EU cyber law won’t force fixes for fridge controllers hit in French attack
A real-world attack on French fridge controllers exposes a material gap in the Cyber Resilience Act: manufacturers set their own support periods, leaving enterprises with no regulatory guarantee of patches for embedded IoT devices.
Summary written by editorial AI · Source link below
The EU’s Cyber Resilience Act that took effect last month only requires companies to fix vulnerabilities and issue free updates during a product's support period, which manufacturers define.
Editorial Analysis
European enterprises procuring connected devices cannot rely on the CRA alone for lifecycle security; procurement contracts must explicitly mandate minimum support periods.
Update procurement policies to require vendors to commit to minimum support and patching periods for all connected devices, independent of CRA defaults.
The EU's new Cyber Resilience Act does not guarantee patches for IoT devices past a manufacturer-chosen support window — procurement policies must fill the gap.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at The Record in a new tab.
More from the Regulatory Desk
- UK Warns Its Critical Infrastructure Faces Grave Risk3d
- Watermarking Without Standards Is Not AI Governance3d
- EU AI Act transparency rules show why businesses can’t afford to wait5d
- European digital rights nonprofit noyb sues Scale AI for ‘invasive’ worker surveillance28 Oct
- Autonomous Cyber Weapons as AI-Enabled Digital Harms: A Platform Accountability Framework26 Oct