Will your toaster need cybersecurity too?

It is half past seven in the morning. The coffee is brewing and the bread is already in the toaster. So far, a perfectly ordinary start to the day.

Now imagine the toaster also has Wi-Fi, an app and the helpful ability to tell us, via our phone, that the toast is ready. Invaluable information, particularly when we are standing fifty centimetres away.

For decades, our main concern was choosing between lightly toasted bread and buttered charcoal. But we added software and a network connection. Along with them came a few more questions: who fixes a security flaw? How do we install an update? How long will the manufacturer keep taking care of that?

The toaster is a bit of fun. The questions already apply to things we buy every day.

When household appliances gained a digital life

A camera watching the front door, a television, a smart lock or the router at home each has a function we can easily explain. Beneath that function, though, there is software, communication and configuration.

This is the Internet of Things, or IoT: objects that exchange data over a network. Some of the software that makes them work is called firmware. We cannot see it on the shop counter, but we take it home too.

A vulnerability in that software might, for example, allow unauthorised access to a camera or let someone use a device in attacks against others. The consequences depend on the flaw, the connections and the protections in place. It does not mean that any smart light bulb automatically gives access to everything on our network.

The problem is simpler than that: we buy an object expecting to use it for years, but its security also depends on work that someone has to keep doing after the sale.

If the toaster’s heating element lasts ten years but care for its software stops after two, we have bought two things with rather different lifespans. The box probably only drew our attention to one of them.

Connectivity comes with responsibilities

This is where the Cyber Resilience Act, or CRA, comes in: the European regulation that sets cybersecurity requirements for products with digital elements falling within its scope.

The fundamental change is to make security a manufacturer’s responsibility throughout development and the support period. The European Commission presents the CRA as a response to inadequate product security and the difficulty buyers face in assessing it.

We should be precise about where our toaster fits: having electronic components is not enough, on its own, to bring a product within scope. The scope covers hardware and software products made available on the market in the course of a commercial activity, with a direct or indirect data connection to a device or network. That connection does not even have to be to the Internet.

A conventional toaster with an electronic timer does not automatically enter this story. Our imaginary toaster, with Wi-Fi and an app, illustrates the issue; whether a particular product is covered depends on its characteristics and the applicable exclusions.

Nor should we lump every volunteer developer together with a commercial manufacturer. Free and open-source software made available outside a commercial activity is excluded; in other contexts it may be covered, and certain organisations that sustain open-source projects have their own rules. The Commission’s explanation of open source clarifies these distinctions. Open source and commercial activity are not automatically opposites.

Security should come as standard

In practice, the requirements for manufacturers cover risk assessment, secure default settings, vulnerability handling and the information needed to use a product securely.

This is the principle of security by design: considering these problems while designing the product. If a device arrives at home with a predictable, universal password, it makes little sense to leave the buyer to do all the work of compensating for that choice.

After the sale, there must be a way to receive reports of flaws, assess what has been found and provide fixes during the support period. For consumer products within scope, security updates must be made available free of charge. Fixing a vulnerability should not require a premium peace-of-mind subscription.

The support period deserves particular attention. It must reflect how long the product can reasonably be expected to be used, with a minimum of five years unless its expected use is shorter. If a longer period of use can reasonably be expected, as may be the case with a router, support must reflect that duration. Five years is not a licence to abandon any product at that point.

There is also a useful detail for buyers: the end of the support period must be clearly stated, with the month and year, at the time of purchase. We should not assume that a fresh five-year period starts when we reach the till. It is worth looking for the actual date.

A router can keep providing Internet access for years after it stops receiving fixes. Pages load, Wi-Fi works, but a flaw discovered later may remain unpatched. Working and continuing to receive security support are different things.

Is it all applicable already? Not yet

For those buying and using these products, three dates are essential to understanding the situation in November 2026. The regulation’s timetable includes other stages, but these are the ones worth highlighting here:

Date	What it means
10 December 2024	The CRA entered into force.
11 September 2026	Manufacturers’ obligations to report actively exploited vulnerabilities and severe incidents covered by Article 14 began to apply.
11 December 2027	The main product cybersecurity obligations apply.

Reporting certain flaws and incidents is therefore already an obligation. ENISA announced the launch of the European reporting platform in September 2026. This does not mean users have to fill in an EU form every time the television app freezes.

But we cannot look at a device on sale today and conclude that it already meets every requirement that will apply in December 2027. Entry into force and the application of the different obligations are not the same thing.

What about the devices already in our homes?

The regulation does not install a miraculous update on an old router, nor does it make every existing product subject to the new requirements.

Under the transitional provisions, products placed on the market before 11 December 2027 are subject to the CRA’s requirements only if they undergo a substantial modification from that date onwards. There is an important exception: the reporting obligations in Article 14 also cover earlier products within the regulation’s scope. These details appear in the CRA’s text, particularly Article 69.

For the equipment we already own, the practical questions still make sense: does it receive updates? Are we installing them? Do we really need to keep every connection and remote feature enabled?

The CRA does not promise to keep every cloud service running forever either. A feature that relies on the manufacturer’s servers deserves a question of its own: what will keep working if that service shuts down?

Before buying, look beyond the Wi-Fi

We usually compare price, power, size and features. For connected devices, I would add four questions:

• Until when will it receive security fixes? Looking for a specific date is more useful than a vague promise of ‘regular updates’.
• How are updates installed? It helps to understand whether updates are automatic and how we are told when we need to do something.
• Who is responsible when a flaw is found? An identifiable manufacturer, with documentation and a security contact, gives us information that an advert full of adjectives cannot.
• What happens without the Internet or the manufacturer’s service? The answer helps us assess the dependency we are buying into.

CE marking, in the context of the CRA’s applicable requirements, indicates conformity. It does not mean that a product is impossible to attack, or that every device has been individually tested by a European authority. Assessment procedures vary depending on the product.

We will still need to install updates, protect our accounts and use devices carefully. But that does not remove the responsibility of those who design them and place them on the market.

This is the change that matters most to me: being able to demand answers about security as naturally as we ask about energy consumption or the warranty.

I do not want to turn breakfast into an IT department meeting. I want to buy a connected device and know that someone has thought about what happens after I take it out of the box.

Burnt toast can be fixed with another slice. A device abandoned by its manufacturer, however, can stay on our network for years with flaws left unpatched. Looking after the security of a connected product should not be a responsibility left solely to the person who bought it.

A short glossary

• IoT — Internet of Things: physical objects that communicate over a network.
• Firmware: software built into a device that controls how it works.
• Vulnerability: a weakness that can be exploited to compromise security.
• Security update: a software change intended to fix or mitigate security flaws.
• Security by design: considering security from the product’s design and development stages onwards.
• Support period: the period during which the manufacturer handles vulnerabilities in accordance with the applicable obligations.