The clock started ticking on September 11. Under Article 14 of the EU Cyber Resilience Act, any company selling connected products in the European market now has 24 hours to report an actively exploited vulnerability to national authorities once it becomes aware of it. The rule covers smart door locks, baby monitors, thermostats, routers, wearables, and the industrial control kits behind factory floors. It does not matter whether the manufacturer is based in Munich or Shenzhen or Jakarta.
The law firm Crowell & Moring laid out the mechanics in a client alert ahead of the deadline, noting the duty attaches to manufacturers, importers, distributors, and the providers of remote data processing solutions that keep those devices running. Miss it, and the penalty starts at €15 million or 2.5% of global annual turnover, whichever is higher.
Why this lands on every connected-device seller
The stakes are narrower than a broad compliance scare. This is the first time a horizontal rule forces the entire connected-product supply chain to run a real 24-hour incident loop, not a best-effort one. A maker in Southeast Asia shipping smart plugs into Germany is as fully covered as a European brand, and the reporting window applies the moment a vendor confirms a vulnerability is being exploited, not when a patch exists.
That last part is the operational bite. Most smaller device makers have no standing way to detect exploitation, which means they cannot reliably start the 24-hour clock. The legal exposure is the same whether the delay came from slow engineering or slow detection. The Crowell alert makes this concrete: compliance "requires a structural shift in product security" touching product design, technical and organizational controls, staff training, and internal procedure.
The European Commission published its first substantive interpretative guidance on March 3, 2026, which clarified that standalone SaaS is out of scope while cloud services can still fall in as a "remote data processing solution" when a product cannot function without them. That boundary matters for camera makers and smart-lock vendors whose entire business model runs through a cloud backend. Those are exactly the products most likely to hit the reporting trigger.
Meanwhile, cameras just became Matter's biggest new surface
Two weeks after that guidance, the Connectivity Standards Alliance released Matter 1.5.1, an update that pushes cameras and video doorbells deeper into the smart home. The release adds multi-stream video so one camera can feed a high-resolution recording stream, a mobile-friendly stream, and an AI analysis stream at the same time. Snapshots move to HEIC. Recorded video gains HLS and DASH upload support.
On paper it is plumbing. In practice, multi-stream delivery widens the attack surface on the exact product class Article 14 treats as most sensitive. A camera that now runs three simultaneous streams through one session has more moving parts to secure, and a doorbell with an integrated chime now sits inside home networks where a vulnerable firmware bug is a front-door problem. The Alliance framed 1.5.1 as a reliability fix for the camera support introduced in Matter 1.5. It is also an expansion of what the CRA now polices.
What 24 hours actually requires
Reporting is not the hard part. Knowing is. Under Article 14, the trigger is awareness of active exploitation, and the follow-on duties arrive with the full application of the CRA on December 11, 2027: vulnerability handling, a defined support period, and mandatory patching over the product's lifetime.
Lauren Cuyvers, a partner at Crowell & Moring, flagged the enforcement architecture: national market surveillance authorities can order corrective action, restrict sales, or force recalls, alongside the tiered fines. For a device maker with meaningful EU revenue, a recall is often worse than the fine.
The practical checklist for makers in scope is not exotic. They need a monitored intake channel for vulnerability reports, a named owner who can call authorities inside a day, contract language with ODMs that surfaces security defects rather than burying them, and a support-period statement per product family. OEM products are covered only for the company commercializing them under its own trademark, which pushes the due diligence burden onto the brand on the label.
One honest caveat: the September 11 obligation covers the reporting requirement only. The heavier technical requirements do not bind until December 2027, and a lot of vendors are still treating this as a 2027 problem. It is not. A reporting failure in 2026 carries the same €15 million ceiling as a patching failure in 2028, and the first enforcement wave is likely to target whoever fumbles a loud, dated incident first.
The Jakarta angle
For Indonesian hardware exporters, the timeline just moved up. Selling smart plugs, cameras, or wearables into the EU now means maintaining an EU-capable incident response channel around the clock, in a timezone spread that makes a true 24-hour loop genuinely hard from Southeast Asia. Small and mid-size exporters without EU representation are the ones exposed, because the authorized-representative requirement adds paperwork they cannot quietly skip.
There is a supply chain problem here too, and the rule does not resolve it. A single camera firmware bug can involve a chipset vendor, an ODM that assembles the board, the brand printed on the box, and the cloud service that stores the clips. Article 14 assigns obligations by role, but the 24-hour clock does not pause while those parties sort out who files. Companies that have not pre-negotiated an incident-response handoff with their suppliers will find that out on the worst possible day.
Our earlier coverage of the smart-home standards fight tracks how Matter reshaped device interoperability. The compliance story now runs parallel to it, and it lands on the same vendors at the same time.
The next checkpoint is December 11, 2027, when the CRA's essential requirements apply in full. Between now and then, the first companies to be tested publicly will be the ones shipping cameras and doorbells at volume, since those are the newest connected products with the freshest code. Whatever enforcement pattern emerges from the first live incident reports will tell the rest of the industry how serious this is, and it will not take long to find out.