Cyber Resilience Act: What Changes for Smart Device Security and What to Look for When Buying

For years, the "smart" device market was the Wild West of security: cameras shipping with admin/admin as the default password, bulbs that never received a single firmware update, smart locks from manufacturers that vanished a year after launch. That is changing, and this time by law.

The European Union's Cyber Resilience Act (CRA) is the first regulation that makes cybersecurity a legal obligation for every "product with digital elements" sold in the EU: from the Wi-Fi bulb to your router and the NVR behind your cameras.

The key dates

• September 11, 2026: Mandatory vulnerability reporting begins. Any manufacturer that learns a vulnerability in its product is being actively exploited must notify the authorities (ENISA) within 24 hours. No more "we'll look into it in next year's update."
• December 11, 2027: Full application. Every new product placed on the EU market must meet the requirements: security by design, no weak default passwords, mandatory security updates throughout the support period, and clear documentation.

Devices with security functions, such as smart locks, cameras, alarm systems and baby monitors, fall into the "important" product classes with stricter conformity assessment.

What it means for the devices you already own

The regulation applies to products placed on the market after full application. It doesn't retroactively fix what you've already installed. And that's where the real risk hides: manufacturers who can't (or won't) bear the cost of compliance will withdraw from the European market, leaving their devices without updates, which means, over time, exposed.

What to look for when buying from now on

• A declared support period: How many years of security updates does the manufacturer promise? If you can't find it written anywhere, that's your answer.
• Brands with a real EU presence: The CRA applies to anyone selling in Europe, but practice will show who complies and who disappears. Established manufacturers (KNX, reputable ecosystems) have already adapted.
• Local operation: A device that works locally (KNX, Zigbee, Thread, Matter over Thread) doesn't turn into a brick if the manufacturer's cloud shuts down, and it exposes far less of your data to the internet.
• Network isolation: Even the best device benefits from proper architecture: a separate VLAN for IoT, firewall rules, controlled remote access.

The Sync-Teq philosophy

The CRA confirms what we've been saying for years: a smart home is a system, not a collection of gadgets. Its security is designed in, not bolted on afterwards. At Sync-Teq we choose equipment from manufacturers with a proven commitment to updates, build networks with proper isolation, and deliver installations that will still be secure in ten years, not just on handover day.