The product isn’t finished when it ships
The Cyber Resilience Act is changing what “launch readiness” means for consumer electronics
For decades, the consumer electronics product lifecycle had a clear endpoint: design the product, test, certify, manufacture, ship.
Connected products have changed the meaning of “finished”.
A smart TV receives firmware updates long after installation. A smart lock depends on mobile operating systems and wireless protocols that continue to evolve. A connected appliance can contain software components whose vulnerabilities only become known years after launch.
The product may have left the factory, but it doesn’t stop changing.
That is one reason the EU Cyber Resilience Act (CRA) represents such a significant shift for consumer electronics manufacturers. Cyber security is no longer simply something to assess before launch. Manufacturers need to consider security across the product lifecycle, including vulnerability handling and ongoing support.
The question is changing from “Is this product ready to launch?” to “How will we continue to assure it throughout its life?”
The connected product has no fixed state
Consider what can happen after a connected product has passed its testing programme.
A firmware update changes how the device communicates. A vulnerability is discovered in a third-party component. A mobile operating system changes its permissions. A cloud API is updated. A new threat emerges.
None of these changes necessarily means starting the entire assurance process again, but each raises the same question: what changed, what does it affect, and does our existing evidence still provide the confidence we need? For connected products, assurance needs to move with the product.
What early CRA pilots are showing
The practical challenge is becoming clearer through early CRA readiness work.
As part of the European CRACY programme, “CRA Compliance made easY”, manufacturers have been busy testing practical CRA tools and assessments against real connected products. The pilots have highlighted challenges in both technical security and the evidence and processes needed for practical CRA readiness.
The first pilot involved a Yale Linus L2 Smart Lock, a company who are taking a proactive approach to preparing for the CRA. The product underwent Bluetooth and Wi-Fi protocol testing, fuzzing, authentication validation and network resilience testing.
Yale said “the pilot not only provided valuable independent input but also aligned with Yale’s broader strategy of fostering a more secure, safer, and accessible smart home market for all”.
A second pilot with tado° highlighted a different challenge. The technical testing produced strong results, but that did not mean the CRA work was finished.
The assessment also considered documentation, risk assessments, security processes and the evidence supporting secure development. Their Head of Firmware Engineering, Matthias Bösl, wanted independent validation that products, processes and documentation were aligned with the emerging requirements of CRA.
Manufacturers also need to show what they have done, why they have done it, how risks have been assessed and how security will continue to be managed as the product evolves.
The lesson from both pilots is clear:
CRA readiness isn’t a test you pass. It’s a capability you maintain.
The evidence needs to evolve with the product
A manufacturer might have penetration-testing results, vulnerability assessments, risk documentation, software inventories and certification evidence. Together, these can provide a strong picture of product security.
But what happens six months later?
A new firmware version is released. Does the original testing still apply?
A software dependency is updated. Does the risk assessment need to change?
A vulnerability is discovered in a component. What is the process for assessing its impact?
The answer won’t always be “test everything again”. Instead, manufacturers need to understand what has changed, what risks that change introduces and what assurance activity is appropriate in response.
That could mean targeted regression or interoperability testing, a security review, further vulnerability assessment or, where necessary, formal recertification. The important thing is that the decision is deliberate and supported by evidence.
From launch readiness to lifecycle assurance
This is the biggest conceptual shift.
Rather than treating assurance as a gate immediately before launch, it becomes a continuous cycle:
BUILD – Security requirements and risks are considered during development.
ASSURE – Testing and evidence provide confidence before launch.
MONITOR – Vulnerabilities, threats, dependencies and product changes are tracked.
RESPOND – Security issues are assessed and remediated.
REASSESS – Changes are evaluated to determine whether existing assurance remains valid or additional testing is required.
Then the cycle continues.
The CRA reflects this reality by requiring manufacturers to handle vulnerabilities effectively throughout the product’s defined support period. From 11 September 2026 manufacturers must provide an early warning within 24 hours and a main notification within 72 hours for actively exploited vulnerabilities and severe security incidents. That duty covers products already on the EU market, including those placed there long before the CRA’s main obligations apply in December 2027.
In short: The manufacturer’s responsibility doesn’t end when the product reaches the customer.
Security becomes part of product quality
For consumer electronics companies, this shouldn’t be viewed purely as a compliance challenge.
Customers don’t distinguish between a hardware problem and a security problem. They experience a product that works and is secure, or not. That makes lifecycle cyber resilience increasingly inseparable from reliability, usability and customer trust.
Marco Bulgheroni of Electrolux made the point at IFA Berlin 2026: regulation is a floor, trust is the adoption gate. People won’t hand a robot the kitchen until they trust how it decides.
Trust is slow to build and quick to lose, and for brands leading on connected products it is most of what the brand is worth. That is the argument for doing CRA properly rather than to the minimum, and with people who have done it before. In both pilots, the gap was rarely in the technical testing. It was in knowing what evidence a regulator will want, and in what form.
The stronger approach is to build an assurance process that connects requirements, testing, evidence, change and ongoing vulnerability management. It doesn’t mean testing everything, all the time. It means knowing what matters, what has changed and when the evidence needs to change with it.
The product isn’t finished when it ships
Connected consumer products don’t have a single, fixed state. Their software changes. Their dependencies change. The threats change. And the environments in which customers use them change.
The Cyber Resilience Act reflects that reality by making cyber security part of the product lifecycle rather than simply the launch process. For manufacturers, that means changing the question from: “Have we tested it?” to: “How will we continue to assure it?” And it isn’t only consumer electronics. The same question is arriving anywhere connected systems make decisions on our behalf. Because a connected product isn’t finished when it ships.
Read our brochure to find out more about how Resillion can help you with the Cyber Resillience Act.
