Connected devices now number in the billions worldwide. Thermostats, watches, speakers, locks, health sensors: these devices communicate with each other and their users via the internet or a local network. Their operation relies on precise components, and their proliferation in households raises concrete questions about security and regulation that the general public is still not well aware of.
Cyber Resilience Act: What the European Regulation Changes for Connected Devices
The European regulatory framework has shifted with the entry into force, on December 10, 2024, of the Cyber Resilience Act (CRA), Regulation (EU) 2024/2847. This text imposes mandatory cybersecurity requirements on all products containing digital elements, which covers almost all connected objects sold on the European market.
The implementation schedule includes two major deadlines. Starting from September 11, 2026, manufacturers will have to report to the authorities any actively exploited vulnerabilities and serious cybersecurity incidents affecting their products. Then, from December 11, 2027, a connected device can only be marketed in the European Union if it complies with the CRA and bears a CE marking that also attests to its cybersecurity.
In practical terms, the CRA mandates security by design, vulnerability management, and security updates throughout the product’s intended lifespan. The penalties can reach up to 15 million euros or 2.5% of global turnover. For a manufacturer of thermostats or connected light bulbs, this means that cybersecurity is no longer a marketing argument but a condition for market access.
This regulation remains little known to the general public, even though it will directly influence the software support duration of devices available in stores. A user consulting the definition of connected devices on Transtec is already measuring the extent of the devices affected by these obligations.
Sensors, Protocols, and Cloud: How a Connected Device Works
The operation of a connected device relies on three distinct layers that communicate continuously.
The Physical Layer: Sensors and Actuators
Each object includes one or more sensors that measure an environmental parameter (temperature, movement, brightness, heart rate). A microcontroller processes this data locally before transmitting it. Conversely, an actuator executes a command: turning on a lamp, locking a door, adjusting a thermostat.
The Network Layer: Wi-Fi, Bluetooth, Zigbee, and Beyond
The transmission of data relies on wireless protocols suited to the application. Wi-Fi is suitable for bandwidth-hungry devices (surveillance cameras). Bluetooth Low Energy powers wearable objects like health watches and bracelets. Protocols like Zigbee or Z-Wave, less known, serve dense home automation networks where dozens of sensors must coexist without saturating the home Wi-Fi.
The choice of protocol directly determines battery life, signal range, and compatibility with the rest of the ecosystem. A Zigbee device does not natively communicate with a Bluetooth network, which often requires going through a gateway (hub) or a centralizing voice assistant.
The Software Layer: Cloud and Applications
The collected data is sent to a remote server (cloud) where it is stored, analyzed, and made accessible via a mobile application. It is this sensor-cloud-application loop that allows for remote control of a device, programming automations, or receiving real-time alerts.
Field reports vary on the reliability of this architecture. When the manufacturer’s server fails or when the company ceases operations, the object may lose some of its functionalities or even become unusable. Some manufacturers offer partial local operation, but this approach remains minority.
Concrete Uses of Connected Devices in Home and Health
Domestic uses represent the majority of the consumer market for connected objects. Three categories concentrate adoption.
- Energy management: connected thermostats that learn the habits of occupants, smart plugs that cut power to devices in standby, window opening detectors that automatically suspend heating.
- Home security: remotely accessible IP cameras, connected locks with rotating codes, smoke detectors linked to the user’s smartphone.
- Health monitoring: watches and bracelets that measure heart rate, sleep quality, or step count, connected blood pressure monitors that transmit data directly to the healthcare provider.
In the health sector, the collection of sensitive personal data raises questions about their storage and use. Heart rate data recorded by a watch passes through the manufacturer’s servers before reaching the application. The user does not always have clear visibility on the retention period or on the third parties who access it.
Securing Your Connected Devices: The Actions That Really Matter
The CNIL reminds us that connected devices generate a large amount of personal data stored on the internet, and that securing them is also the user’s responsibility. Several measures significantly reduce the attack surface.
- Systematically change the default password of each device, using a unique and complex password.
- Update the firmware as soon as a new version is available, as these updates often fix actively exploited vulnerabilities.
- Segment the home network by creating a Wi-Fi network dedicated to connected devices, separate from the one used for the computer or smartphone.
- Disable unused features (microphone, geolocation) to limit the collection of unnecessary data.
A connected device whose firmware is no longer updated becomes a potential entry point into the home network. With the arrival of the CRA, manufacturers will be required to provide patches throughout the intended lifespan of the product, but this obligation will only fully apply from late 2027. Until then, checking the manufacturer’s support policy before purchase remains the most reliable reflex.
The market for connected devices is evolving under dual pressure: that of uses, which are multiplying in homes and health, and that of European regulation, which raises security requirements to an unprecedented level. The choice of a connected object is no longer limited to its functionalities: the duration of software support and compliance with the CRA are becoming full-fledged purchasing criteria.