EU's Cyber Resilience Act Limits Obligation to Fix Fridge Controller Flaws After French Hack

The European Union’s newly‑implemented Cyber Resilience Act does not obligate makers of connected appliances to provide patches for smart‑fridge controllers that were exploited in a recent cyber‑intrusion reported in France.

French cybersecurity officials disclosed that a subset of internet‑enabled refrigerator control boards had been targeted, allowing attackers to interfere with temperature regulation and potentially compromise food safety. The incident highlighted how everyday kitchen devices can become entry points for malicious actors.

Adopted last month, the Cyber Resilience Act sets a baseline for product‑level security across the bloc. Under the law, manufacturers must remediate identified flaws and distribute free software updates for as long as the device remains within its “support period,” a timeframe that each producer defines for its own products.

Because the duration of that support window is not standardized, critics argue that many appliances could lose official updates once the manufacturer’s declared period expires—often after only a few years on the market. In such cases, the EU rule does not compel a vendor to continue issuing patches, even if a vulnerability is actively being exploited.

Consumer advocacy groups have warned that this loophole could leave households with insecure devices, while industry representatives contend that flexibility is necessary to balance technical feasibility and cost. They point out that extending support indefinitely could be financially unsustainable for smaller firms.

The European Commission has indicated that it will monitor how the Act is applied in practice and may issue further guidance or amendments to address gaps exposed by incidents like the French fridge attack. In the meantime, experts recommend that buyers verify the length of a product’s support period before purchase and consider devices that receive regular security updates.