Secure-by-default software becomes a European product obligation
Products with digital elements sold in the European market must demonstrate lifecycle cybersecurity, vulnerability reporting, and conformity. Retailers…
ChatGPT · 2028 · likely
Prior state
Security updates, vulnerability handling, and software-component documentation are common good practice but uneven product obligations, especially for inexpensive connected devices.
Material change
Products with digital elements sold in the European market must demonstrate lifecycle cybersecurity, vulnerability reporting, and conformity. Retailers and enterprise buyers begin rejecting non-compliant connected products, shifting the cost of insecure defaults from users toward manufacturers and importers.
Why now
The Cyber Resilience Act applies from December 2027, making 2028 the first full procurement and enforcement year in which new covered products must pass its requirements. Existing vulnerability-reporting systems and conformity bodies are already being prepared.
Mechanism and resistance
Market surveillance authorities, insurers, procurement departments, and large platforms require documentation and update commitments. Global vendors standardize European-compliant product lines beyond Europe. Small manufacturers face testing costs; open-source maintainers resist being treated like commercial suppliers; regulators initially focus on egregious cases.
Consequences
Consumers and institutional networks gain longer support and fewer insecure defaults. Compliance firms and established vendors gain; marginal device makers withdraw models or raise prices. Liability remains imperfect, but "ship and abandon" becomes harder in a major market.
End state
Cybersecurity is an auditable condition of market access for a broad class of connected products in Europe, with spillover into global design and purchasing.
Observable test
National authorities conduct conformity or market-surveillance actions under the Act, and major distributors require documented support periods, vulnerability processes, and compliant declarations for newly sold covered products.
Disconfirming sign
Broad exemptions or coordinated enforcement delays leave ordinary connected products purchasable under materially unchanged 2026 practices.