The European Union has officially enacted the Cyber Resilience Act, introducing mandatory cybersecurity standards for all Internet of Things devices sold in the EU market. The landmark regulation represents the most comprehensive attempt by any major jurisdiction to address the systemic cybersecurity risks posed by the proliferation of poorly secured connected devices.

Under the new rules, manufacturers of IoT devices — including smart home appliances, wearables, industrial sensors, and networked toys — must meet minimum security requirements before their products can be sold in the EU. These requirements include implementing secure default settings, prohibiting universal default passwords, providing regular security update support throughout the device's expected lifetime, and disclosing vulnerabilities within defined timeframes.

"This is a watershed moment for IoT security in Europe and potentially the world," said EU cybersecurity commissioner Elena Kovač. "For too long, the costs of insecure devices have been externalized to consumers and society. This regulation puts the responsibility where it belongs — with the manufacturers."

The regulation gives manufacturers a transition period to comply, but enforcement will include market access restrictions and substantial fines for non-compliance. Industry groups representing device manufacturers have broadly welcomed the regulation, while noting that compliance will require significant investment in product development processes.

Cybersecurity experts are praising the regulation as a long-overdue step but are cautioning that enforcement will be critical to its effectiveness. Some are also calling on other major economies, including the United States and the United Kingdom, to implement similar standards to prevent manufacturers from selling compliant products in the EU and insecure versions elsewhere.