Following the political agreement on the Cyber Resilience Act (CRA), the Commission is preparing for its implementation. When the CRA goes into force, the Commission will adopt an implementing act with technical descriptions of the categories of important and critical products listed in the Annexes of the CRA. The Commission has started informal consultations about these definitions.
One question is which smart metering equipment should be categorized as critical products. The list of critical products includes two product categories related to smart metering: hardware devices with security boxes, and smart meter gateways and other devices for advanced security purposes. But it is not clear if smart meters and data concentrators would really fall under these categories.
Based on our experience with smart metering architectures, only the smart meter gateways as used in the German smart metering architecture should be categorized as critical.