EU Smart Device Rules 2026: What Matter Makers Must Meet
EU smart device rules 2026 explained: the Radio Equipment Directive, Cyber Resilience Act dates, where Matter fits and what makers and owners should do.
EU smart device rules 2026 combine CE marking, cybersecurity and reporting duties.
EU smart device rules 2026 are not a “Matter 1.6 ban”. Two real laws apply: the Radio Equipment Directive (RED) cybersecurity act, in force since 1 August 2025, and the Cyber Resilience Act (CRA), whose first duties start on 11 September 2026. This guide from IoT Insights Hub explains what each law asks of smart home makers and what owners should check.
Key Takeaways
- EU smart device rules 2026 come from the RED delegated act and the Cyber Resilience Act, not from Matter.
- RED cybersecurity duties apply from 1 August 2025. CRA vulnerability reporting starts 11 September 2026.
- Most other CRA duties, including CE marking for security, apply from 11 December 2027.
- No source we found bans seven named device types. Devices you already own keep working.
- Matter helps with security but is not a legal compliance certificate.
Editorial note: an earlier version of this article described a “Matter 1.6 rule” that banned seven device types. IoT Insights Hub found no EU or Connectivity Standards Alliance source for that claim, so we replaced it with what the law actually says.
Table of Contents
What are the EU smart device rules 2026 for connected home products?
EU smart device rules 2026 are two laws working together. The Radio Equipment Directive’s delegated act has required cybersecurity, privacy and fraud protections for internet-connected radio equipment since 1 August 2025. The Cyber Resilience Act adds vulnerability handling and reporting duties from 11 September 2026, and full product requirements from 11 December 2027.
Both laws cover products that connect to the internet or to other devices, which takes in smart bulbs, plugs, locks, cameras and hubs. The European Commission’s CRA page describes the Act as horizontal legislation for products with digital elements. Read it alongside IoT Insights Hub’s guide to IoT security risks in 2026.
Is there an EU Matter 1.6 rule that bans smart devices?
No. We found no EU regulation or Connectivity Standards Alliance document that bans seven device types under a Matter 1.6 rule. Matter is an industry interoperability standard, not EU law. Using Matter does not by itself prove legal compliance, and lacking Matter does not make a device illegal.
Headlines about banned bulbs and plugs usually mix up three things: the CSA’s Matter specification, the RED cybersecurity act and the CRA. Check any such claim against the official texts on EUR-Lex listed in the sources below.
What are the key dates for EU smart device rules 2026 and beyond?
Four dates matter. The RED cybersecurity requirements apply from 1 August 2025. CRA vulnerability and incident reporting starts on 11 September 2026. Nearly all other CRA duties, including CE marking for cybersecurity, apply from 11 December 2027. Products sold before that date are generally not covered unless substantially modified.
| Date | Law | What starts |
|---|---|---|
| 1 August 2025 | RED delegated act (EU) 2022/30 | Network protection, privacy and fraud protection for internet-connected radio equipment |
| 10 December 2024 | CRA (EU) 2024/2847 | Act enters into force |
| 11 September 2026 | CRA | Manufacturers must report actively exploited vulnerabilities and severe incidents |
| 11 December 2027 | CRA | Main product requirements, CE marking for cybersecurity and full enforcement |
| 16 February 2026 | Delegated Regulation (EU) 2026/339 | Repeals the RED cybersecurity act (EU) 2022/30 to avoid overlap with the CRA. EUR-Lex metadata lists the old act as no longer in force after 10 December 2027; check the official text |
What must smart device makers do under the EU smart device rules 2026?
Makers must design security in, avoid shipping a shared default password, deliver security updates, and document risks. Under the CRA they must also report actively exploited vulnerabilities to ENISA and national CSIRTs within 24 hours of becoming aware. Conformity with harmonised standards such as EN 18031 gives a presumption of conformity under the RED act.
- Run a cybersecurity risk assessment for each product.
- Publish a contact for reporting vulnerabilities.
- State how long security updates will be supplied.
- Keep technical documentation and a software bill of materials ready.
- Plan CE marking and, for higher-risk classes, third-party assessment.
Our partner site covers the maker duties in more depth in its Cyber Resilience Act guide for IoT makers.
Where does Matter fit into EU smart device rules 2026?
Matter gives devices a common language, signed device attestation and encrypted local communication, which helps meet security goals. It does not replace RED or CRA duties. A Matter-certified bulb still needs its own risk assessment, update plan and CE documentation. Treat Matter as one useful layer, not a compliance certificate.
Matter’s local control and multi-admin design also reduce dependence on a vendor cloud, which is good for privacy. Hobbyists building on boards such as the ones in our ESP32 vs Raspberry Pi Pico W comparison should note that selling a finished product changes their obligations.
What should smart home owners do about the EU smart device rules 2026?
Nothing needs to be thrown away. Existing devices keep working. When buying new, choose brands that publish a security-update period, a vulnerability contact and a support end date. Change default passwords, turn on automatic updates and keep Matter and Thread firmware current.
What do critics say about the EU smart device rules 2026?
Critics say the CRA adds cost and paperwork that small makers and open-source projects struggle to carry, and that the harmonised standards for the CRA were still being drafted in 2026, which leaves uncertainty. Supporters say clear update and reporting duties will remove the worst products from shelves.
Both sides have a point. The CRA tries to ease the load on open-source software through its “steward” concept, but smaller hardware makers still face certification work. This is IoT Insights Hub’s editorial reading, not a named study, so check your own product category with a test lab.
What else do people ask about the EU smart device rules 2026?
Are smart devices being banned in the EU in 2026?
No blanket ban exists. Devices that do not meet the Radio Equipment Directive cybersecurity requirements cannot be placed on the EU market as new products, but devices you already own keep working. We found no rule that bans seven named device types.
Is Matter required by EU law?
No. Matter is an industry standard from the Connectivity Standards Alliance. It can support security goals, but the legal duties come from the Radio Equipment Directive and the Cyber Resilience Act.
When does the Cyber Resilience Act apply to smart home devices?
Reporting duties for actively exploited vulnerabilities and severe incidents start on 11 September 2026. Most other obligations, including CE marking for cybersecurity, apply from 11 December 2027.
Do hobbyist ESP32 or ESPHome projects fall under these rules?
Personal projects that are never sold or supplied commercially are generally outside the scope. Selling devices or firmware as a commercial product can bring the rules into play, so check the official guidance.
What should you do next about EU smart device rules 2026?
Makers should map each product to RED and CRA duties now, starting with the 11 September 2026 reporting process. Owners can keep their devices and update them. EU smart device rules 2026 reward clear security practice, not panic. IoT Insights Hub will update this guide as harmonised standards are published.
Sources (official texts, dates as published on 5 November 2026):
About The Author
2 thoughts on “EU Smart Device Rules 2026: What Matter Makers Must Meet”
Comments are closed.