The EU has had enough of "smart" devices with half-baked security

Commissione Europea
(Image credit: 123RF)

The European Union (EU) is set to crack down on shoddy device security with a significant new piece of legislation.

The proposed "Cyber Resilience Act" will ensure that all devices connected "either directly or indirectly to another device or network", including everything from fridges to smartwatches, will need to adhere to a newly proposed set of cybersecurity standards. 

The price of non-compliance is pretty steep,  companies could face fines of as much as 15 million euros ($15 million) or up to 2.5% of their total global turnover if they fail to adhere.

What does this mean for companies?

Manufacturers will now have to report all known actively exploited vulnerabilities and incidents.

The proposed regulation will also increase the onus on manufacturers to keep consumers informed, ensuring they "enable consumers to have sufficient information about the cybersecurity of the products they buy and use".

Manufacturers will also be obliged to provide regular security support and software updates to address new vulnerabilities. 

The new rules won't apply to devices whose cybersecurity requirements are already outlined as part of existing EU rules, such as medical devices, aviation technology, and cars.

The claim is that through compliance costs could run up to €29 billion in compliance costs it will ultimately save companies €290 billion annually in cyber incidents.

It’s no surprise that the EU is choosing to crack down on device security, it's proven to be a serious ongoing issue, and cybercriminals everywhere are looking to IoT devices as endpoints

Consumers' right group Which? built a house filled with smart devices and registered 12,807 unique scan and attack attempts in its first month directed at these.

Device security generally doesn't seem something that consumers are focused on prioritizing, at least according to research from BlackBerry.

Out of over three-quarters - 77% - of smart devices in the home being purchased in the past two years, less than a third (30%) of German and Dutch home workers who own a smart device said security was a top three factor when making these purchases.

"We deserve to feel safe with the products we buy in the single market. Just as we can trust a toy or a fridge with a CE marking, the Cyber Resilience Act will ensure the connected objects and software we buy comply with strong cybersecurity safeguards," said Margrethe Vestager, European Commission EVP for digital strategy. "It will put the responsibility where it belongs, with those that place the products on the market.”

It's not just the EU that is ready and willing to crack down on device security.

A draft of the UK government's own “security by design” legislative covering smart device security surfaced as far back as 2019.

Will McCurdy has been writing about technology for over five years. He has a wide range of specialities including cybersecurity, fintech, cryptocurrencies, blockchain, cloud computing, payments, artificial intelligence, retail technology, and venture capital investment. He has previously written for AltFi, FStech, Retail Systems, and National Technology News and is an experienced podcast and webinar host, as well as an avid long-form feature writer.

Read more
A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.
NIS2: the GDPR of cybersecurity
An American flag flying outside the US Capitol building against a blue sky
White House unveils "US Cyber Trust Mark" to help determine if your devices are secure
EU
I read the EU’s AI Act so you don’t have to - here are 5 things you need to know
A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.
IoT’s botnet problem is up 500% – three things admins must do now
Abstract image of cyber security in action.
TikTok’s American ownership rule ignores bigger IoT threat
A Wi-Fi router placed on a desk with cables going in. A hand is holding a padlock on top of the router.
Five Eyes shares fresh guidance for network edge device security
Latest in Security
A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.
Broadcom warns of worrying security flaws affecting VMware tools
URL phishing
HaveIBeenPwned owner suffers phishing attack that stole his Mailchimp mailing list
Ransomware
Cl0p resurgence drives ransomware attacks to new highs in 2025
Google Chrome
Google Chrome security flaw could have let hackers spy on all your online habits
cybersecurity
Chinese government hackers allegedly spent years undetected in foreign phone networks
Data leak
A major Keenetic router data leak could put a million households at risk
Latest in News
Xbox Series X and Xbox wireless controller set to a green background
Xbox Insiders are currently testing a new Game Hub feature that looks useful, but I've got mixed feelings about it
A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.
Broadcom warns of worrying security flaws affecting VMware tools
Microsoft Surface Laptop and Surface Pro devices on a table.
Hate Windows 11’s search? Microsoft is fixing it with AI, and that almost makes me want to buy a Copilot+ PC
Oura Ring 4
Activity tracking on Oura Ring is about to get a whole lot better, but I've got bad news about your step count
Google Pixel Buds Pro 2
Cleaned your Pixel Buds Pro 2 recently? If not, you might be getting worse sound
Google Maps on a phone being held in someone's hand
Google Maps is getting two key upgrades, for easier route planning and quicker access to Gemini AI