Eight days ago a deadline started existing that did not exist before. Since 11 September 2026, any manufacturer placing a connected product on the EU market has 24 hours to tell a national CSIRT when one of its vulnerabilities is being actively exploited. That includes the smart plugs in my hallway, the Zigbee sensors on my window frames, and the mini PC my whole house runs on.
I did not notice. Nothing in my Home Assistant dashboard changed. No vendor emailed me. The change happened entirely on the legal side of the smart home, which is exactly the part I normally ignore, so I spent an evening reading the actual text instead of the headlines. Some of it is better than I expected. One part of it is weaker than the headlines suggest, and it happens to be the part that concerns me as the person living in the house.
What actually switched on this month
The law is the Cyber Resilience Act, Regulation (EU) 2024/2847. It entered into force in December 2024, and most of it does not apply until 11 December 2027. Article 14 is the exception: it applies from 11 September 2026, and Article 14 is the reporting article.
Two things have to be reported. An actively exploited vulnerability, meaning there is reliable evidence somebody is already using it against systems without permission. And a severe incident affecting the security of the product. The timeline is an early warning within 24 hours of the manufacturer becoming aware, a fuller notification within 72 hours, and a final report within 14 days of a fix or mitigation being available. For a severe incident the final report is due within a month.
Reports go through one portal, the Single Reporting Platform, which ENISA switched on the same day the obligation started. A vendor files once, the receiving CSIRT distributes to the other member states where the product is sold. I like this part. Coordinated disclosure in the smart home has historically meant a researcher tweeting at a vendor and hoping.
Two details I had to read twice. First, “aware” is not the moment a bug report lands in an inbox: Commission guidance from July puts it at the point where an initial assessment gives a reasonable degree of certainty. Second, the clock does not pause for weekends or public holidays, so a Friday evening disclosure is somebody’s Saturday. And one more that matters in a flat full of older kit: the obligation covers products already placed on the EU market before the regulation fully applies in December 2027. My four-year-old sensors are not grandfathered out.
The 24 hours are not for me
This is the bit worth being precise about, because the coverage I read collapsed it. The 24-hour deadline is the manufacturer’s obligation toward CSIRTs and ENISA. The obligation toward me exists too, but it is written differently: manufacturers have to inform impacted users, and where appropriate all users, about the vulnerability or incident and any mitigating measures they can take. Without undue delay. No hour count attached.
I do not think that is scandalous. There are good reasons not to force a public announcement 24 hours into an active exploitation, before a fix exists, and the authorities being told first is the point of the design. But it does mean the mental model of “the EU now guarantees I hear about it within a day” is wrong, and I would rather run my house on the accurate version. I still find out the way I have always found out: release notes, GitHub, the vendor’s changelog, and whatever shows up on the Home Assistant community forum before either.
There is also a gap I cannot fully resolve as a non-lawyer. The reporting duty applies now, but the penalty and market surveillance machinery in the rest of the regulation does not arrive until December 2027. So for the next fifteen months the obligation is real and the consequences of ignoring it are thinner than they will be. Treat that as my reading of the application dates, not legal advice.
Home Assistant is not on this clock yet
The CRA invented a category for projects like the one running my house: the open-source software steward. A steward is not a manufacturer. No CE marking, no Declaration of Conformity, no administrative fines. It carries a lighter set of duties: a cybersecurity policy, cooperation with authorities, and reporting. And genuinely free and open-source software supplied outside a commercial activity sits outside the scope entirely.
ENISA’s launch note is explicit about the timing: the steward reporting duty sits in Article 24(3), and that article applies from 11 December 2027. So Home Assistant Core, ESPHome and Zigbee2MQTT are not filing with a CSIRT this month. Home Assistant Green, the Home Assistant Connect ZBT dongles and Home Assistant Cloud are a different story, because those are sold products with a company behind them.
Which is why the most convincing evidence that this regulation has teeth is not a press release. Nabu Casa currently has a Product Security & Compliance Engineer opening, and the description reads like a CRA to-do list: vulnerability handling, security updates, SBOMs, defined support periods, incident reporting, plus EN 18031 and the Radio Equipment Directive. Shelly Group has posted a comparable role. Two smart home vendors I actually buy from are hiring people whose job is to know when the 24-hour clock started. That is a more honest signal than any compliance badge on a box.
My house is in Switzerland, which has none of this
Here is the slightly uncomfortable part of writing this from Switzerland. Switzerland is not in the EU, and there is no Swiss equivalent of the CRA. The Federal Council acknowledged that in August 2025 and told the federal cyber security office, together with OFCOM and SECO, to draft a bill for consultation by autumn 2026, explicitly aligned with the CRA. Autumn 2026 is now. A consultation draft is still several years away from being a law I benefit from.
Meanwhile every Zigbee sensor and smart plug I own was designed for the EU market and sold to me through a Swiss retailer out of essentially the same stock. I get the security work for free, as a side effect of my hardware needing to be sellable in Germany. It works, and I am not going to pretend otherwise. But it is spillover, not protection. If a vendor decided the Swiss channel was not worth the same support period, nothing local stops them today.
What I am actually doing about it
Nothing dramatic, because the CRA does not make any device in my flat better this month. What it changes is the cost of silence for the companies I buy from, and that shows up in purchasing decisions rather than in my configuration files.
Three things I now check before buying, which I did not check this carefully a year ago. Whether the vendor publishes a security contact and an advisory feed at all, because a company that has to report within 24 hours in 2027 probably starts building that habit in 2026. Whether firmware updates can be applied locally, without the vendor’s cloud, since an advisory I cannot act on is trivia. And whether the product page states a support period, because the CRA is going to force that number into the open and I would rather buy from whoever says it voluntarily first.
The rest of my defence is unchanged and unglamorous: almost nothing in this flat can reach the internet, the Zigbee network has no cloud dependency, and my hub is a used office PC whose firmware I patch myself. Local-first was never primarily a regulatory argument. It just happens to be the setup where a vulnerability disclosure I hear about three weeks late is still a manageable problem.
Ask me again in December 2027, when the rest of this regulation arrives and the support-period numbers have to be printed somewhere I can read them. That is the date I have actually put in my calendar.
Leave a Reply