EU Cyber Resilience Act mandates five‑year security updates for connected devices

From 11 September 2026 manufacturers of network‑connected products such as routers, smart TVs and baby monitors must report active vulnerabilities to the EU within 24 hours, issue a full notification within 72 hours and submit a final report within 14 days after a fix is ready. Full enforcement of the reporting duty begins on 11 December 2027, and the act requires a minimum five‑year security‑update support period for each product placed on the EU market. Non‑compliant firms can face penalties of up to €15 million or 2.5 % of global turnover, whichever is higher.

A YouGov survey carried out in April 2026 with 16 474 respondents across 14 European countries found strong consumer distrust of routers from Russia and China. In Denmark, more than three‑quarters of participants distrust Russian devices and 60 % distrust Chinese ones, while only 6 % mistrust European‑made routers. The same poll showed that many consumers cannot correctly identify the origin of major brands, highlighting a knowledge gap that complements the new regulatory push for higher security standards.