As the calendar turns toward 2026, a quiet but monumental shift is taking place across Europe’s technology landscape. It doesn’t come from a new chipset, a faster wireless standard, or a groundbreaking cloud platform. Instead, it arrives in the form of regulation — a regulation that will redefine the future of connected devices: the European Union’s Cyber Resilience Act (CRA).

For many manufacturers, the CRA still feels like something far away. The document is long, the compliance process complicated, and the enforcement timeline spread over a few years. But make no mistake: 2026 is the decisive year. It’s the year when both the EU and the EEA — including Norway — begin to expect, and in practice demand, IoT products that meet the CRA’s cybersecurity standards.

The question is no longer “Will this be required?”
It’s “What happens if we ignore it?”

And the answer is clear: the risks are far higher than most companies realise.

A New Baseline for Every Connected Device

The CRA applies to virtually any product with a digital or communications component:

• Smart-home devices
• HVAC controllers and recuperators
• Sensors, gateways, and hubs
• Industrial IoT devices
• Power tools with wireless interfaces
• Anything that updates firmware, connects to the cloud, or interacts with apps

For the first time in EU law, cybersecurity and software lifecycle processes become mandatory. Manufacturers must provide:

• Secure-by-design architecture
• A Software Bill of Materials (SBOM)
• Vulnerability management processes
• Secure firmware update mechanisms with signature verification
• Anti-rollback protections or secure boot
• Incident reporting within 24 hours
• Long-term security support

Failure to meet the requirements can result in fines reaching €15 million or 2.5% of global turnover.

But the financial penalties, while large, are not the most immediate danger — particularly for companies targeting European and Norwegian markets.

The Real Risk: The Market Will Block You Before the Regulators Do

Although the CRA’s full enforcement phases continue into 2027 and 2028, the market will start enforcing CRA-level expectations in 2026.

Distributors will ask for compliance.
Retailers will ask for documentation.
Integrators will ask for cybersecurity guarantees.
Insurance companies will ask for secure update procedures.
Utilities and municipal buyers will simply say “no” to insecure devices.

It’s not theoretical. This is already happening today.

The biggest risk is not being fined.

The biggest risk is that your product will not be accepted into the market at all.

Why This Matters Even More in Norway

Because Norway participates in the European Economic Area (EEA), it adopts nearly all EU product-safety and CE-marking legislation — RED, EMC, LVD, NIS2, and soon the CRA.

But the more important reality is that Norway already behaves as if CRA-like requirements are in place.

Norwegian buyers — especially utilities, municipalities, energy companies, and building operators — are more strict in cybersecurity expectations than many EU countries.

This is driven by several public reports and industry guidelines:

• The Norwegian National Security Authority (NSM) explicitly states that security must be integrated into procurement:
  “Include security during procurement and development processes.”
  NSM ICT Security Principles
• A comprehensive chapter published via Springer and produced by SINTEF, Cyber Security Requirements in the Norwegian Energy Sector, highlights the security pressures on utilities.
  Springer Link
• A report covered by ComputerWeekly explains that Norway’s Auditor General found significant cybersecurity vulnerabilities across the energy industry, warning that cyber risk management has become a top priority:
  ComputerWeekly Article
• The Norwegian Research Council has funded multi-year programs to strengthen cybersecurity and resilience in IT/OT systems in the Nordic energy industry, reinforcing that cybersecurity is non-negotiable for connected devices:
  Research Council Project
• And industry leaders such as Embriq observe that new EU legislation (including NIS2) is already shaping Nordic procurement practices:
  Embriq NIS2 Guide

Taken together, these references make one conclusion unavoidable:

In Norway, even before the CRA formally enters the EEA, insecure IoT products will be rejected during procurement because they do not meet the cyber standards demanded by utilities, municipalities, and enterprise customers.

Norway will not wait for compliance.
The market already demands it.

Why Launching a Non-CRA Product in 2026 Is a Dangerous Strategy

By mid-2026, not having CRA-level security creates multiple risks:

1. Regulatory Exposure

Authorities may audit or challenge your technical documentation, and non-compliant products could face restrictions or forced recall.

2. Commercial Failure

Retailers, integrators, and distributors may refuse onboarding unless CRA documentation is provided.
This is already happening in parts of Germany, the Netherlands, and Scandinavia.

3. Insurance & Liability Exposure

A hacked or compromised device can lead to denied claims or liability actions, particularly in the highly regulated Nordic energy sector.

4. Enormous Redesign Costs

If you launch a product now without CRA-level architecture, retrofitting secure boot, encrypted OTA updates, SBOM generation, and vulnerability disclosure processes may cost 10–20× more than building them in upfront.

5. Reputation Risk

One breach or a single negative procurement assessment can have a long-term reputational impact, especially in security-sensitive markets like Norway.

Norwegian Utilities Don’t Need to Say “We Reject Weak IoT” — The Requirements Do It for Them

You won’t find a public press release that says, “Utilities reject weak cybersecurity devices.”
But you don’t need one.

Everything Norway’s critical infrastructure ecosystem publishes — NSM guidance, SINTEF studies, the Auditor General’s report, NIS2 preparations, public procurement rules — points to a system where:

• insecure IoT cannot enter energy networks,
• insecure HVAC or building automation cannot be installed in municipal buildings,
• insecure smart devices cannot be approved in tenders,
• and insecure cloud-connected equipment is a liability that procurement teams will not accept.

The CRA does not introduce a new culture in Norway.
It simply codifies the rules the Norwegian market already lives by.

What Companies Should Do Now

To be taken seriously in the EU and Norway in 2026 and beyond, manufacturers should implement at minimum:

• Secure firmware update with signature verification
• Anti-rollback and/or secure boot
• SBOM in CycloneDX or SPDX format
• Cloud and data protection architecture
• Vulnerability disclosure policy
• CVE monitoring
• Documented incident response process
• A long-term software update commitment (5–10 years)

Additional best practices include penetration testing, encrypted local storage, and external code auditing.

The Bottom Line: The Market Is Moving Faster Than the Law

Launching a non-CRA-compliant IoT device in 2026 is not just a regulatory gamble — it’s a commercial risk that can block your product from entering the market at all.

In both the European Union and Norway, the direction is clear:

If your device isn’t secure by design, it won’t be welcome — anywhere.

For companies that prepare now, CRA becomes a competitive advantage.
For those that don’t, 2026 will be the beginning of a very expensive lesson.

If you want to be ready, contact us Prototypeforge contact@prototypeforge.com, we will prepare you for the compliance journey.