Rules for boosting the security of connected devices have entered into force in the European Union.
The Cyber Resilience Act (CRA) puts obligations on product makers to provide security support to consumers, such as by updating their software to fix security vulnerabilities. Although the deadline for compliance with the main obligations of the law is still three years out — December 11, 2027 — to allow device makers time to comply.
The legislation was proposed a little over two years ago, with the goal of amping up the security of devices such as smartwatches, internet-connected toys and home appliances that can be controlled by an app.
The proliferation of connected devices has led to worries over rising hacking risks, with quasi-regular headlines about hacked baby monitors and kids toys amping up concerns that profits were being put before consumer security.
The pan-E.U. law puts mandatory cybersecurity requirements on products with digital elements. Requirements apply throughout in-scope products’ lifecycles, from design, development, and operation. Distributors and retailers must also ensure the stuff that they supply or stock abides by the EU’s rules.
The CRA applies to connected devices broadly — meaning products that connect directly or indirectly to another device or network — with exceptions in the case of products that are covered by other existing E.U. rules, such as medical devices, cars, and some open-source software.
Devices can display the E.U.’s CE mark to communicate that they are abiding by the CRA. Regional consumers should then have less leg work to ensure they are purchasing a more secure product if they look out for the CE marking.
Leave a Reply