A connected luminaire may stay in service longer than its first controller or software platform. Include security support and system ownership in the buying decision, alongside light output and controls.
Identify the product and responsible operator
Describe the luminaire, radio module, controller, gateway, and associated software. Confirm which products and economic operators fall within the relevant rules; the answer depends on the product and how it is supplied.
Separate the legal frameworks and dates
Radio equipment requirements and the Cyber Resilience Act have different scopes and application stages. Check the actual provisions and dates for the product. Do not treat a reporting milestone as the date every product requirement applies.
Map the connections
Record local network access, cloud services, remote administration, mobile apps, and update paths. Identify what happens when internet access or a vendor service is unavailable.
Ask what the evidence covers
Request the applicable standards, editions, assessment scope, and product configuration. A named security standard on a datasheet does not explain which functions or requirements were evaluated.
Put support in writing
Specify the support period, update delivery, vulnerability contact, security-notice process, and end-of-support policy. Check default access, account transfer, configuration backup, and device replacement at handover.
Close gaps before placing the order
Ask the responsible compliance specialist to identify the evidence needed for market access. Keep unresolved items visible in the procurement schedule rather than relying on a generic “cybersecure” claim.
Frequently Asked Questions
Does local control remove all security concerns?
No. Local interfaces, credentials, updates, and maintenance access still need review.
What is the most useful supplier commitment?
A documented support period and process for updates, vulnerabilities, ownership transfer, and end of service.
Official reference: European Commission: Cyber Resilience Act. Check the applicable product, edition, and project requirements when using this guidance.
