CRA Smart TV Manufacturer Compliance 2027

Key numbers

Default

Smart TVs without security functionality are typically Default products. Module A self-assessment applies.

5-8 years

Expected smart TV lifecycle. Art. 13.8 requires security updates for the declared support period.

€149

Per TV model. Complete Annex VII documentation including support period declaration.

How CRACheck works

You enter your product data. CRACheck structures the documentation per Article 31 + Annex VII.

Classify your TV models

Smart TVs are typically Default products unless they include security functionalities (e.g., integrated alarm camera). Use CRACheck classifier.

Map the attack surface

WiFi/Ethernet, Bluetooth, USB, HDMI-CEC, streaming apps, voice assistant, browser, OTA update mechanism.

Define your support period

How many years will you provide firmware security updates? Art. 13.8 requires this to reflect expected use. For TVs, 5+ years is the expectation.

Generate Annex VII documentation

Enter specifications into CRACheck. 15-25 minutes per TV model.

Integrate with existing CE dossier

Add CRA documentation alongside EMC, LVD, RED and ErP technical files. Art. 31.3 allows a single documentation set.

Deliver to EU retailers

Major EU retailers (MediaMarkt, Fnac, Amazon) will require CRA compliance proof.

Common mistakes

❌

ART. 13.8

"We provide firmware updates for 2 years — same as warranty"

Article 13.8 requires the support period to reflect the expected time of use. Smart TVs are used for 5-8 years. A 2-year support period is inconsistent with how consumers use the product. Market surveillance authorities may consider it non-compliant.

❌

ANNEX I, PART I, 1(c)

"Our TV only streams content — there is no sensitive data to protect"

A smart TV processes WiFi credentials, streaming service login tokens, potentially voice recordings, and viewing history. Annex I Part I point 1(c) requires protection of confidentiality of stored, transmitted and processed data.

❌

ART. 13.5

"We use Android TV / Tizen / webOS — the platform vendor handles security"

Article 13.5 requires manufacturers to exercise due diligence when integrating third-party components. If your TV runs Android TV, Google provides the OS — but you are responsible for the complete product. Your customisations, pre-installed apps, hardware drivers and update delivery are your responsibility.

What the ZIP contains

8 PDF documents generated from your data. Each cites the specific article of Regulation (EU) 2024/2847 it complies with.

Product Classifier

Confirms Default or Important classification. Smart TVs are typically Default.

Technical Documentation

Art. 31 + Annex VII. Covers streaming architecture, voice processing, OTA update, USB/HDMI interfaces.

Risk Assessment

Art. 13.2-13.3. Includes unauthorized access to microphone/camera, credential theft, malware via USB.

User Information

Annex II. Privacy settings, parental controls, secure setup, secure disposal.

Declaration of Conformity

Art. 28 + Annex V.

CVD Policy

Vulnerability disclosure for smart TV firmware and apps.

Notification Template

Art. 14. Pre-structured for the 24h/72h/14d timeline.

Obligations Calendar

CRA dates with the extended support period for TVs.

See before you buy — Download sample dossier (PDF, fictional company) — Real structure, real articles, real format. Fictional data.

Generated from your data, in your browser. No data leaves your device.

What you pay

🧾 EUROPEAN PRODUCT COMPLIANCE CONSULTANCY (TV)

€10,000–€20,000

Per TV platform. 3-6 months. Requires product samples and firmware access.

✓ CRACHECK

€149

8 documents. 15 min. Per model. No firmware access required. Pack 10: €99/product.

Two layers

● LAYER 1

What CRACheck does

Generates Annex VII documentation for your smart TV. Covers WiFi/Bluetooth, streaming apps, voice processing, OTA updates, support period declaration.

∅ LAYER 2

What CRACheck does NOT do

CRACheck does not test your TV's firmware, scan pre-installed apps for malware or assess your OTA update reliability. Product security testing is separate from documentation.

We document. You secure the firmware and the update pipeline.

Enforcement regime

Article 64 of Regulation (EU) 2024/2847.

🔴

Non-compliance with Annex I + Art. 13/14 (Art. 64(2))

€15,000,000 / 2.5%

Art. 64.2.

🟠

Non-compliance with Art. 31, Art. 28, Art. 32 (Art. 64(3))

€10,000,000 / 2%

Art. 64.3.

🟡

Incorrect or misleading information (Art. 64(4))

€5,000,000 / 1%

Art. 64.4.

Alternatives

Criterion	European compliance consultancy	Rely on platform vendor compliance	Provide existing CE documentation	CRACheck
Cost	€10,000–€20,000	€0	€0	€149
Result	Per platform. 3-6 months.	Platform compliance does not cover your product-level obligations.	EMC/LVD/RED do not cover Annex I cybersecurity.	8 docs. 15 min. One model, one dossier.

Your TV lineup spans multiple models and sizes?

If models share the same firmware and hardware platform, one dossier per platform may suffice. Different platforms need separate dossiers. Volume pricing: €99/product (10-pack), €79/product (30-pack).

Request Volume Pricing

Response within one business day.

What CRACheck guarantees and what it does not

CRACheck generates a structured document according to Article 31 and Annex VII of Regulation (EU) 2024/2847 from the information you provide. The accuracy, completeness and truthfulness of that information is your responsibility as the manufacturer.

We guarantee that the document structure follows Article 31 and Annex VII of Regulation (EU) 2024/2847 and that the legal references cited are correct. We do not guarantee that a specific document will be accepted by a market surveillance authority in a specific case or by a commercial buyer in a procurement process.

CRACheck is not legal advice. For specific situations, consult a lawyer or specialised regulatory consultancy.

Frequently asked questions

Is a smart TV Default or Important under CRA?

Smart TVs are not listed in Annex III or Annex IV. They are Default products eligible for Module A self-assessment unless they include security functionalities listed in Annex III point 17.

Does the CRA require us to update TV firmware for 5+ years?

Article 13.8 requires you to provide security updates for the support period you declare. The support period must reflect expected use. For TVs, this is typically 5-8 years.

Our TV runs thousands of third-party streaming apps — do we document each one?

The SBOM covers software components you integrate or pre-install. Third-party apps installed by the user from an app store after purchase are not your responsibility. Pre-installed apps and the OS platform are.

Does the CRA cover smart TV advertising and tracking?

The CRA covers cybersecurity, not data protection. GDPR covers tracking. However, Annex I Part I point 1(f) requires data minimisation — collecting only data necessary for the intended purpose.

What about TVs already in consumers' homes?

Article 69 applies: products placed on the market before 11 December 2027 are subject to the CRA only upon substantial modification. Normal security patches do not constitute substantial modification.

Is this a subscription?

No. One-time payment. 30 days editing, 10 regenerations. PDF yours permanently.

Can I request a refund?

Pursuant to Art. 16(m) of Directive (EU) 2011/83, licence activation constitutes express consent. Refunds only for reproducible technical failures.

What if the regulation changes?

Regenerate at no additional cost during licence validity.

Official legal sources

Regulation (EU) 2024/2847 — Cyber Resilience Act — full text

⚠️ Important notice: CRACheck is a self-assessment documentation tool, not legal advice and not a third-party audit. The document under Article 31 and Annex VII of Regulation (EU) 2024/2847 is generated from your input data. You are responsible for the accuracy of the data you provide. CRACheck does not replace a qualified professional assessment.