Can You Trust a Smart Device's Security Updates? A 2026 Buyer's Check

Security rules in the UK and EU set a legal baseline for connected products when they are sold. A published support period, together with the ability to run a device locally, gives you a better way to judge whether it will still be practical and safer to keep in your home three years from now.

This guide is desk research: we did not install, pair or test any device.

Why “it updates itself” isn’t a promise

“Automatic updates” describes how updates may arrive. It does not tell you how long the manufacturer intends to provide security updates, whether the device will receive them for its whole useful life, or what happens when support ends. The question to ask before buying is not only “Can it update?” but “How long will it get security updates, and where is that commitment published?”

That distinction matters because new vulnerabilities can be discovered after a product is on sale. If the manufacturer issues a fix, a device that can receive it may be better protected than one left unpatched. If support has ended, or the product no longer receives updates, the device may remain exposed to known issues. It is then worth asking whether the device still needs to be connected to your home network.

Rules can help set a floor for product security information and practices. They do not tell you that a particular device will stay secure, continue receiving updates for a period you consider adequate, or keep working if its manufacturer’s services change. Treat regulatory compliance as a starting point, not a long-term support promise.

What a security update actually protects you from

A security update can address vulnerabilities discovered after a device was designed and sold. Without a fix, an affected device may become a weak point on the network it shares with your other connected products. That does not mean every unpatched device will be compromised; it means the buyer should know whether the manufacturer has committed to providing security updates, and whether the device can still be used if that support stops.

A label alone cannot answer those questions. Look for a published minimum security update period, and a way to report security issues to the manufacturer. Then consider what the device depends on: if core functions require a vendor’s cloud service, an end to updates or cloud support could affect whether the product remains useful.

The three regimes at a glance: UK PSTI, EU CRA, US Cyber Trust Mark

The UK Product Security and Telecommunications Infrastructure Act 2022 provides the legal basis for setting security requirements for consumer connectable products. The UK’s regime has been in force since 29 April 2024 and applies to manufacturers, importers and distributors (GOV.UK regime overview; SmartRegulations explainer). The PSTI Act, Part 1 sets out the relevant power; GOV.UK’s guidance explains the requirements and scope. The NCSC’s consumer explainer says the law is meant to help people choose products designed to provide ongoing protection against cyber attacks.

The European Union’s Cyber Resilience Act, or CRA, entered into force on 10 December 2024. Its main obligations apply from 11 December 2027, while reporting obligations for actively exploited vulnerabilities apply from 11 September 2026 (reporting obligations). The European Commission says the CRA addresses the lack of timely security updates (legislative summary) and requires products to be designed, updated and maintained for security. Obligations apply at every stage of the value chain (manufacturer guidance). Its CRA overview also explains the role of CE marking. The Commission published practical guidance on 27 July 2026 for manufacturers.

In the United States, the Cyber Trust Mark is a voluntary cybersecurity label for wireless consumer IoT products. The mark is not mandatory, and you should not assume that every product has one.

Comparison table: what each regime requires, when it applies, what it does NOT guarantee

Regime	What it requires	When it applies	What it does NOT guarantee
UK PSTI	Three baseline requirements: no universal default or easily guessable passwords; published information on how to report security issues; and published information on minimum security update periods. See GOV.UK’s requirements.	In force since 29 April 2024 for manufacturers, importers and distributors of covered consumer connectable products.	It does not prove that a particular product will remain secure for its full useful life, receive updates beyond its published minimum period, or work locally without a cloud service.
EU Cyber Resilience Act	Security requirements for covered products, including being designed, updated and maintained for security; the CE mark signals CRA compliance once the main obligations apply (11 December 2027). See the European Commission’s CRA overview.	Entered into force 10 December 2024. Reporting obligations for actively exploited vulnerabilities apply from 11 September 2026; main obligations apply from 11 December 2027.	CE marking does not prove that a product is invulnerable, will remain secure indefinitely, or will work locally if a vendor service ends.
U.S. Cyber Trust Mark	A voluntary cybersecurity label for wireless consumer IoT products.	A voluntary program; no product is required to carry the mark.	It is not a universal requirement, and seeing a label is not a guarantee of ongoing updates, security, or local operation.

The UK guidance identifies the Office for Product Safety and Standards as the enforcement authority. The PSTI guidance is a useful place to check the rule’s scope and details. These regimes differ in timing and approach, but a compliant product is not automatically a secure product for as long as you own it.

How to check a support period before you buy

Use these steps on a product page or in-store. The aim is to find a clear commitment, not to infer one from phrases such as “automatic updates.”

Find the minimum security update period. For covered products under the UK regime, manufacturers must publish information on the minimum security update period. Check the product page, its security information, and any documentation available in the box. The GOV.UK guidance describes this publication requirement.
Look for a clear end date or duration. A stated date is easier to assess than vague wording such as “long-term support.” If the manufacturer gives a duration, check whether it says when that period starts. Do not assume an unstated start date or treat “automatic updates” as a support commitment.
Check that the information is for this product. Make sure you are looking at information that applies to the product line you are considering, rather than a general statement about the manufacturer’s devices. If it is unclear, ask the seller or manufacturer to point you to the specific commitment.
Find the vulnerability reporting route. Check for a published way to report security issues to the manufacturer. This is one of the UK’s baseline requirements for covered products. A general customer-support contact may not make clear how security issues should be reported, so look for the manufacturer’s security or vulnerability disclosure information.
Check password language. Look for a statement about setup and passwords. The UK baseline prohibits universal default and easily guessable passwords (NCSC consumer rights PDF). Treat any documentation that relies on a shared default password as a serious warning sign, rather than something to overlook for convenience.
If the commitment is missing or vague, pause. For a UK product within the rules, published information on the minimum security update period is required. If you cannot find it, ask the manufacturer or seller. If you still cannot get a clear answer, consider another product rather than guessing how long support will last.
Check the remaining practical details. For EU products placed on the market after 11 December 2027, a CE mark signals CRA compliance; for earlier products, rely on the vendor’s published support commitment. If a U.S. Cyber Trust Mark appears, remember that the program is voluntary; its presence is not a promise of indefinite updates. In either case, check whether the vendor still supports the product line and whether core functions depend on its cloud.

A published period is not a guarantee that every issue will be fixed or that the product will remain safe. It gives you a concrete commitment to evaluate and compare. For the UK requirements, consult the official guidance; for the EU timeline, see the Commission’s CRA page.

The second check the law doesn’t give you: local control

A published support period and local operation are two separate checks for a homeowner. The first tells you what update commitment the manufacturer publishes. The second asks whether core functions depend on the vendor’s cloud.

A cloud-dependent device may lose important functions if the vendor’s service is unavailable or ends, regardless of whether it met a legal baseline when sold. Local operation does not replace security updates, and it does not make an unsupported device automatically safe. But it can reduce your dependence on the vendor’s continued service for everyday use.

Before buying, look for an explicit description of which functions work locally and which require an internet connection or vendor account. If that is not clear, ask. Do not assume that a device advertised as smart, or one that carries a security label, will keep working locally. Neither the UK requirements nor the CRA overview should be read as a guarantee of local operation.

What’s excluded from the rules

The UK PSTI regime does not cover every product a homeowner might connect. GOV.UK lists exclusions including medical devices, smart meter products, EV charge points, and some desktop, laptop and tablet devices. Motor vehicles and their trailers, agricultural and forestry vehicles, and two- and three-wheel vehicles and quadricycles are exempt under a 2025 amendment. Northern Ireland products covered by Windsor Framework legislation are also outside the regime, and desktops, laptops and tablets are excluded only if they lack cellular capability (unless designed exclusively for children under 14). Check the official scope guidance rather than assuming a connected product is covered because it uses a network.

If a product is excluded, do not treat that as proof that it lacks security protections. It means this particular PSTI baseline does not apply, so check the vendor’s own update and vulnerability-reporting commitments.

The U.S. Cyber Trust Mark is voluntary, not a mark required on every product. Do not mistake the absence of the mark for a legal violation, or its presence for a guarantee of ongoing support.

Red flags on a product page

Pause before buying if you encounter any of these:

No published minimum security update period where the UK requirements apply, or no way to get a clear answer about how long updates are provided.
A vague claim such as “automatic updates” without a published minimum period.
Default-password instructions that suggest a shared or universal password.
No published route for reporting security vulnerabilities.
Cloud-only operation with no clear explanation of what happens to core functions if the vendor’s service ends.
A product page that does not make its support or security information easy to find, or gives unclear answers about whether the product line is still supported.

A missing detail is not by itself proof that a product has a vulnerability. It is a reason to ask more questions before relying on the product in your home. For covered UK products, compare the page against the three baseline requirements in GOV.UK’s guidance.

What to do if you already own an unsupported device

Start by checking the manufacturer’s security or vulnerability disclosure page for information about the product and its support status. If the device no longer receives security updates, consider whether it still needs access to your main home network. The practical triage in this guide is to isolate it from the main network if you continue using it (ideally on a separate guest or IoT Wi-Fi network if your router supports one), or replace it if you cannot reasonably reduce the risk or it no longer meets your needs.

Then check what still works without the vendor’s cloud. If core functions stop when the service ends, the product may not be useful to keep even if you can isolate it. If the support status is unclear, ask the manufacturer directly and keep the answer with your product records.

Do not treat a label, past compliance or a cloud connection as a promise of future updates. Revisit the PSTI guidance or the EU CRA overview to understand which baseline applies, then make a separate decision about support and local operation.

FAQ

Does a CE mark or PSTI compliance mean my device is secure?

No. Both are baselines, not proof that a device is free of vulnerabilities or will remain secure indefinitely. Compliance at shipping does not prove ongoing security or local operation. See the UK requirements and the European Commission’s CRA overview.

Is the U.S. Cyber Trust Mark mandatory in America?

No. It is a voluntary FCC program; no device is required to carry it. Do not assume a product has the mark, or that it is required to have one.

What’s the difference between PSTI and the EU Cyber Resilience Act timelines?

The UK PSTI requirements have been in force since 29 April 2024. The CRA entered into force on 10 December 2024; reporting obligations apply from 11 September 2026, and its main obligations apply from 11 December 2027. Check the UK guidance and the CRA overview for their respective details.

My device’s support period just ended. What should I do?

Check the manufacturer’s disclosure information, consider isolating the device from your main network, and decide whether to replace it. If it depends on the vendor’s cloud, also check what functions remain if that service is unavailable. The section “What to do if you already own an unsupported device” outlines those triage steps.

How This Guide Was Built

This guide is based on desk research, not device testing. The legal and regulatory information was checked against the UK legislation and GOV.UK’s PSTI guidance, and the European Commission’s Cyber Resilience Act page. The FCC Cyber Trust Mark description comes from FCC program summaries in search results; the FCC page could not be opened during research, so check it directly for current rules. No brand-specific support-period lengths or claims about particular devices carrying the mark are included.

← Back to guides