Product Compliance And Certification For Smart Lock In The Eu

Scope and evidence must be confirmed before any paid tests or filings.

An EU smart-lock launch is not a single “CE certificate” exercise. A battery-powered Bluetooth lock may simultaneously be radio equipment, electrical/electronic equipment, a digital security product and a door-safety component. Start from the finished model, radio paths, software service and intended door—not the supplier’s certificate for its Bluetooth module.

Fix the product boundary before choosing the EU route

Document the facts below per SKU, firmware baseline and sold bundle. A lock, optional cloud bridge, phone application, power adapter and separately sold mechanical cylinder may not have identical legal classifications.

Radio: BLE, Wi‑Fi, Thread/Zigbee, NFC or other transmitter; band, power, antenna, country restrictions and supplied gateway.
Connectivity: whether the lock itself exchanges internet data, directly or through phone/hub; distinguish remote unlock from purely local control.
Data and access: names, guest credentials, unlock logs, biometrics, cloud location, retention and who controls the data.
Physical installation: retrofit knob or entire electromechanical lock; designated fire/escape door; power-loss and manual-release behaviour.
Commercial package: batteries, charging adapter, packaging, brand owner, country of first EU sale and importer.

No-radio variant: an electronic keypad lock with no radio communication function should not be routed through RED merely because a phone app or separate accessory exists. Assess EMC Directive 2014/30/EU for in-scope electronic apparatus and Low Voltage Directive 2014/35/EU only for in-scope electrical equipment rated at 50–1,000 V AC or 75–1,500 V DC, subject to exclusions. For a radio-equipped finished lock, RED itself covers its electrical-safety and EMC objectives; do not automatically duplicate those routes for the same apparatus.

EU smart-lock regulatory decision matrix

Legal layer / trigger	What it changes	Product-specific proof / decision
RED 2014/53/EU — radio transmitter	Normally applies to a finished lock intentionally emitting or receiving radio waves; covers electrical safety, EMC and spectrum performance. The RED safety objectives have no voltage floor.	Radio architecture; RF/EMC/safety assessments, applicable OJ-listed standards, EU DoC and CE mark.
RED cybersecurity — internet/data/payment	Since 1 August 2025, 2022/30 activates RED Art. 3(3)(d) for internet-connected radio equipment; (e) where specified personal/traffic/location data are processed; (f) if internet-connected equipment enables transfer of money or value. Assess each trigger, not “all wireless” by default.	Connection diagram, data map, remote-key threat model, EN 18031 applicability and exceptions.
RoHS 2011/65/EU — electrical/electronic equipment	Usually relevant to powered electronic locks within the directive’s scope; limits specified hazardous substances, subject to category and exemptions.	Component/material declarations and risk-based substance evidence for the finished unit.
WEEE 2012/19/EU — end-of-life electronics	Electronic locks may trigger national producer registration, take-back/financing and crossed-bin information; this is not a second CE certification.	Destination-country EPR allocations, WEEE category and visible disposal mark.
Batteries 2023/1542 — included cells	Check battery type, supply and producer obligations; portable-battery removability/replacement rules under Art. 11 apply from 18 February 2027, with stated exceptions.	Battery specification, waste route, user instructions and future design review.
GDPR 2016/679 — personal-data operations	If accounts, digital keys, biometric identifiers or attributable entry logs are processed, controller/processor roles and lawful, transparent, secure processing require analysis; GDPR is not a CE mark.	Data-flow diagram, roles, privacy information, access/retention controls and contracts.
CRA 2024/2847 — digital security product	Annex III Class I names smart-home security products including smart door locks, but classification is conditional. Under Implementing Regulation 2025/2392, category 17 covers digital products protecting consumer physical security in residential settings and controllable or manageable remotely from other systems (and central controllers). A hotel-only or non-remote design is not automatically category 17; assess the complete product and other CRA categories. Main obligations generally apply from 11 December 2027. Article 14 reporting applies from 11 September 2026, including to in-scope products already marketed before December 2027 (Article 69(3)).	Record residential versus professional intended use, remote-control/management architecture, core function, 2025/2392 category check, vulnerability reporting and future assessment route.
Construction/escape + GPSR 2023/988	An electromechanical lock supplied for regulated door assemblies or escape routes needs a separate check of construction-product/door-performance rules and installation requirements. GPSR addresses residual consumer risks not covered by sector rules.	Door claims, EN 14846/escape-hardware applicability check, failure-mode/egress assessment and installation limitations.
Packaging 2025/40 — retail/shipping pack	PPWR generally applies from 12 August 2026 on a phased basis; national producer/EPR arrangements and relevant packaging duties must be mapped separately from RED.	Packaging material and supplier records, Member State EPR/market allocation, phased marking review.

Keep two different tests separate: CRA category 17 asks about remote control or management from another system in residential security use; unlike the RED delegated cybersecurity test, its wording does not require internet communication. A phone-controlled, local-only BLE lock may therefore require CRA Class I category 17 assessment even if it is not internet-connected under RED 2022/30. Neither classification follows automatically from the word ‘smart’.

Classify the lock’s internet, personal-data and payment functions

An app is not enough to conclude the lock is “internet-connected” under the delegated act: assess whether the radio equipment can exchange internet data itself, directly or through intermediate equipment. Decide on the design and protocols actually supplied. Commission Delegated Regulation 2026/339 repeals the 2022/30 cyber delegated act with effect from 11 December 2027, when the CRA main rules start; surveillance for equipment placed on the market under the 2022/30 regime from 1 August 2025 to 10 December 2027 is preserved.

Configuration	RED 3(3) classification question	Required next investigation
Local BLE-only lock; app never relays lock data online	Radio requirements apply; internet-connected status cannot be presumed merely because the phone has internet.	Prove offline architecture and check whether another RED cyber category applies.
Lock + cloud bridge; remote unlocking or cloud guest keys	Internet path makes Art. 3(3)(d) a strong trigger; (e) where covered personal/traffic/location data are processed.	Trace lock–hub–cloud messages, authentication, updates, revocation and audit-log protection.
Fingerprint lock with local templates	Biometrics raise significant data and physical-security questions; local-only does not automatically bring a normal door lock under delegated internet-connected category.	Identify biometric data processing, controller role, fallback unlock and possible applicable RED (e) category.
In-lock paid access / transfers of monetary value	RED 3(3)(f) depends on an internet-connected radio device enabling transfers of money or monetary value—not merely a subscription paid on a separate website.	Document transaction functionality and assess EN 18031-3 and the OJ limitations.

Door use, escape routes and mechanical risk

A security claim (“burglary resistant”) does not establish suitability for a fire or escape door. EN 14846 is a product-related electromechanical door-hardware standard, not a blanket approval for every retrofit smart-lock actuator. Determine whether the lock/strike is within a harmonised construction-product route and whether the complete door assembly requires additional evidence. Record the inward egress path, mechanical override, battery depletion, jammed motor, fire alarm interaction and compatibility with the specified door. Do not claim suitability without verified assembly-level and local installation evidence.

Smart-lock technical evidence pack

Evidence / owner	What the file must demonstrate
Finished-product definition — manufacturer	Model variants, intended doors, wiring/batteries, radio bands, hub/app/software versions and accessories.
Regulatory applicability record — compliance lead	Dated yes/no/conditional decisions for RED, cyber, RoHS, batteries, waste, packaging, data, CRA and door use.
Radio/safety/EMC reports — test team	Results for final antenna/enclosure/power arrangement, risk assessment and chosen harmonised standards.
Cyber threat model — security lead	Pairing, guest-key expiry, credential revocation, remote-unlock abuse, OTA authenticity, cloud outage, default credentials.
Physical failure and door checks — engineering	Unlock/egress under flat battery, trapped bolt, fire or power loss; installation restrictions and mechanical testing.
Supplier chain records — procurement	RoHS declarations, battery data, component changes; supplier module CE report alone is insufficient.
EU DoC and label proofs — manufacturer/importer	Signed DoC covering applicable CE legislation, model identifier, CE/RED markings and local-language instructions.
After-sale programme — accountable owner	Vulnerability intake, correction/recall workflow, support policy, software release history and EPR registrations.

Who signs the conformity assessment and when is a notified body involved?

The brand owner marketing the finished lock under its name generally takes the manufacturer role, even when a third party assembles it. A non-EU brand needs the appropriate EU-based economic operator for covered harmonised products; an importer has independent verification and traceability duties. Under RED, the manufacturer draws up the technical file and EU declaration and keeps them for ten years after placement on the market.

CE marking follows conformity assessment; no EU agency issues a universal “CE certificate”. Under RED Article 17, internal production control may be possible for Article 3(1); for spectrum and activated cyber requirements under Article 3(2)/(3), the availability and full application of OJ-cited harmonised standards determine whether that internal route is available or a notified-body route is needed. EN 18031 standards were cited with restrictions in Decision 2025/138; inspect the restrictions rather than treating a test pass as blanket presumption of conformity. CRA Class I also has its own future conformity route; do not confuse the two assessments.

For a CRA Class I smart-home security lock, Article 32(2) permits the internal-control route only where the relevant harmonised standards, common specifications or qualifying cybersecurity certification schemes are fully applied. If those means are absent or only partly applied, the relevant requirements require the B+C or H third-party route. Do not reuse a RED notified-body decision as the CRA decision; verify the available conformity tools before the 2027 launch.

Labelling and release-to-market checks

Freeze the exact marketed kit: lock, gateway, batteries, power supply, firmware and phone/cloud features.
Complete risk and regulatory classification; resolve any notified-body involvement before declaring conformity.
Match RF, electrical safety, EMC, chemical, cybersecurity and mechanical evidence to the same finished variant.
Check CE marking, product identification, manufacturer/importer details, frequency/power information and RED instructions/DoC information.
Provide instructions, safety limits and installation warnings in languages required by each destination Member State.
Check WEEE/battery/packaging labels, EPR registrations and current PPWR stage separately from the CE file.
Confirm remote-key recovery, lost-phone, offline access and critical security fixes; do not release a fire-exit claim without its own evidence.

Three smart-lock configurations: go/no-go decisions

Typical product	Initial route	Hold release until
Retrofit BLE knob, local-only, replaceable cells	RED + likely RoHS; check battery, WEEE, packaging and remaining safety risks. Prove whether internet cyber trigger is absent.	Radio evidence and local-only architecture are documented; manual entry/exit and cell replacement are safe.
Wi‑Fi/cloud smart lock with remote guests	RED including relevant 2022/30 cyber branches; GDPR/data roles, RoHS, circular-economy and CRA workstreams.	Secure key lifecycle, firmware update process, EN 18031 restrictions and privacy flows are evidenced.
Smart mortise lock sold for hotel escape doors	Above routes plus door-hardware/egress/installation classification; potentially distinct assessment for lock and door assembly.	Escape mode and complete-door compatibility are verified; no unsupported fire/escape rating is advertised.

Change control after launch

Freeze evidence by hardware and firmware baseline. Reassess before the next batch when any of the following changes affect the original assumptions:

New radio chipset, antenna, power stage or enclosure → reconsider RF, EMC, safety and RED evidence.
Cloud bridge, remote-unlock feature or payment function added → reopen 2022/30 internet/data/payment classification and security controls.
New sensor, biometric retention, analytics or third-country cloud host → revisit GDPR roles and technical protections.
New door type, lockcase, egress claim or battery chemistry → revisit physical risk, installation limits and circular-economy records.

Official legal and guidance sources

These primary texts govern classification. A standard helps demonstrate compliance only to the extent of its applicable provisions and any Official Journal restrictions.

Smart-lock compliance: practical questions

Does CE marking on the Bluetooth module certify the whole lock?

No. The finished product, antenna, enclosure, power and software configuration need their own assessment and manufacturer DoC; the module file is supporting evidence only.

Does a BLE lock without Wi‑Fi always escape RED cybersecurity?

No automatic answer. Examine whether the lock can exchange data with the internet through its paired phone or bridge, as well as whether any other listed equipment category applies.

Is an EU notified body mandatory for every smart lock?

No. The RED conformity module depends on which essential requirements apply and whether the relevant OJ-cited harmonised standards are fully used; other routes and future CRA classification need their own analysis.

Can an ordinary smart lock be marketed for fire exits?

Not without checking the exact door, lock hardware and exit/egress requirements. Radio and cyber evidence does not prove the assembly can be used on an escape route.

Do GDPR compliance and EU cybersecurity rules mean the same thing?

No. RED/CRA concern product cybersecurity requirements; GDPR separately governs personal-data processing, actors and user rights. A secure lock may still lack a lawful data-processing arrangement.

Does every electronic lock, including a hotel-only lock, automatically become CRA Class I?

No. Annex III must be read together with Implementing Regulation 2025/2392, category 17: residential consumer physical-security use and remote control or management from another system are material. A professional-only or mechanically isolated product needs its own classification; being outside category 17 does not automatically exclude it from the CRA.