CRA enforcement timeline
The Cyber Resilience Act came into force in 2024 with most obligations applying from December 2027. Manufacturers placing connected products on the EU market need to demonstrate secure-by-design practices, provide vulnerability handling, and maintain product security update capability for an expected lifetime.
Production-side implications:
- Signed firmware enforcement
- Per-unit identity for SBOM and security update tracking
- Secure provisioning workflows that do not expose root keys
- Documented test records that survive a regulator audit
These are production-line decisions made years before a product ships. Buyers who delay the production workflow until CRA enforcement starts will find themselves scrambling.
Matter protocol adoption
Matter (formerly Project CHIP) is consolidating the smart home and building automation protocol space. Production teams shipping smart lighting, HVAC controls, and IoT gateways increasingly need to support Matter commissioning out of the factory.
The production-side reality: each Matter device needs a unique credential and a verifiable identity. The commissioning data has to be present at first power-on. This is a per-unit provisioning workflow, not a post-sale step.
eSIM growth
Embedded SIM (eSIM) adoption removes the physical SIM logistics step from cellular IoT manufacturing. Profiles can be downloaded and installed remotely. Good news for box-build complexity.
The production-side implication: provisioning shifts from physical SIM insertion to electronic profile download. The line still has to verify cellular connectivity and log per-unit IMEI, but the supply chain for the SIM itself drops out.
Per-unit identity: no longer optional
Across IoT, building automation, energy, and access control, per-unit identity has moved from optional to expected. Buyers ask whether each shipped unit has a unique cryptographic identity, a serial that maps to the production batch, and a firmware version that can be verified after the unit is in the field.
This shift drives demand for production lines that can do secure provisioning inline with PCBA and FCT. Lines without that capability either bolt it on (with reliability and cost penalties) or lose business to lines that have it integrated.
Sources
- European Parliament, Cyber Resilience Act (Regulation EU 2024/2847)
- Connectivity Standards Alliance, Matter specification
- GSMA, eSIM specifications and adoption reports
- ETSI EN 303 645 (consumer IoT security baseline)