EU cyber law won’t force fixes for fridge controllers hit in French attack
A real-world attack on French fridge controllers exposes a material gap in the Cyber Resilience Act: manufacturers set their own support periods, leaving enterprises with no regulatory guarantee of patches for embedded IoT devices.
Summary written by editorial AI · Source link below
The EU’s Cyber Resilience Act that took effect last month only requires companies to fix vulnerabilities and issue free updates during a product's support period, which manufacturers define.
Editorial Analysis
European enterprises procuring connected devices cannot rely on the CRA alone for lifecycle security; procurement contracts must explicitly mandate minimum support periods.
Update procurement policies to require vendors to commit to minimum support and patching periods for all connected devices, independent of CRA defaults.
The EU's new Cyber Resilience Act does not guarantee patches for IoT devices past a manufacturer-chosen support window — procurement policies must fill the gap.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at The Record in a new tab.
More from the Regulatory Desk
- UK proposes 14-year prison terms for undersea cable sabotage3d
- U.K. Sanctions Cryptomus for RU Money Laundering14 Oct
- Norway fines Microsoft ad firm $9.6 million over Grindr data sharing12 Oct
- CYBERFORT: A Compliance-Chain Platform Operationalising the Cyber Resilience Act for SMEs8 Oct
- Japan Adopts Proactive Cyber Defense Strategy8 Oct