Certifying a smart lock: RED, CRA, CPR and lock standards

Hugues Orgitelloupdated 7 Oct 202614 min read

The smart door lock is one of the few connected products the EU texts name by name. Annex III of the Cyber Resilience Act lists "smart door locks" among the important products of class I, and Implementing Regulation (EU) 2025/2392 describes the category as products that protect the physical security of consumers in a residential setting and can be controlled or managed remotely. The same lock is radio equipment under the RED, a product with a battery under Regulation (EU) 2023/1542, and, on an escape route or a fire door, building hardware under the Construction Products Regulation, where the cited lock standards are older than most people expect. This guide walks each layer from the texts, with the dates that apply up to 2027.

The layers and their texts

No layer exempts another. The RED absorbs safety and EMC for a radio product, but the CPR, the CRA and the Battery Regulation run alongside it.

Layer	Trigger in the lock	EU text	US and Canada	Detailed guide
Radio	Bluetooth LE, Zigbee, Thread, Wi-Fi, UWB, NFC	Directive 2014/53/EU (RED) Articles 3(1)(b) and 3(2)	47 CFR Part 15, ISED RSS-247	RED checklist
Safety	Any electrical supply, cells included	RED Article 3(1)(a), LVD objectives with no voltage limit	No federal radio rule	IEC 62368-1
Cybersecurity	Internet connection, personal data	RED Article 3(3)(d), (e) with EN 18031, then the CRA	Voluntary Cyber Trust Mark	CRA
Battery and environment	Cells, substances, waste	Regulation (EU) 2023/1542, RoHS, REACH, WEEE	California Proposition 65	Battery regulation
Building hardware	Lock, exit device or door furniture covered by a cited standard	CPR, EN 14846, EN 179, EN 1125	Voluntary ANSI/BHMA and UL standards, local codes	CPR
Ecosystem	Logo or interoperability claim	Bluetooth SIG, Thread Group, Matter, Aliro (private programmes)	Same	Matter

For the general sequence of a project, see getting started with certification.

Dated obligations, 2025 to 2027

Date	What applies	Text
30 January 2025	EN 18031-1, -2 and -3:2024 cited, with restrictions	Implementing Decision (EU) 2025/138
28 April 2025	ANSI/BHMA A156.40 (residential deadbolts) revised, BHMA announcement	BHMA
1 August 2025	RED Article 3(3)(d), (e), (f) apply to the categories of Delegated Regulation 2022/30	Delegated Regulation (EU) 2023/2444
18 August 2025	Separate collection symbol on every battery	Regulation (EU) 2023/1542, Article 13(4)
1 December 2025	Technical description of the CRA Annex III categories published	Implementing Regulation (EU) 2025/2392
8 January 2026	New CPR applies; standards cited under Regulation 305/2011 stay valid until withdrawn	Regulation (EU) 2024/3110, Articles 94 and 95(3)
26 February 2026	Aliro 1.0 released with a certification programme	Connectivity Standards Alliance
11 June 2026	CRA Chapter IV (notified bodies) applies	Regulation (EU) 2024/2847, Article 71
18 August 2026, or 18 months after the implementing act if later	General information label on batteries; capacity label for rechargeable portable batteries; minimum average duration label for non-rechargeable ones	Regulation (EU) 2023/1542, Article 13(1) to (3)
11 September 2026	CRA reporting of actively exploited vulnerabilities and severe incidents	Regulation (EU) 2024/2847, Articles 14 and 71
18 February 2027	Portable batteries readily removable and replaceable by the end user	Regulation (EU) 2023/1542, Article 11
11 December 2027	CRA applies in full; Delegated Regulation 2022/30 repealed	Regulation (EU) 2024/2847, Article 71; Delegated Regulation (EU) 2026/339

Radio layer: RED, FCC, ISED

Regulatory radio conformity

Under Article 3(2) of Directive 2014/53/EU, a lock transmitting in the 2.4 GHz band (Bluetooth LE, Zigbee, Thread, 2.4 GHz Wi-Fi) uses EN 300 328 V2.2.2. EMC under Article 3(1)(b) uses EN 301 489-17 V3.3.1, cited by Decision (EU) 2025/893; EN 301 489-1 is the common part and is not cited on its own. In the US the transmitter is authorised under 47 CFR 15.247 (15.407 for 5 GHz Wi-Fi) and receives an FCC ID; the digital circuitry falls under Part 15 subpart B. In Canada, RSS-247 applies with RSS-102 for RF exposure.

Radio in the lock	EU (Article 3(2))	US	Canada
Bluetooth LE, Zigbee, Thread, Wi-Fi 2.4 GHz	EN 300 328 V2.2.2	47 CFR 15.247	RSS-247
Wi-Fi 5 GHz	EN 301 893 V2.2.1	47 CFR 15.407	RSS-247
UWB (hands-free unlocking)	See the UWB guide	Part 15 subpart F	See the UWB guide
EMC of the whole lock	EN 301 489-17 V3.3.1	Part 15 subpart B	ICES-003

RF exposure belongs to Article 3(1)(a). EN 62311 and EN 62479 are not cited under the RED: when they are used, they are other technical specifications justified in the technical file. Details per standard are in RED tests and FCC tests; for the two North American systems see ISED versus FCC.

Under Article 17 of the RED, internal production control (module A) is available for Articles 3(2) and 3(3) only when the cited harmonised standards are applied in full; otherwise a notified body is involved. Under the FCC rules a pre-certified module keeps its modular grant within its conditions (47 CFR 15.212); the RED has no modular grant, so module reports are evidence and the lock maker declares the finished product.

Ecosystem programmes

These are private programmes, separate from spectrum law:

• Bluetooth LE: Bluetooth SIG qualification to use the Bluetooth name and logo.
• Zigbee: Zigbee certification by the Connectivity Standards Alliance.
• Thread: Thread Group certification.
• Wi-Fi: Wi-Fi Alliance certification.
• Matter: Matter certification; the Alliance asks for the network transport (Thread or Wi-Fi) to be certified by its own body first. Door Lock is a Matter device type.
• Aliro: released as version 1.0 on 26 February 2026 by the Connectivity Standards Alliance, for phones and wearables presenting credentials to readers and locks over NFC, Bluetooth LE, or Bluetooth LE plus UWB. The Alliance states that Aliro "includes a comprehensive certification program and supporting test suites managed through Authorized Test Labs". FiRa Core 3.0 (14 January 2025) added Aliro UWB features and Core 4.0 (3 December 2025) completed their scope, see the UWB guide. The CCC Digital Key is the vehicle-access counterpart, not a building-lock programme.

Safety layer: the RED, not the LVD

Article 1(4) of the RED states that radio equipment within its scope "shall not be subject to Directive 2014/35/EU, except as set out in point (a) of Article 3(1)". Article 3(1)(a) applies the LVD safety objectives "but with no voltage limit applying". So the supply voltage does not change the regime of a radio lock: AA cells, a lithium pack and a mains supply are all assessed for safety under the RED.

IEC 62368-1 is the usual product safety standard for this kind of electronics; it is not cited under the RED (under the LVD the cited edition is EN 62368-1:2014 + AC:2015), so it is listed in the technical file as another technical specification. A separate external mains adapter is not radio equipment and is LVD equipment in its own right.

Supply	Safety route	Battery evidence
Alkaline AA or AAA cells	RED Article 3(1)(a), EN 62368-1 as another specification	Battery Regulation labelling of the cells
Primary lithium cell	Same	UN 38.3 for transport; IEC 60086-4 for primary lithium safety
Rechargeable lithium pack	Same	UN 38.3; IEC 62133-2 for secondary lithium
Mains, internal supply	Same, with mains insulation in the assessment	None
External adapter	Lock: RED; adapter: LVD	None

The tests are in battery safety and transport and shipping in lithium shipping.

Cybersecurity layer: RED Article 3(3), then the CRA

RED Article 3(3)

Delegated Regulation (EU) 2022/30 sets which radio equipment is caught:

Point	Applies to a lock when	Cited standard
3(3)(d), network protection	It "can communicate itself over the internet, whether it communicates directly or via any other equipment" (Article 1(1))	EN 18031-1
3(3)(e), personal data and privacy	It is internet-connected and can process personal data, traffic data or location data (Article 1(2)(a))	EN 18031-2
3(3)(f), protection from fraud	It is internet-connected and "enables the holder or user to transfer money, monetary value or virtual currency" (Article 1(3))	EN 18031-3

A typical lock with an app and a cloud service is caught by points (d) and (e), not by (f). The EN 18031 standards are CEN-CENELEC standards cited by Decision (EU) 2025/138 with restrictions. The one that matters most for a lock: the standards give no presumption if, under clauses 6.2.5.1 and 6.2.5.2, "the user is allowed not to set and use any password". A lock that offers that option needs a notified body for the points concerned. See the EN 303 645 guide for how the ETSI consumer IoT baseline, which is not cited, relates to EN 18031.

Cyber Resilience Act: class I, point 17

Annex III, class I, point 17 of Regulation (EU) 2024/2847 reads: "Smart home products with security functionalities, including smart door locks, security cameras, baby monitoring systems and alarm systems". Implementing Regulation (EU) 2025/2392 describes it as products "that protect the physical security of consumers in a residential setting and which can be controlled or managed remotely from other systems, as well as hardware and software that centrally control such products", including "smart door locking devices". The hub or app that centrally controls the lock is therefore in the same category.

CRA provision	Content for a smart lock
Annex III, class I, point 17	Residential smart door locks controllable remotely; the controlling hub and software too
Annex III, class I, point 1	Identity and access management systems, including "authentication and access control readers"; the 2025/2392 description covers access to "physical locations"
Article 32(2)	Module A only if harmonised standards, common specifications or a certification scheme at level "substantial" are applied in full; otherwise module B with C, or module H
Article 13(8)	Support period of at least five years, unless the product is expected to be in use for less
Article 14	Reporting of actively exploited vulnerabilities and severe incidents, from 11 September 2026
Article 71	Chapter IV from 11 June 2026, everything else from 11 December 2027

Delegated Regulation 2022/30 is repealed from 11 December 2027 by Delegated Regulation (EU) 2026/339, when the CRA takes over cybersecurity for radio products. Outside the EU: EN 303 645 covers the UK PSTI regime and the Singapore label; in the US, the Cyber Trust Mark is voluntary, built on NIST IR 8425 (see NIST IR 8425): UL Solutions withdrew as Lead Administrator effective 19 December 2025 and the ioXt Alliance was selected on 13 April 2026.

Battery and environment

Obligation	Content for a lock	Guide
Regulation (EU) 2023/1542, Article 11	From 18 February 2027, portable batteries in a product must be "readily removable and replaceable by the end-user", with commercially available tools; Article 11(3) exempts cases where continuity of power and a permanent connection are required for the safety of the user and the appliance	Battery regulation
Regulation (EU) 2023/1542, Article 13	Collection symbol since 18 August 2025; general information label and capacity (rechargeable) or minimum average duration (non-rechargeable) label from 18 August 2026 at the earliest. These are labels on the battery	Battery regulation
Directive 2011/65/EU (RoHS)	Restricted substances in the electronics	RoHS
REACH	Candidate List substances, SCIP notification	REACH
WEEE	Crossed-out wheeled bin, producer registration	WEEE

For California, see Proposition 65; supply-chain reporting is in conflict minerals.

Building hardware layer: what the CPR actually cites

This layer does not belong to radio CE marking. Under the CPR, a construction product covered by a harmonised standard cited in the Official Journal gets a declaration of performance and CE marking under that regulation; the scope and intended uses are set by the standard itself. Regulation (EU) 2024/3110 has applied since 8 January 2026, and standards cited under Regulation 305/2011 "shall remain valid" until withdrawn (Article 95(3)).

The Commission summary list of 9 February 2026 gives this status for lock-related standards:

Standard	Subject	Cited under the CPR?
EN 12209:2003 (with AC:2005)	Mechanically operated locks, latches and locking plates	Yes, the 2003 edition only
EN 12209:2016, EN 12209:2024	Later editions of the same	No; BSI withdrew the 2016 edition on 10 January 2025 in favour of the 2024 one
EN 14846:2008	Electromechanically operated locks and striking plates	Yes
EN 179:2008	Emergency exit devices operated by a lever handle or push pad, for escape routes	Yes
EN 1125:2008	Panic exit devices operated by a horizontal bar, for escape routes	Yes
EN 16034:2014	Fire resisting and smoke control characteristics of door sets, with EN 14351-1 or EN 13241	Yes
EN 16867:2020 with A1 and A2	Mechatronic door furniture	No
EN 15684	Mechatronic cylinders	No
EN 13637	Electrically controlled exit systems for escape routes	No
EN 1906	Lever handles and knob furniture	No

EN 16867 is the standard that describes most retrofit and keypad smart locks: it applies to mechatronic door furniture "fitted on the door set which gives the possibility to control the locking and/or release part through an electronic authorization means", operable by card, code or biometric credential. It is combined with locks to EN 12209, EN 14846 or EN 15685, or forms part of an exit device to EN 179, EN 1125 or EN 13637. It excludes mechatronic cylinders (EN 15684) and electromechanical locks (EN 14846). Its suitability on fire or smoke doors is determined by fire resistance tests in addition to its own tests. Because it is not cited, it gives no CPR presumption: it is a voluntary performance standard.

Which hardware a door needs (an exit device, a fire-rated lock, an electrically controlled exit system) is decided by national building and fire-safety rules, not by these product standards. On a certified fire door, check the door test or classification report before fitting any lock.

United States

The ANSI/BHMA A156 series and UL standards are voluntary consensus standards; nothing in the FCC rules requires them. Two catalogue entries are relevant to locks: ANSI/BHMA A156.40, residential deadbolts, revised in 2025, and UL 437, key locks, edition 8 of 15 May 2013, reaffirmed as an American National Standard on 31 January 2023. Building and fire codes adopted locally decide what is required on egress doors.

Claims the texts contradict

Common claim (some made by earlier versions of this page)	What the texts say
"A battery lock escapes the LVD, but a mains-powered radio lock falls under the full LVD."	Article 1(4) of the RED: radio equipment is not subject to the LVD; Article 3(1)(a) applies its safety objectives with no voltage limit, whatever the supply.
"RED 3.3 requires network, personal data and fraud protection for every connected lock."	Point (f) applies only to internet-connected equipment that enables the transfer of money, monetary value or virtual currency (Article 1(3) of 2022/30).
"The CRA only applies from 11 December 2027."	Article 14 reporting has applied since 11 September 2026 and Chapter IV since 11 June 2026 (Article 71).
"A smart lock is a default-category CRA product."	Annex III, class I, point 17 names smart door locks; module A is open only under the conditions of Article 32(2).
"A notified body is needed when the lock goes on a fire door."	Notified bodies under the RED depend on whether cited standards are applied in full (Article 17). Fire doors are a CPR matter with their own standards and bodies.
"EN 62311 is the EU standard for RF exposure of the lock."	EN 62311 is not cited under the RED; it can only be used as another technical specification, justified in the file.
"EN 12209 and EN 1906 are the cited standards for door locks and handles."	The CPR list cites EN 12209:2003, not the 2016 or 2024 editions, and does not list EN 1906.
"EN 16867 is the harmonised standard for smart locks."	EN 16867 is not in the CPR list; it gives no presumption.
"The lock must carry a capacity and lifetime label."	Article 13 labels are on the battery: capacity for rechargeable portable batteries, minimum average duration for non-rechargeable ones, from 18 August 2026 at the earliest.
"A Matter-over-Thread lock always embeds BLE for commissioning."	The Matter page lists other commissioning paths; BLE qualification is needed only if the lock uses Bluetooth.

Procedure: scope the project layer by layer

1. Fix the markets and the mounting. Residential front door, office access point, escape route or fire door: this decides the CRA category (point 17 or point 1) and the CPR standards.
2. Inventory the radios. Bluetooth LE, Thread, Wi-Fi, NFC, UWB: each brings its RED standard, FCC rule section and RSS, plus a private programme if you use the logo.
3. Decide the supply. Cells, lithium pack or mains: safety stays under the RED; battery evidence (UN 38.3, IEC 62133-2 or IEC 60086-4) and Article 11 removability depend on the choice.
4. Map cybersecurity. EN 18031-1 and -2 with a check of the 2025/138 restrictions now; CRA Article 14 reporting in place since 11 September 2026; the class I route for 11 December 2027.
5. Check the building hardware. Compare the product with the scopes of EN 14846, EN 12209:2003, EN 179 and EN 1125; use EN 16867 as a voluntary performance reference.
6. Cover the environment. RoHS, REACH, WEEE and the battery labels.
7. Assemble the file. A technical file covering every act that applies, an EU declaration of conformity, and a declaration of performance where the CPR applies.

For planning, see the timeline and costs guides.

Common pitfalls

Pitfall	Consequence	Remedy
Offering a "no password" option	No EN 18031 presumption, notified body needed	Force a password or a unique credential at setup
Treating the lock as a default CRA product	Wrong assessment route for 2027	Plan for class I, point 17
No vulnerability reporting process	CRA Article 14 missed since 11 September 2026	Set up the reporting process now
Gluing the battery in	Non-compliance with Article 11 from 18 February 2027	Design for end-user replacement or document an Article 11 exception that fits the text
Citing EN 12209:2016 or EN 16867 as giving CPR presumption	Declaration of performance on the wrong basis	Use the editions in the Commission list
Treating SIG, Thread, Matter or Aliro certification as radio approval	Product placed without RED, FCC or ISED conformity	Run the regulatory and private files separately

Further reading

• Getting started with certification: the mental model common to every project
• RED checklist: European radio conformity phase by phase
• EN 303 645: consumer-IoT cybersecurity: the worldwide baseline and EN 18031
• Cyber Resilience Act: Annex III classes and Article 32 routes
• Certifying a BLE wearable: a neighbouring connected consumer product
• Technical file: mandatory contents: the backbone of the file
• Glossary: definitions of RED, EN 18031, FCC ID

A 30-minute audit with AESTECHNO engineers.

AESTECHNO is the electronics design house that edits spilma. We help product teams scope their certification effort and avoid the common mistakes.

Book a free audit

Sources and references

See also

• What certifications does an EV charger need?
• What certifications does a LoRaWAN sensor need?
• Worked example: IoT sensor, RED and FCC

Sources & references

1. Directive 2014/53/EU (RED), Articles 1(4), 3 and 17, EUR-Lex eur-lex.europa.eu/eli/dir/2014/53/oj
2. Delegated Regulation (EU) 2022/30, Article 3(3)(d), (e) and (f) of the RED, EUR-Lex eur-lex.europa.eu/eli/reg_del/2022/30/oj
3. Delegated Regulation (EU) 2023/2444, application from 1 August 2025, EUR-Lex eur-lex.europa.eu/eli/reg_del/2023/2444/oj
4. Implementing Decision (EU) 2025/138, EN 18031-1, -2 and -3 cited with restrictions, EUR-Lex eur-lex.europa.eu/eli/dec_impl/2025/138/oj
5. Delegated Regulation (EU) 2026/339, repeal of 2022/30 from 11 December 2027, EUR-Lex eur-lex.europa.eu/eli/reg_del/2026/339/oj
6. Regulation (EU) 2024/2847 (Cyber Resilience Act), Articles 13, 14, 32, 71 and Annex III, EUR-Lex eur-lex.europa.eu/eli/reg/2024/2847/oj
7. Implementing Regulation (EU) 2025/2392, technical description of the Annex III categories, EUR-Lex eur-lex.europa.eu/eli/reg_impl/2025/2392/oj
8. Regulation (EU) No 305/2011 (CPR), summary list of harmonised standards generated on 9 February 2026, European Commission single-market-economy.ec.europa.eu/single-market/goods/european-standards/harmonised-standards/construction-products-cpdcpr_en
9. Regulation (EU) 2024/3110 on construction products, Articles 94 and 95, EUR-Lex eur-lex.europa.eu/eli/reg/2024/3110/oj
10. Regulation (EU) 2023/1542 concerning batteries and waste batteries, Articles 11 and 13, EUR-Lex eur-lex.europa.eu/eli/reg/2023/1542/oj
11. ETSI EN 300 328, wideband transmission systems in the 2.4 GHz band, ETSI www.etsi.org/deliver/etsi_en/300300_300399/300328/
12. Title 47 CFR Part 15, radio frequency devices, United States Government (eCFR) www.ecfr.gov/current/title-47/chapter-I/subchapter-A/part-15
13. DIN EN 16867:2024-10, mechatronic door furniture (EN 16867:2020 with A1 and A2), catalogue entry, DIN Media www.dinmedia.de/en/standard/din-en-16867/380115252
14. BS EN 12209:2024, mechanically operated locks and locking plates, catalogue entry, BSI knowledge.bsigroup.com/products/building-hardware-mechanically-operated-locks-and-locking-plates-characteristics-and-test-methods
15. BHMA announces updates to six ANSI/BHMA standards, including A156.40 residential deadbolts (April 28, 2025), BHMA buildershardware.com/Portals/0/Files/News%20Coverage/2025/BHMA%202025%20Published%20Six%20Standards%20Press%20Release.pdf?ver=2025-05-30-180405-223
16. UL 437, Standard for Key Locks, edition 8, catalogue entry, UL Standards & Engagement www.shopulstandards.com/ProductDetail.aspx?UniqueKey=25916
17. Introducing Aliro 1.0: a unified standard to transform the access control ecosystem, Connectivity Standards Alliance csa-iot.org/newsroom/introducing-aliro-1-0-a-unified-standard-to-transform-the-access-control-ecosystem/