assessment modules; or create a CRA presumption of conformity.
Most CRA provisions apply from 11 December 2027. Article 14 reporting applies from 11 September 2026, and the conformity-assessment-body provisions in Chapter IV apply from 11 June 2026. Products placed on the market before 11 December 2027 generally enter the substantive product requirements only after a substantial modification, but Article 14 reporting applies to all in-scope products, including those placed on the market earlier.
Avoid phrases such as "CRA compliant through EN 303 645" unless supported by official CRA and harmonized-standard materials.
Do not copy the ETSI associated-service boundary into CRA scoping without checking CRA product and service definitions separately.
Keep legal triggers, conformity routes, Article 14 reporting, and market-surveillance exposure in a separate CRA-owned column.
Articles 14, 69 and 71 establish the reporting application date, transition for products already on the market, and general application date.
5
Section 5
A practical bridge-matrix workflow
Build the bridge matrix only after separating the ETSI and CRA scopes. Populate the ETSI columns from EN 303 645 provisions and TS 103 701 assessment evidence. Populate the CRA columns from the regulation, including the applicable Annex I requirement, product class, support period, Article 32 conformity route, and any reporting duty.
Leave a row marked "not assessed" when the product facts, CRA classification, or source mapping are incomplete. Do not fill the gap with an ETSI conformance verdict.
Column 1: ETSI provision or TS 103 701 test objective.
Grounds the use of DUT identification, ICS, IXIT, test plans, verdicts, and external evidence in the ETSI evidence half of the matrix.
The TL uses these documents to derive a test plan.
6
Section 6
Checklist before publishing an ETSI-to-CRA claim
Before a team publishes a customer-facing statement, procurement response, or audit summary, check that every claim is tied to the correct source. ETSI evidence can be strong and still be insufficient for a CRA statement if the legal hook is missing.
Confirm the page names EN 303 645 as a consumer IoT baseline, not as a full CRA compliance route.
Verify that the ETSI source version, product boundary, associated-service assumptions, support period, and evidence artifacts are named.
Keep CRA-specific claims limited to what the reviewed CRA source says; otherwise mark them as unresolved mapping work.
Make each reused evidence item traceable to a release, DUT, test plan, or assessment window.
Primary legal source for the CRA scope, economic-operator obligations, essential cybersecurity requirements, conformity assessment, timing, market surveillance, and enforcement side of the comparison.
Articles 2, 13, 14, 28-32, 69 and 71 and Annexes I and VII establish CRA scope, manufacturer and reporting duties, conformity assessment, transitional rules, application dates, and technical documentation.
Articles 2, 7, 8, 13 and 32 and Annexes I, III and IV support the CRA scope, product classification, manufacturer, essential-requirement, and conformity-route columns.
Show 11 more
Article 13 and Annex I Part II establish the manufacturer's support-period and vulnerability-handling duties that must be mapped separately from ETSI evidence.
Articles 14, 69 and 71 establish the reporting application date, transition for products already on the market, and general application date.
Articles 2 and 3 establish the CRA product scope, exclusions, and key definitions.
Articles 13, 19, 20 and 21 allocate manufacturer, importer, distributor, and deemed-manufacturer duties.
Articles 69 and 71 establish the transitional treatment and the 11 September 2026 and 11 December 2027 application dates.
Article 13 and Annex I establish manufacturer duties and essential product-security and vulnerability-handling requirements.
Article 31 and Annex VII specify the CRA technical documentation and supporting material.
Articles 14 and 71 establish the reporting events, staged notification clocks, and 11 September 2026 application date.
Articles 53-58 and 64 establish market-surveillance measures and maximum administrative fines.
Articles 27, 28 and 32 govern presumptions of conformity and the conformity-assessment procedures.
The CRA is the controlling source for legal scope, duties, timing, conformity assessment, CE marking, reporting, and enforcement.