EU cyber law won’t force fixes for fridge controllers hit in French attack
A real-world attack on French fridge controllers exposes a material gap in the Cyber Resilience Act: manufacturers set their own support periods, leaving enterprises with no regulatory guarantee of patches for embedded IoT devices.
Summary written by editorial AI · Source link below
The EU’s Cyber Resilience Act that took effect last month only requires companies to fix vulnerabilities and issue free updates during a product's support period, which manufacturers define.
Editorial Analysis
Framed for the Compliance & GRC desk
The CRA's reliance on manufacturer-defined support periods creates a regulatory gap for connected products; compliance teams must understand where the CRA's protections end and organisational risk management must begin.
Map your CRA compliance strategy to account for manufacturer-defined support periods and establish procurement policies that require minimum support commitments.
The EU's new Cyber Resilience Act does not guarantee patches for IoT devices past a manufacturer-chosen support window — procurement policies must fill the gap.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at The Record in a new tab.
More from the Regulatory Desk
- UK proposes 14-year prison terms for undersea cable sabotage3d
- U.K. Sanctions Cryptomus for RU Money Laundering14 Oct
- Norway fines Microsoft ad firm $9.6 million over Grindr data sharing12 Oct
- CYBERFORT: A Compliance-Chain Platform Operationalising the Cyber Resilience Act for SMEs8 Oct
- Japan Adopts Proactive Cyber Defense Strategy8 Oct