Starting September 11, 2026, the first reporting requirements under the Cyber Resilience Act (CRA) will take effect: Manufacturers of connected products will be required to report actively exploited vulnerabilities and serious security incidents to the relevant authorities within 24 hours. For the Austrian smart lock manufacturer Nuki, this is no cause for concern, but rather confirmation of the course the company has been on since its founding. Nevertheless, Nuki is pushing for action: The new rules must be enforced equally for all manufacturers; otherwise, those who have already invested in security could face a competitive disadvantage.
- What’s happening: Starting September 11, 2026, the first CRA reporting requirement for actively exploited vulnerabilities and serious security incidents will take effect.
- Deadlines: 24 hours for an early warning, 72 hours for an expanded report, and 14 days for the final report.
- When does full compliance become mandatory: By December 11, 2027, all affected products must fully comply with CRA requirements.
- Nuki’s position: Security-by-design has been standard at Nuki for over ten years; the CRA confirms this approach but requires consistent market monitoring.
What Specifically Takes Effect on September 11, 2026
The Cyber Resilience Act has been in effect since December 2024, but the actual obligations are phased in. The first phase begins on September 11, 2026: Manufacturers must report vulnerabilities and incidents to the European cybersecurity agency ENISA and the relevant national CSIRT—in Germany, this is the BSI. The reporting process takes place in three steps. First, an early warning must be issued within 24 hours, including product identification and an initial assessment. This is followed within 72 hours by an updated report containing technical details. The process concludes with a full report submitted no later than 14 days.
Virtually every product with a digital component and a network connection is affected, ranging from smart home devices to industrial control systems and accounting software. Exceptions apply, among others, to medical technology, civil aviation, and certain types of vehicles that are already subject to their own regulations. Starting December 11, 2027, all connected products sold in the EU must then meet the full CRA requirements, from secure development to long-term update support.
| Date | What Applies |
|---|---|
| September 11, 2026 | Mandatory reporting of actively exploited vulnerabilities and serious security incidents begins |
| +24 hours after discovery | Early warning to ENISA and the national CSIRT (in Germany: BSI) |
| +72 hours after discovery | Expanded report with technical assessment |
| +14 days after discovery | Complete final report |
| December 11, 2027 | All CRA core requirements must be fully met |
Nuki: “Not just a superficial touch-up,” but part of the product’s DNA since its founding
The Graz-based manufacturer is best known in Germany for its retrofit locks, which allow standard door locks to be controlled smartly without any modifications—for example, via the Nuki Opener, which can now also be controlled via IFTTT. Nuki views the CRA less as a new hurdle and more as a validation of its own approach: End-to-end encryption, ongoing threat analyses, and automatic security updates have been standard features since the first generation of smart locks, along with physical secure elements and enhanced memory protection against tampering.
“For us, IT security isn’t just a superficial touch-up applied to a product when a new regulation comes along—it’s embedded in our product’s DNA. We therefore see the Cyber Resilience Act as a logical continuation of our existing course,” says Jürgen Pansy, co-founder and Chief Innovation Officer at Nuki. Still, the transition isn’t entirely effortless: “No one can simply pull compliance with the CRA requirements out of thin air. But thanks to our groundwork, this isn’t a frantic overhaul while operations continue—it’s structured work built on a very solid foundation.”
The reporting requirement is a real-world test for the security organization
Luise Werner, a cybersecurity expert at the BSI-certified testing agency secuvera, emphasizes that the new deadlines require more than just a signature on a compliance document: “The new reporting requirements are, above all, a practical test for manufacturers’ security organizations. Within a very short time, it must be possible to reliably determine which products and versions are affected, how severe an incident is, and what measures are necessary. This only works if risk analysis, secure development, technical testing, and vulnerability management are already seamlessly integrated.”
Testing practice reveals just how great the difference can be between processes that look sound on paper and actual security. “A product can be secure on paper and still be vulnerable. Independent security tests provide an important additional perspective,” says Eric Clausing, IoT Lead at the testing institute AV-TEST. Most vulnerabilities found in practice do not arise from gaps in the design, but from errors in implementation—ranging from online communication to the app to the hardware. Clausing therefore views the CRA’s binding framework positively: It forces manufacturers to make security measurable and transparent, thereby building trust among both customers and the manufacturers themselves.
Why Many Buyers Still Distrust Smart Locks
This lack of trust is Nuki’s real problem, not the technology behind it. According to a recent customer survey conducted by the company, 44 percent of respondents cited security concerns as one of the biggest hurdles to purchasing an electronic door lock, even though established devices such as Nuki’s own models, competitive products from Yale (such as the recently introduced Linus Smart Lock L2 Lite), or locks like the WE.LOCK SOHO demonstrate a high level of security in testing. A study by Parks Associates commissioned by the Connectivity Standards Alliance reaches a similar conclusion and cites privacy and security concerns as a major obstacle to the widespread adoption of smart home products overall.
“That’s why we expressly welcome the Cyber Resilience Act. Legal frameworks such as the CRA, as well as reliable industry standards like Matter and certifications from independent testing institutes such as AV-TEST, help alleviate unfounded fears. They build the trust we need to make smart locks relevant to the general public,” explains Martin Pansy, co-founder and CEO of Nuki.
When Compliance Becomes a Competitive Issue
As clearly as Nuki supports the CRA, the company is equally clear in pointing out the cost implications. The European Commission estimates the direct compliance costs at around 29 billion euros, roughly two percent of the European industry’s revenue. According to Martin Pansy, that’s only part of the equation: “The obligation to provide security updates for a product for five years or longer ties up developer resources on an ongoing basis. On top of that, there are additional expenses for component selection and software tools.” For an established company like Nuki, this is feasible; for young startups, however, it’s a real barrier to market entry that can slow innovation in Europe.
From this, Pansy derives a clear demand: strict market oversight. “The CRA sets the right standards, but an EU regulation is only as strong as its enforcement. Strict regulations are of little use to consumers if products without proven safety standards continue to enter the European market unhindered. We need a level playing field that rewards responsibility and does not encourage circumvention of regulations.”
Conclusion
The Cyber Resilience Act transforms what was previously a matter of discretion into a legal obligation, and September 11, 2026, is just the beginning. By December 11, 2027, manufacturers must have fully aligned their processes for development, reporting, and update distribution with the new requirements. For providers like Nuki, which have been investing in “security-by-design” for years, this is a validation. Whether the CRA actually ensures greater security in the smart home or merely incurs additional costs will depend on one aspect that is scarcely mentioned in the text of the law itself: consistent market surveillance.
Sources: Nuki press release, European Commission,
