EU cybersecurity CE mark for connected devices, what changes for buyers - Pasquale Pillitteri

The Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, will require all products with software or network connections sold in the EU to display the CE mark for cybersecurity. This includes routers, cameras, smartwatches, and smart locks. The regulation mandates security updates for at least five years, or the product's expected lifespan if shorter.

The CE marking, already familiar on toys and appliances, will now also indicate protection against cyberattacks and unauthorized access. The European Commission describes it as a symbol making secure hardware and software easier to identify. The regulation applies to all products sold in the EU market, including those from American or Chinese brands.

Requirements for Manufacturers

Manufacturers apply the cybersecurity CE mark themselves after completing a conformity assessment, taking responsibility for their declaration. National market surveillance authorities conduct checks afterward, with third-party assessments required for the most sensitive products. The regulation covers devices with digital elements that connect to networks or other devices.

Essential requirements include products reaching the market with no known exploitable vulnerabilities, secure factory configurations, automatic security updates (with options to disable or postpone them), suitable authentication mechanisms, and data protection. While many summaries claim the regulation bans default passwords, it actually requires secure configuration by default.

Update Duration and Enforcement

Security updates must be provided for the entire support period, set at no less than five years. If a manufacturer expects shorter use, the support matches that duration. The end-of-support date must be communicated to users at purchase. Products with screens must warn users when support ends.

Penalties for non-compliance can reach up to 15 million euros or 2.5% of worldwide annual turnover. Micro and small enterprises, however, cannot be fined for missing the 24-hour early-warning deadline for security incidents. Enforcement will be carried out by national authorities.

What Consumers Should Check

After 2027, consumers should look for the CE marking, manufacturer's name and contacts, and the end date of security support on product packaging or pages. Be suspicious if the support date is missing or claims 'for life.' Check for vulnerability reporting pages and whether updates are automatic.