Smart home and security
EU Declaration of Conformity for Smart Plugs and Smart Home Devices: requirements and checklist
By Ing. Jaroslav Křepelka, Owner, DoC solutions s.r.o. · Updated 22 September 2026
A smart plug is a mains switching device with a radio and an app, which puts it squarely in the scope of the Radio Equipment Directive and, because it is connected to the internet, the RED cybersecurity requirements that apply since 1 August 2025. From 11 December 2027 the Cyber Resilience Act adds broader security obligations for connected products.
This page covers plug-in smart plugs and adaptors, and similar Wi-Fi, Zigbee or Thread smart home devices such as switches, relays and hubs.
Checklist: what your smart plug / smart home device declaration must contain
- Model exactly as on the device, with each plug type (Schuko, French, Italian, etc.) and radio variant covered
- Name and postal address of the manufacturer (and of the authorised representative, if appointed)
- The statement that the declaration is issued under the sole responsibility of the manufacturer
- Radio Equipment Directive 2014/53/EU, including Delegated Regulation (EU) 2022/30
- RoHS Directive 2011/65/EU
- The harmonised standards applied for radio, EMC, safety and cybersecurity, with versions
- Place and date of issue, name and function of the signatory, and the signature
Which EU legislation applies
| Legislation | Applies? | In the DoC? | Notes |
|---|---|---|---|
| Radio Equipment Directive2014/53/EU | Applies | In the DoC: Yes | Covers electrical safety (Article 3(1)(a), with no voltage limit), EMC and the radio. Do not cite the LVD and EMC Directives separately. |
| Cybersecurity delegated actDelegated Regulation (EU) 2022/30 | Applies | In the DoC: Yes | Applicable since 1 August 2025. Internet-connected radio equipment must protect the network (Article 3(3)(d)) and, where it processes personal data such as usage schedules or location, personal data and privacy (Article 3(3)(e)). |
| Cyber Resilience Act(EU) 2024/2847 | Applies | In the DoC: No | Manufacturers must report actively exploited vulnerabilities and severe incidents from 11 September 2026. The full requirements, including CE marking under the CRA, apply to products with digital elements placed on the market from 11 December 2027. |
| RoHS Directive2011/65/EU | Applies | In the DoC: Yes | Restriction of hazardous substances in electrical and electronic equipment. |
| Plug and socket-outlet rulesnational standards | Applies | In the DoC: No | Plug and socket systems for domestic use are not harmonised in the EU; they are even excluded from the LVD (Annex II). The plug and socket parts must meet the national standard of each country of sale. A plug-in timer or adaptor without a radio is therefore not CE marked under the LVD at all. |
| WEEE Directive2012/19/EU | Applies | In the DoC: No | Producer registration in every EU country where you sell and the crossed-out wheeled bin symbol. |
Typical harmonised standards
A harmonised standard gives presumption of conformity only in the version cited in the Official Journal of the EU. Always check the current list for each directive before you issue or update a declaration (European Commission: harmonised standards); the versions below are the ones commonly used at the time of writing, and the right selection depends on your product.
Radio and EMC
Versions shown are cited under RED in Implementing Decision (EU) 2022/2191 as amended; for EN 301 489-1 use the version listed in the Official Journal.
- ETSI EN 300 328 V2.2.22.4 GHz Wi-Fi, Bluetooth, Zigbee and Thread
- ETSI EN 301 489-1 and EN 301 489-17 V3.3.1EMC for radio equipment — wideband data transmission systems
Electrical safety and EMF
- EN 60669-2-1:2004 + A1:2009 + A12:2010Switches for household installations — electronic switches (the switching function)
- National plug and socket-outlet standardsFor example DIN VDE 0620, NF C 61-314 or CEI 23-50, depending on the country; IEC 60884-2-5 covers adaptors
- EN 62479 or EN 62311Human exposure to electromagnetic fields
Cybersecurity
- EN 18031-1:2024Internet-connected radio equipment (cited with restrictions)
- EN 18031-2:2024Radio equipment processing personal data (cited with restrictions)
Hazardous substances (RoHS)
- EN IEC 63000:2018Technical documentation for the assessment of electrical and electronic products with respect to the restriction of hazardous substances
Already have a declaration for your smart plug / smart home device?
A certification expert checks it against everything on this page and tells you exactly what to fix. Written report in 48 hours, €99 per product (excl. VAT).
Common mistakes in smart plug / smart home device declarations
Cybersecurity not addressed
Since 1 August 2025 internet-connected smart plugs must meet RED Article 3(3)(d), and usually (e). Default passwords, unencrypted local control and missing update mechanisms are the typical gaps behind a missing EN 18031 assessment.
LVD and EMC listed next to RED
For radio equipment RED covers safety and EMC; listing the other directives is a template error.
One plug variant tested for all countries
Schuko, French and Italian plugs have different national requirements. Each variant needs to be identified and assessed against the relevant national standard.
Switching capacity not supported
The declared maximum load (for example 16 A / 3680 W) must be backed by temperature-rise and endurance tests of the relay and contacts.
No plan for the Cyber Resilience Act
From 11 December 2027 connected products need to meet the CRA's security and vulnerability-handling requirements, and reporting obligations start on 11 September 2026.
What you need besides the declaration
- Technical documentation
- Radio, EMC, safety and EMF reports, temperature-rise and endurance tests at rated load, a cybersecurity risk assessment with EN 18031 evidence, and RoHS documentation. Keep it for 10 years.
- Security support
- A way to receive vulnerability reports and deliver security updates, which the CRA will make mandatory, including a defined support period.
- Marking and instructions
- CE marking, crossed-out wheeled bin, ratings, manufacturer name and contact address, and installation, safety and security information in the local language.
- Economic operator in the EU
- An importer, authorised representative or responsible person established in the EU (Article 4 of Regulation (EU) 2019/1020).
No EU presence yet? We can act as your EU authorised representative or responsible person.
Frequently asked questions
Do smart plugs have to meet the RED cybersecurity requirements?
+
Yes. Smart plugs connected to the internet, directly or through a hub or app, must meet Delegated Regulation (EU) 2022/30 since 1 August 2025.
Does the Cyber Resilience Act apply to smart plugs?
+
Yes, smart plugs are products with digital elements. Vulnerability reporting starts on 11 September 2026 and the full requirements apply from 11 December 2027.
Is a smart plug covered by the Low Voltage Directive?
+
Its safety is covered by the Radio Equipment Directive, which applies the LVD safety objectives without voltage limits. The plug and socket parts must also meet national plug standards.
What does MyCECheck check on a smart plug declaration?
+
RED and the cybersecurity delegated act, the radio, safety and EN 18031 standards and versions, the plug variants and the economic operator. Written report within 48 hours.
Already have a declaration for your smart plug / smart home device?
A certification expert checks it against everything on this page and tells you exactly what to fix. Written report in 48 hours, €99 per product (excl. VAT).