Which rules apply to connected devices today?
Since 1 August 2025, extra cybersecurity requirements have applied in the EU to radio equipment that can communicate over the internet itself, directly or via another device. The legal basis is Delegated Regulation (EU) 2022/30. Such devices must not harm the network and must protect personal data and privacy. The privacy part also covers childcare devices such as baby monitors, radio toys and wearables, if they can process personal, traffic or location data.
The Cyber Resilience Act (Regulation (EU) 2024/2847) goes further, but its main obligations only apply from 11 December 2027. Until then, ask the seller yourself when security updates will end.
| Date | What applies | What it means for you |
|---|---|---|
| 10 December 2024 | Cyber Resilience Act enters into force | No new obligations yet for devices on sale |
| 1 August 2025 | Cybersecurity requirements for radio equipment | Protection of the network, data and privacy |
| 11 September 2026 | Manufacturers report actively exploited vulnerabilities and severe incidents | Not directly: manufacturers must send an early warning within 24 hours |
| 11 December 2027 | Cyber Resilience Act fully applicable | End date of security support shown at purchase |
Which manufacturer details should you be able to find?
Germany’s Federal Network Agency (Bundesnetzagentur) warns that bargains are often low-quality goods. Its spot checks look at whether the CE marking is correct, the manufacturer details are right and instructions with safety warnings are included. You can check the same points before buying.
| Check | Where to find it | Warning sign |
|---|---|---|
| Manufacturer | Product page, packaging | Only a brand name, no postal address |
| Contact in the EU | Seller and delivery details | Shipped from outside the EU, nobody reachable in the EU |
| CE marking | Device, packaging | Missing on a device with Wi-Fi or Bluetooth |
| Security updates | Data sheet, question to the seller | No answer on how long updates last |
| App and privacy | App store listing, privacy notice | Account required, but no privacy notice |
According to the EU’s Your Europe portal, the CE marking means the manufacturer declares that the product meets the applicable safety requirements; if it is missing where it should be, that may point to a problem. If a product ships from outside the EU, you do not automatically benefit from European consumer protection, warns the Bundesnetzagentur; see Cheap online platforms: check customs, returns and safety.
How long will the device get security updates?
From 11 December 2027, the manufacturer must state the end date of its support period clearly at the time of purchase. That period should be at least five years, unless the product is expected to be used for a shorter time. For consumer products, security updates should in principle install automatically.
Some national rules already help: in France, the DGCCRF says sellers must state how long software updates remain compatible. For claims, see Faulty device: legal guarantee or warranty, who to claim from.
Tip: Ask the seller in writing: ‘Until what date will the manufacturer provide security updates for this model?’ A dated answer is useful evidence later.
Where can you find alerts and report a device?
In Safety Gate, the EU rapid alert system, you can find recall alerts and report a defective product bought in the EU. No match is not proof of safety: Switzerland’s Federal Office of Communications (BAKOM) stresses that a device missing from its list is not automatically compliant.
| Country | Authority | What you can do |
|---|---|---|
| Germany | Bundesnetzagentur | Contact market surveillance with product details and where you bought it; report unsafe products via the EU database ICSMS |
| Austria | Sozialministerium, AGES | Find important recalls on ages.at and in the AGES app |
| Switzerland | BAKOM | List of non-compliant devices, which may not be used, sold or imported |
| France | DGCCRF | Report problems via SignalConso, check recalls on RappelConso |
| Italy | Ministry of Enterprises and Made in Italy (MIMIT) | Compliance and safety of consumer products, including imports |
| Spain | INCIBE | Free cybersecurity helpline 017, WhatsApp 900 116 117, Telegram @INCIBE017 |
What should you do after buying?
- Replace the default password for the device and app with a long one of your own.
- Turn on automatic updates and install offered updates promptly.
- Switch off features you do not need, such as remote access.
- Use only a well-protected Wi-Fi network; see Home Wi-Fi check: five questions for your router.
- Keep the receipt, a screenshot of the listing and the seller’s answer on updates.
An example: Niamh compares two sets of smart plugs
Fictional example: Niamh in Galway wants to switch her lamps on and off while away. She compares a four-pack of smart plugs for €19 with a two-pack for €32. The cheaper listing names a brand but no manufacturer address, and the parcel ships from outside the EU. Safety Gate shows no alerts for either model, which on its own proves nothing.
Niamh asks both sellers until when security updates will be provided. The maker of the two-pack names a date and an EU postal address; the other seller does not reply. She buys the two-pack, sets her own password in the app, turns on automatic updates and keeps the answer with her receipt.
Common mistakes
- Treating the absence of a Safety Gate alert as proof of safety.
- Reading the CE marking as an official quality seal rather than the manufacturer’s own declaration.
- Comparing only price and star ratings and missing where the goods ship from.
- Keeping the default password and postponing updates.
- Reading the privacy notice and app terms only after the purchase.
Your checklist
The checkboxes are for your own reference. No entries are sent to us. To keep a copy, print the page or save it as a PDF using your browser menu.
Common questions
Does a CE marking prove that a smart device is secure?
No. With the CE marking, the manufacturer declares that the product meets the applicable requirements. Since August 2025, these include protecting the network, data and privacy for connected radio equipment. Authorities such as Germany’s Bundesnetzagentur only check samples. If the marking is missing or looks suspicious, you can report the product to the authorities in your country.
How long must a smart device receive security updates?
From 11 December 2027, the manufacturer must state the end date of its support period at the time of purchase, generally at least five years. Until then, national rules vary; in France, for example, sellers must already state how long software updates remain compatible. Ask for a date before you buy and keep the answer.
Do these rules apply in Switzerland?
Not automatically. Switzerland is not an EU member, so Swiss rules apply. Telecommunications installations and electrical devices that do not meet them may not be placed on the market or used. BAKOM keeps a list of non-compliant devices that is not exhaustive, and breaches can be fined. The checks in this guide still help you compare offers.
Sources and further information
Primary sources from public authorities, consumer organisations and providers. A source may be in another language; follow the guidance that applies to your service and where you live.
- EUR-Lex: Delegated Regulation (EU) 2022/30 on radio equipment (consolidated version)Source review date:
- European Commission: Cyber Resilience Act summarySource review date:
- EUR-Lex: Regulation (EU) 2024/2847, the Cyber Resilience ActSource review date:
- Your Europe: Product safety, CE marking and Safety GateSource review date:
- Bundesnetzagentur (Germany): Market surveillance and buying tips (in German)Source review date:
- Sozialministerium (Austria): Dangerous products and recalls (in German)Source review date:
- BAKOM, Swiss Federal Office of Communications: Non-compliant devices (in German)Source review date:
- DGCCRF (France): Connected objects, the risks to know (in French)Source review date:
- MIMIT (Italy): Safety of consumer products (in Italian)Source review date:
- INCIBE (Spain): Protect your smart home (in Spanish)Source review date:
