EU cyber act sparks race to patch IoT security gaps
The gist
The EU Cyber Resilience Act is forcing IoT manufacturers into a high-stakes race to overhaul security, report breaches within 24 hours, and ditch quick-fix compliance for continuous vigilance—or risk regulatory chaos.
What to know
- Nearly half of British manufacturers lack formal cyber incident response plans, even as 30% have faced attacks and the EU's 24-hour reporting deadline looms for September 2026.
- The CRA demands secure-by-default IoT devices, ongoing vulnerability management, and a detailed software bill of materials before CE marking—making one-time compliance a thing of the past.
- Four overlapping EU regimes (CRA, NIS2, GDPR, MDR) create a tangled web of staggered reporting rules, turning unified incident management into a regulatory minefield.
Manufacturers Face Readiness Crunch
With the EU’s 24-hour breach reporting rule imminent, most manufacturers are still scrambling to build real incident response capabilities amid a surge in supply chain attacks.
With the EU’s 24-hour breach reporting rule imminent, most manufacturers are still scrambling to build real incident response capabilities amid a surge in supply chain attacks.
Security by Design, Not by Default
The CRA forces IoT makers to overhaul their entire approach, demanding continuous security updates, embedded resilience, and long-term accountability for every connected device.
The CRA forces IoT makers to overhaul their entire approach, demanding continuous security updates, embedded resilience, and long-term accountability for every connected device.
Regulatory Maze Complicates Breach Response
Conflicting deadlines and overlapping EU regimes mean that one cyber incident can trigger a cascade of legal obligations, with each stakeholder facing unique—and sometimes conflicting—reporting pressures.
Conflicting deadlines and overlapping EU regimes mean that one cyber incident can trigger a cascade of legal obligations, with each stakeholder facing unique—and sometimes conflicting—reporting pressures.