The European institutions have struck a deal to better protect connected consumer products from cyberattacks and hackers. The Cyber Resilience Act sets minimum cybersecurity requirements for all connected devices, which will significantly improve the current situation. Consumer groups have for years repeatedly warned that too many of the products we rely on lack even the most basic cybersecurity features [1].

Among the improvements are:

• a requirement for manufacturers to provide software updates to connected products for as long as they are meant to be used, or for at least five years for longer lasting products,

• for sensitive consumer products, such as smart home products, connected toys or health wearables, to go through a more rigorous assessment to show that they conform to the law.

The right for consumers to seek redress collectively if a product that does not meet these EU cybersecurity standards caused damage.

Ursula Pachl, Deputy Director General of the European Consumer Organisation, said:

“Most of us use connected products every day, in our homes and at work, yet the market has failed to adequately protect consumers against cybersecurity risks. This legislation will substantially improve what was a very worrying situation until now and which made us far too vulnerable to cyberattack and harm. We now call on authorities to stay vigilant and in particular ensure that manufacturers respect the period during which software updates have to be provided.”

ENDS

Notes

[1] In 2016, the #ToyFail campaign, launched by our Norwegian member Forbrukerrådet, showed that a children’s doll named Cayla could easily be hacked in a few simple steps. In 2023, Testachats/Testaankoop from Belgium tested 20 popular smart home devices and found over 61 vulnerabilities in most of the products, while UK consumer group discovered smart TVs and washing machines were being abandoned by brands after only two years’.