That video doorbell seemed like a bargain until the firmware updates stopped. Nobody mentioned a support period at checkout, and there was no way to find out before paying. The European Union's Cyber Resilience Act is an attempt to close that gap. It makes basic security a legal condition for selling connected products in Europe, rather than a nice-to-have feature a manufacturer can quietly abandon. And because most companies build one version of a product for the whole world, what it forces will show up on shelves well outside the EU.

What counts as a "product with digital elements"

The Act's wording is clunky, but the idea is broad: hardware and software that connect to a network, whether directly or through something else. Smart TVs, fitness trackers, baby monitors, routers, smart locks, cameras, printers, connected toys, industrial sensors — plus the apps and firmware that keep them running.

Standalone software counts too, as do components that one company buys and drops into another company's product. The trigger is placing the product on the EU market, not where the business is based. A manufacturer in Asia or North America selling into Europe carries the same obligations as one in Poland.

Most devices land in the standard category, where the maker can assess its own compliance. A shorter list of "important" and "critical" products — firewalls, certain chips and identity systems, some industrial control equipment — needs testing by an approved third party.

What the rules actually demand

The requirements are unglamorous, and that is the point. Products must ship without known exploitable vulnerabilities, have a secure default configuration, protect the confidentiality of data they handle, limit their attack surface, and be designed so that a single flaw doesn't bring down everything around it. Default passwords that are the same on every unit are exactly the kind of thing this is meant to end.

Manufacturers also have to run a vulnerability process: document the components inside the product (often in the form of a software bill of materials), take in reports about flaws, fix them, and distribute security updates free of charge for a declared support period. That support period has to reflect how long the product is realistically expected to last, and it has to be stated openly. For some product categories, the European Commission can set minimum periods.

The three dates that matter

1. 10 December 2024 — the regulation entered into force, starting the clock on the transition.
2. 11 September 2026 — the reporting duty kicks in. Manufacturers must notify the EU's cybersecurity agency about actively exploited vulnerabilities and severe incidents affecting their products.
3. 11 December 2027 — the main rulebook applies in full. Products placed on the EU market from this date must meet the requirements.

One detail matters enormously for shoppers: the law is not retroactive. Devices already on the market before that final date can keep being sold, even if they would fail the new tests. Retailers clearing out old stock in 2028 will still be able to do so. So a compliance mark on the box tells you about a specific product, not about the brand's whole inventory.

What changes on the box

Compliant products will carry the CE marking, backed by a declaration of conformity and technical documentation that the manufacturer must keep available for regulators. Importers and distributors get duties too — they can't knowingly pass on a product that obviously fails the requirements.

The rules have teeth. Penalties for breaching the main obligations can reach €15 million or 2.5% of global annual turnover, whichever is higher, with separate figures for reporting failures and for supplying misleading information. That is a different conversation from a strongly worded security advisory.

What to check before you buy

Until the deadlines pass, most products on shelves carry no CRA evidence at all. That doesn't leave you powerless. Ask a few direct questions — by email if the shop page is silent, so you have an answer in writing.

• The support period, in years. If a listing doesn't state how long security updates will be provided, treat that as an answer in itself. A camera expected to last eight years but supported for two is a two-year camera.
• How updates arrive. Automatic is better than manual, and manual is better than none. Check whether updates are free, and whether the device still performs its core job if the manufacturer's cloud service shuts down.
• Setup defaults. Does it force a unique password on first use? Does it disable remote access until you turn it on? Anything that works out of the box with a shared password is a liability.
• Cloud dependency. If the lock, the camera or the thermostat stops working when the vendor's servers go offline, you are renting the product's core function.
• A route to report bugs. Look for a security contact address or a vulnerability disclosure page. A company with no way to receive a flaw report has no reliable way to fix one.
• Track record. Check whether the previous generation of the same product line still receives updates. Past behaviour is a better predictor than any promise on a product page.
• Second-hand devices. You inherit the original owner's settings. Factory reset it, install the latest firmware, and change anything that was tied to their account.

Where the rules stop short

The Act is not a guarantee of safety. It focuses on the product itself, and standalone online services generally sit outside its scope — so a well-built camera paired with a shaky account system is only partly addressed. Self-assessment means many manufacturers will be checking their own homework rather than submitting to a lab. And a compliant device can still be compromised later if a vulnerability is discovered and patched slowly.

What the law changes is the baseline. Manufacturers will have to decide, in writing, how long they will stand behind a product, and they will be penalised for lying about it. That shifts the burden away from the buyer who was previously expected to guess.

A habit worth keeping

Before you pay, spend two minutes on the support period, the update mechanism and the security contact. If a seller can't answer those three questions, buy a different product — there is almost always an alternative, and the difference in price is usually smaller than the difference in how long the device stays safe.

Then, once the device is home: change the default credentials, turn off features you don't use, keep it on a separate network from your main computers if your router allows it, and install updates when they appear. Regulatory deadlines are slow. Your own habits can be faster.

If you run a business that sells connected products into the EU, treat the 2027 date as a project with a start date, not a deadline to discover later. The details matter and they vary by product category, so it's worth getting proper compliance advice rather than relying on a summary — including this one.

Photo: haus_automation / Pixabay