EU-ReadyRules RadarServicesFind a partnerAboutContactLogin
Start a request

Worked example: importing a Wi-Fi smart plug from China

Step by step: which EU and Austrian rules apply when you import a Wi-Fi smart plug with energy metering from Shenzhen and sell it in the EU — documents, dates, pitfalls.

Illustrative scenario — not a customer case. It shows how the rules on the radar work together for one typical product. General information, not legal advice.

Content reviewed by DI(FH) Herbert Schrank · As of

The scenario

An Austrian company wants to buy a Wi-Fi smart plug with energy metering from a manufacturer in Shenzhen. The plug is controlled with the manufacturer’s app via its cloud. The company will sell it under the manufacturer’s brand to businesses and consumers in the EU, also through its own web shop. First delivery: early 2027.

Who is who

The Austrian company is the first to place the plug on the EU market, so it is the importer — with its own legal duties. If it sold the plug under its own brand, or modified it in a way that may affect compliance, it would be considered the manufacturer, with all manufacturer duties.

Which rules apply — and what they mean here

RuleWhy it appliesWhat it means here
RED Radio Equipment Directive — cybersecurityThe plug is radio equipment (Wi-Fi). It connects to the internet and processes personal data (app account, usage data).The EU declaration of conformity must cover electrical safety, EMC, radio use and the cybersecurity requirements of Article 3(3)(d) and (e). Ask for test evidence, e.g. against EN 18031-1 and EN 18031-2. If a restriction published with these standards applies (e.g. the user can skip setting a password), a notified body is needed. The cybersecurity requirements apply to units placed on the market before 11 December 2027 (Delegated Regulation (EU) 2026/339 repeals (EU) 2022/30 from that date); after that the CRA takes over. The safety, EMC and radio requirements of the RED continue to apply.
CRA Cyber Resilience ActThe plug is a product with digital elements (firmware, app, cloud connection).Since 11 September 2026 the manufacturer must report actively exploited vulnerabilities and severe incidents — also for units already on the market; agree how you will be informed. Units placed on the market from 11 December 2027 must meet all CRA requirements: plan the support period, security updates and SBOM now. Smart plugs are not listed in Annex III of the CRA: its smart-home categories are general-purpose virtual assistants and products with security functionalities (including smart door locks, security cameras, baby monitors and alarm systems). A plug whose core function is switching power is therefore normally not an “important” product — check this against Implementing Regulation (EU) 2025/2392 and have the manufacturer confirm it.
GPSR General Product Safety RegulationConsumers can buy the plug, and it is sold online.An economic operator established in the EU must be named — here the importer. Product identification (type, batch or serial number), manufacturer and importer contact details, and instructions and safety information in a language consumers in the country of sale easily understand (in Austria: German). The web shop must show the manufacturer’s and the EU operator’s name, postal and electronic address, product identification with a picture, and warnings and safety information.
Data Act Data ActThe plug generates usage and energy data that users can access.For units placed on the market after 12 September 2026 the manufacturer must design the product so that users can access these data. As seller, you must inform the user before the contract about the type, format and estimated volume of the data, whether they are generated continuously and in real time, where and for how long they are stored, and how to access, retrieve or erase them. The app and cloud are a “related service”: the manufacturer must provide its own pre-contract information for them.
WEEE / RoHS WEEE & RoHS (Austria: EAG-VO)The plug is electrical and electronic equipment sold in Austria.Register as producer in the Austrian EDM register before placing the plug on the Austrian market and, because it is household equipment (it can be used in private households), join a collection and recovery system. Mark the product with the crossed-out wheeled-bin symbol. RoHS compliance must be declared in the EU declaration of conformity.
PPWR Packaging and Packaging Waste RegulationThe plug is shipped and sold in packaging.As importer you are the producer of this packaging for extended producer responsibility in Austria — including the shipping packaging of your web shop: take part in a packaging compliance scheme. Ask the manufacturer for the EU declaration of conformity for the packaging.
PLD New Product Liability DirectiveThe manufacturer is outside the EU, and the first units are placed on the market after 9 December 2026.As importer you are a liable party in the EU (together with any authorised representative). Software counts as a product, and missing security updates within the manufacturer’s control can make the plug defective. Check your product liability insurance and get written update commitments. Damage to property used only for professional purposes is not covered by these rules.
NIS2 / NISG 2026 NIS2 — Austrian NISG 2026Business customers such as energy suppliers may be NIS2 entities.Expect security questionnaires and requests for evidence (support period, update policy, SBOM) in their contracts.

Not relevant in this example

  • Batteries Regulation — the plug has no battery (it would apply if it had one).
  • Machinery Regulation and AI Act — no machine, no AI function.
  • Dual-use export controls — only relevant if the plug or its technology is exported or re-exported from the EU.

Step by step

  1. 1

    Before you order

    • EU declaration of conformity covering RED Article 3(1), 3(2) and 3(3)(d) and (e), plus RoHS.
    • Test evidence for safety, EMC, radio and cybersecurity (e.g. EN 18031-1/-2), for the firmware version you will receive.
    • Support period, update path, SBOM and a contact point for vulnerability reports (CRA).
    • Where the cloud and the user data are hosted, and the Data Act information for users.
  2. 2

    Before the first delivery

    • Producer registration in the EDM register and participation in collection and recovery systems (equipment and packaging).
    • Importer name and postal address on the product — or, where not possible, on the packaging or in an accompanying document.
    • Instructions and safety information in German for Austria (and in a language easily understood in every other country of sale).
    • Web-shop listing with the required GPSR information; pre-contract Data Act information.
    • Product liability insurance checked for imported products with software.
    • CE marking and type, batch or serial number on the product; each unit accompanied by the EU declaration of conformity or the simplified declaration; instructions state the frequency band(s) and maximum radio-frequency power.
    • For direct sales to end users in other EU countries: WEEE and packaging registration in each of those countries (through an authorised representative where required).
  3. 3

    After placing on the market

    • Keep a copy of the EU declaration of conformity for 10 years (for units placed on the market from 11 December 2027: 10 years or the support period, whichever is longer) and ensure the technical documentation can be provided to the authorities on request.
    • Pass on vulnerability and safety reports to the manufacturer and inform the authorities where required.
    • Check that units shipped later still match the tested firmware; plan CRA conformity for units placed on the market from 11 December 2027.

Typical pitfalls

  • The test report covers an older firmware than the one actually shipped.
  • Setup that lets the user skip setting a password (this triggers the EN 18031 restriction and requires a notified body), or a shared default password (this does not meet the standard at all).
  • The importer’s name and address are missing on the product, packaging and documents.
  • No EDM registration before placing on the market.
  • Nobody has agreed how long security updates will be provided.

How ITDA-S handles this

For the parts it supplies, ITDA-S collects and checks these documents before shipment in an EU-Ready File, takes on the importer role in Austria, names a risk level and an alternative product, and QmiSoft integrates the product on site.

Have the documents for your product checked →

Get notified when EU product rules change

One email when dates, obligations or official guidance change for any of the 12 rule sets on the EU Rules Radar. You confirm by clicking a link; unsubscribe at any time.

We use your email address only to send you the confirmation email and, after your confirmation, the rule-change alerts. Privacy Policy

General information, not legal advice. Authentic are only the texts published in the Official Journal of the EU and the Austrian Federal Law Gazette.

Not sure where your product stands?

Send us the product and its documents. We check the technical file against the rules on this radar and tell you what is missing — and source an EU-ready alternative if needed.

Start a request →Email us