Connected smart locks fall within a wider product-security change
Regulation (EU) 2024/2847, known as the Cyber Resilience Act, entered into force on December 10, 2024. The European Commission describes it as a horizontal framework for hardware and software products with digital elements made available on the EU market.
A connected smart lock may combine physical lock hardware, wireless modules, firmware, mobile applications and cloud services. Buyers and responsible economic operators should assess which parts of the complete product and supply chain fall within their compliance scope.
Security responsibilities continue after product launch
The European Commission summary highlights secure product development, vulnerability handling, security updates and information for users. These responsibilities make lifecycle planning as important as pre-shipment functional testing for connected lock programs.
Project documentation should clearly allocate responsibilities for firmware maintenance, app and cloud components, vulnerability intake, security updates, incident escalation and end-of-support communication.
Key dates should be built into product roadmaps
The Commission states that reporting obligations apply from September 11, 2026 and that the Act becomes fully applicable from December 11, 2027, with certain conformity-assessment provisions applying earlier.
Importers and brands should use the preparation period to review product architecture, software bills of materials, technical documentation, supplier agreements and update processes. This article is a buyer-planning summary and not legal advice.
Official source and buyer takeaway
Official source: European Commission, “The Cyber Resilience Act — Summary of the Legislative Text.” View the official source cited for this article
Buyer takeaway: connected smart lock RFQs should include cybersecurity documentation, software maintenance and vulnerability-management questions early enough to influence architecture and commercial responsibility.