Developing adaptive IoT communication under the CRA

Key takeaways

• Since 2025, ACRIOS has been running an R&D project supported by the Technology Agency of the Czech Republic. The project partner is the Faculty of Informatics at Masaryk University.
• The project aims to develop a communication module that automatically switches between LoRaWAN and NB-IoT based on signal strength and availability, transmission energy cost and network load, without increasing production costs.
• The intended benefits include more reliable data transmission, long battery life and lower TCO, including avoiding LoRaWAN gateway installation where only a few devices are located.
• The planned architecture combines the strengths of both networks: NB-IoT can connect devices beyond LoRaWAN gateway coverage, while LoRaWAN provides an alternative where NB-IoT coverage is weak.
• Security under the Cyber Resilience Act is part of the architecture from the outset, covering the device lifecycle from secure development and vulnerability management to encrypted communication and over-the-air updates.
• The CRA analysis and embedded system emulator are already complete. A security methodology is taking shape in 2026 alongside network simulation continuing into 2027, followed by the communication module in 2027 and a smart end device for pilot deployment in 2027 and 2028.

‍

Since 2025, ACRIOS Systems has been running a research and development project supported by the Technology Agency of theCzech Republic, with the goal of developing a communication module with adaptive switching between LoRaWAN and NB-IoT, together with a methodology forcombining both in a single system, without increasing production costs. The intended result is more reliable transmission of measured data in battery-powered operation, lower planning and maintenance costs, and security that exceeds the requirements of the Cyber Resilience Act (CRA). ACRIOS is delivering the project together with the Faculty of Informatics at Masaryk University.

Project background

The development builds on earlier ACRIOS research and innovation work, specifically on LoRaWAN mesh and on the development of converters for smart metering. In both areas, ACRIOS supplies in-house hardware and firmware and has real-world deployments to back it up. The current project extends these foundations in two directions: by adding NB-IoT as a second communication path and by achieving full compliance with the Cyber Resilience Act (CRA).

The reasoning is practical. European meter networks are heterogeneous in the vast majority of cases, comprising different manufacturers, generations, and communication standards accumulated over decades. Connecting such a network does not mean replacing the meters but adding a communication layer above them. This is where converters belong, connecting meters to remote reading without touching their metrological part. Combining two radio technologies in a single module makes data transmission more resilient.

Where this kind of solution leads in practice is illustrated, for example, by the remote meter reading network deployed in Vilnius, where ACRIOS supplied the infrastructure for data collection across a diverse meter estate. That is a different type of project from this research, but the principle is the same: a single solution connects multiple meters without replacing them. The project with the Technology Agency of the CzechRepublic takes the same principle further, towards a module that handles two networks at once and security prepared for new European rules.

Development scope and goals

The communication module under development shall automatically switch between LoRaWAN and NB-IoT based on operating conditions, ensuring that data from meters reaches the head-end system reliably. The decisive factors include signal strength and availability, the energy cost of data transmission, and network load. As a result, the module shall offer:

• Reliable  network connectivity: when LoRaWAN infrastructure is missing, the module uses NB-IoT. Where NB-IoT coverage is weak (basements, shafts, mines), LoRaWAN takes over. If one network fails, the module connects to the other.
• Long battery life: dynamic technology selection minimises  unnecessary transmission and the associated battery drain.‍
• Lower TCO: there is no need to install LoRaWAN gateways where only a few devices are located.‍
• Security beyond the baseline: an architecture, processes, and tools that  meet the security standards for data protection in line with the Cyber Resilience Act (CRA).‍
• Scalability for real projects: use in smart metering as well as in industrial IoT for monitoring and control. All of it deployable into existing projects.

‍

A typical scenario looks like this: a locally limited LoRaWAN infrastructure can be linked across its individual parts through NB-IoT outputs. Likewise, devices beyond the reach of LoRaWAN gateways can connect to the network via NB-IoT. In this way, even fragmented sites can be linked without a complete network of LoRaWAN gateways, thereby lowering the overall cost of running the network.

Security under the CRA as part of the design

Security here is not a late add-on, but part of the architecture from the first design. The Cyber Resilience Act introduces security requirements across the entire device lifecycle, from secure development through vulnerability management to encrypted communication and over-the-air updates. Adding these features afterward is often costly and complicated, so the project addresses them directly in the design. For operators of critical energy infrastructure, readiness for the new rules matters as much as transmission reliability.

Timeline and milestones

The project started in 2025. Project management, focused on tracking milestones, budget, and compliance, runs continuously, and an analysis of CRA requirements has already been completed to establish the security and process framework. At the turn of 2025 and 2026, an embedded system emulator was created as a security testbed for rapid iteration.

In 2026, a security methodology with specific procedures and compliance templates is now taking shape, while an analysis and simulation of the heterogeneous network run in parallel, continuing into 2027 to establish behavioural models and switching parameters. In 2027, a module for heterogeneous communication will follow as a hardware and software building block for LoRaWAN and NB-IoT. The final phase will take place in 2027 and 2028, producing a smart end device ready for pilot deployment.

Project participants

• ACRIOS Systems: architecture design, firmware development, integration into real applications (smart metering, industrial IoT), running pilots, and bringing the work into practice.
• Faculty of Informatics at Masaryk University: FI MU contributes its research facilities, laboratory and measurement capacities, and supports in designing and validating electronic subsystems and security mechanisms.

‍

The project also fulfills the goals of the Czech National RIS3 Strategy 2021 to 2027 (strengthening the business sector, developing skills for smart specialisation, and digitalising business) and contributes to the security and resilience of critical energy infrastructure.

What comes next

Throughout the project, ACRIOS will share results, demonstrations, and invitations to pilots. For a specific use case, whether remote meter reading, consumption monitoring, or load management, a scenario can be selected, and an integration plan prepared.

Thanks go to the Technology Agency of the Czech Republic for its support and to Masaryk University for its partnership. ACRIOS looks forward to the joint research that will bring heterogeneous communication from the lab into practice.

Glossary of terms used

• Converter: a device that connects an existing meter interface to another communication interface or network, allowing meter data to be collected without replacing the meter
• CRA (Cyber Resilience Act): the EU regulation establishing cybersecurity requirements for products with digital elements and related obligations throughout their lifecycle, including vulnerability handling and security updates
• Embedded system emulator: a software environment that imitates the behaviour of an embedded system for development and testing
• Gateway: a network element that receives LoRa radio packets from end devices and forwards them to the LoRaWAN network server
• Head-end system: a system that receives and manages meter data and communication before passing data to other systems
• Heterogeneous network: a network that combines different communication technologies, in this project LoRaWAN and NB-IoT
• LoRaWAN: a low-power wide-area network protocol in which devices send data through gateways to a network server, operated on public or private networks
• NB-IoT (Narrowband IoT): a cellular low-power technology running in mobile operators' licensed networks, suited to devices that send small amounts of data
• Over-the-air (OTA) update: a firmware or configuration update delivered to a device remotely over its communication network
• TCO (Total Cost of Ownership): the full cost of a solution over its lifetime, including purchase, installation, operation and maintenance
• Vulnerability management: the process of identifying, assessing and fixing security weaknesses in a product throughout its lifecycle