Skip to content

Pausito · smart living

Automation

How secure are smart devices?

Short answer

The risk is real but manageable. Since 1 August 2025 EU cybersecurity requirements apply to wireless connected devices, and the Cyber Resilience Act follows from 11 December 2027.

Security timeline: Timeline: 2020 ETSI EN 303 645, 10/12/2024 CRA in force, 1/8/2025 RED, 11/9/2026 reporting obligation, 11/12/2027 main obligations.
Security timeline — Timeline: 2020 ETSI EN 303 645, 10/12/2024 CRA in force, 1/8/2025 RED, 11/9/2026 reporting obligation, 11/12/2027 main obligations. (The text inside the figure is in Dutch.)

Explanation

Through Delegated Regulation 2022/30, the Radio Equipment Directive requires basic security for radio equipment that communicates over the internet, and for toys, childcare equipment and wearables that process personal data. The European standard ETSI EN 303 645 contains 13 security provisions for consumer IoT. The Cyber Resilience Act makes security updates mandatory.

Rules of thumb

  • RED cybersecurity: originally from 1 August 2024, postponed to 1 August 2025. [SW-S60, SW-S70]
  • CRA: in force 10 December 2024; reporting obligation for manufacturers from 11 September 2026; main obligations from 11 December 2027. [SW-S59]
  • ETSI EN 303 645 (2020): 13 provisions plus 5 on data protection. [SW-S61]
  • Change default passwords, install updates and put smart devices on a separate guest network. (practical tip, not a source value)

Pitfalls

  • Devices placed on the market before 1 August 2025 are not automatically covered by the new requirements. [SW-S70]

Search terms

These search terms are in Dutch; only terms that also find a topic in English are links.

cyberbeveiliging IoT Cyber Resilience Act RED wachtwoord

Read also

General information, not personal advice. Check the source and reference date.

Sources

  1. SW-S59 Cyber Resilience Act — Europese Commissie (Shaping Europe's digital future) (Reference date 2026-09-27)
  2. SW-S60 Gedelegeerde verordening (EU) 2022/30 — cyberbeveiliging radioapparatuur (RED art. 3(3) d, e, f) — Europese Commissie (EUR-Lex) (Reference date 2026-09-27)
  3. SW-S61 ETSI releases world-leading consumer IoT security standard (EN 303 645) — ETSI (Reference date 2026-09-27)
  4. SW-S70 Gedelegeerde verordening (EU) 2023/2444 tot wijziging van 2022/30 — Europese Commissie (EUR-Lex) (Reference date 2026-09-27)

Reference date: 2026-09-27 · Translated with AI from the Dutch original.