Most advice on smart home security starts after the device is already on your network: change the password, put it on a separate VLAN, update the firmware. Some of the most important decisions are made earlier, in the shop. A camera that never gets another firmware update, or a plug that stops working the day its cloud service shuts down, cannot be fixed by good network settings.
This guide explains what EU law already requires from connected devices, what changes in 2027, and how to use the European baseline standard for consumer IoT security, ETSI EN 303 645, as a checklist before you buy.
What the law requires in the EU today
Radio Equipment Directive: since 1 August 2025
Commission Delegated Regulation (EU) 2022/30 activated three cybersecurity requirements of the Radio Equipment Directive (RED), Article 3(3)(d), (e) and (f). They cover network protection, personal data and privacy, and protection against fraud. According to the European Commission, the regulation has applied since August 2025. The network protection requirement applies to any radio equipment that can communicate over the internet, directly or through other equipment. In practice, that includes Wi-Fi plugs, cameras and also Zigbee or Bluetooth devices that reach the internet through a hub or a phone.
Manufacturers can show compliance using the harmonised standards EN 18031-1, -2 and -3. When the Commission cited them in the Official Journal (Implementing Decision (EU) 2025/138), it added an important restriction: if a product lets the user skip setting a password altogether, following the standard's password clauses does not give a presumption of conformity.
For you as a buyer, this means a new radio device sold in the EU should carry a CE mark that also covers these security requirements. It does not tell you how long the device will be supported.
Cyber Resilience Act: reporting since September 2026, the rest from December 2027
The Cyber Resilience Act (CRA, Regulation (EU) 2024/2847) entered into force on 10 December 2024. It covers products with digital elements in general, not only radio equipment. The timeline:
- 11 September 2026: manufacturers have to report actively exploited vulnerabilities and severe incidents. The Commission states that this applies to all products with digital elements made available in the EU, including those already on the market. An early warning is due within 24 hours, a full notification within 72 hours.
- 11 December 2027: the main obligations apply. On the same date, the RED cybersecurity regulation is repealed (Delegated Regulation (EU) 2026/339) to avoid overlapping requirements.
Two CRA rules matter most to buyers:
- Support period. Under Article 13(8), the manufacturer has to handle vulnerabilities for a support period that reflects how long the product is expected to be used, and this period has to be at least five years, unless the product is expected to be in use for a shorter time.
- End date at the time of purchase. Under Article 13(19), the end date of the support period, at least month and year, has to be clearly specified at the time of purchase, where applicable on the product, its packaging or by digital means. Where technically feasible, the device also has to notify you when support ends.
Until December 2027, manufacturers are not yet required to publish that end date, and many do not. A device bought in 2026 may already be covered by the vulnerability reporting duty, but that does not guarantee you will receive updates for any particular length of time.
Outside the EU
The UK's product security regime for consumer connectable products, under the Product Security and Telecommunications Infrastructure Act 2022, came into effect on 29 April 2024. The UK government guidance lists ETSI EN 303 645 among its reference documents.
ETSI EN 303 645 as a buying checklist
ETSI EN 303 645 "Cyber Security for Consumer Internet of Things: Baseline Requirements" (current version V3.1.3, September 2024) contains 13 groups of provisions for devices plus data protection provisions. You cannot test a device against the standard in a shop, but several provisions turn into questions you can answer from the product page, the manual or the manufacturer's website.
1. No universal default password
Provision 5.1-1: if passwords are used, they have to be unique per device or set by the user. A manual that says "log in with admin/admin" is a red flag. A unique password printed on a label, or a setup process that makes you choose one, is what you want. Provision 5.1-4 adds that it has to be simple to change the password.
2. A way to report vulnerabilities
Provision 5.2-1: the manufacturer has to publish a vulnerability disclosure policy with at least contact details for reporting issues and timelines for acknowledging reports and for status updates. Look for a "security" or "vulnerability disclosure" page on the manufacturer's website. A manufacturer that publishes security advisories for its products is also showing that it actually fixes issues.
3. A published support period
Provision 5.3-13: the manufacturer has to publish the defined support period, the minimum length of time (as a period or an end date) for which the device gets software updates. Provision 5.3-16 requires the model designation to be clearly recognisable on a label or in the user interface, because you need the exact model to check its support period. If you cannot find any statement about updates, assume the worst.
For devices whose software cannot be updated at all, provision 5.3-14 recommends publishing why, and for how long and how hardware replacement is offered.
4. Updates that are actually delivered
Provisions 5.3-7 and 5.3-8 require updates to use best practice cryptography and to be timely. From the outside, the practical test is a firmware changelog or release notes page. Check when the last update for the model was published and whether security fixes are mentioned.
5. Keeps working without the internet
Provision 5.9-2 recommends that devices remain operating and locally functional when network access is lost and recover cleanly after a power cut. This is only a recommendation in the standard, but for a home automation system it is one of the most valuable properties. Check whether the device can be controlled locally, for example over Zigbee, Z-Wave, Matter, a local API or MQTT, or whether every command goes through a cloud service.
6. Minimal exposed services
Provision 5.6-1 requires unused network and logical interfaces to be disabled. You cannot see this before buying, but you can check reviews and security advisories for the model for things like an open telnet port or an unauthenticated web interface.
7. Easy data deletion
Provision 5.11-1: users have to be able to erase all their user data from the device in a simple manner. The manual should describe a factory reset that removes your Wi-Fi credentials and account data. This matters when you sell, give away or dispose of the device.
A short pre-purchase routine
- Write down the exact model designation.
- Look for the support period or update end date on the product page, packaging or manufacturer's site.
- Find the manufacturer's vulnerability disclosure or security page.
- Open the firmware changelog and check the date of the last update.
- Read the manual: default password, local control, factory reset.
- Search for the model name together with "vulnerability" or "CVE" to see how earlier issues were handled.
If a device fails several of these checks, it can still be useful, but treat it as untrusted: put it on an isolated network, block its internet access if it works without it, and plan to replace it.
What this guide does not cover
Certification labels other than the CE mark are not covered here, and neither are national rules in individual EU countries. Legal dates and requirements are summarised from the sources below; for anything that affects a business decision, read the regulation text itself.