Depends on the lock and the method of attack you are using - CFAA violations are usually tied to 18 USC §1030 (4) (https://www.law.cornell.edu/uscode/text/18/1030), which only apply to "protected computer[s]"

A computer is protected (18 USC §1030(e)(2)) in generally one of three circumstances - i) Used exclusively by a financial institution; ii) Used exclusively by the US Gov't; or iii) Affects foreign commerce or communication [usually interpreted to mean connected to the Internet]

Therefore, if you are using a non-internet connected device (i.e. Bluetooth or NFC only), it's unlikely to be a violation of the CFAA.

NOT LEGAL ADVICE, SEEK YOUR OWN LICENSED ATTORNEY