The CRA Treats Your Smart Home Agent as Deterministic Code. That Is the Vulnerability.

On 11 September 2026, Article 14 of Regulation (EU) 2024/2847 became applicable. The Cyber Resilience Act's reporting obligation for actively exploited vulnerabilities went live. The ENISA Single Reporting Platform went live with it — no API, English only.

Consider what that means mechanically. A 24-hour early-warning obligation is now binding on any manufacturer placing a product with digital elements on the Union market, and the channel for delivering that warning is a human-operated web form. This tells you what the legislator expected to receive: a slow trickle of reports about a bounded set of well-understood defects. The CRA was written for locks. It is now being applied to keys that rewrite their own teeth. The hash is not the art; it is merely the key — and the CRA cannot tell the two apart.

A small anomaly worth noting: much of the coverage placed 11 September 2026 on a Thursday. It is a Friday. When the reporting on a reporting obligation cannot keep its dates straight, consider what that same obligation now demands of manufacturers at a 24-hour cadence.

I want to be exact, because the easy framing is wrong. This is not a story about companies missing a deadline through negligence. It is a story about a specification whose central assumption — that software is a fixed artifact you can enumerate, attest, and patch — does not survive contact with a probabilistic agent running inside a baby monitor. The deadline was met. The premise was not.

Start with the legal mechanics, because most of the noise ignores them. The CRA is a Regulation, not a Directive. It applies directly, with no member-state transposition layer. That removes the interpretive slack national lawmaking normally supplies. One text, one schedule, one penalty structure. For smart home, the relevant obligations sit in Article 14 (vulnerability and incident reporting), Annex I (essential cybersecurity requirements), and Annex III (important products). Smart home assistants, smart door locks, IP cameras, and baby monitors are named in Annex III — which means the strictest conformity-assessment routes attach precisely to the devices most likely to host an autonomous agent.

The regime is phased, and this is where commentary usually goes wrong. Article 14 applies from 11 September 2026. The bulk of the obligations — conformity assessment, CE marking, technical documentation, the five-year support period, the machine-readable SBOM — apply from 11 December 2027. Companies are living in a genuine dual-track transition: reporting is live, but the harmonized standards that would confer a presumption of conformity are not yet cited in the Official Journal. Reporting without an API. Conformity without standards. Call it an enforceability deficit — immediate risk exposure paired with enforcement instruments still under construction.

The penalty ladder is deliberately asymmetric. Non-compliance or failure to report: up to €15 million or 2.5% of global turnover, whichever is higher. Providing incorrect or incomplete information: up to €5 million or 1%. There is no CRA-level criminal liability, and — as of this writing — not a single enforcement action against an agent-bearing product.

Adjacent to this sits DORA (Regulation 2022/2554), which governs digital operational resilience for financial entities. It is not aimed at smart home hardware, but it establishes the template: mandatory incident reporting, defined timelines, audited continuity. The CRA imports that DNA into consumer products. What was a sectoral obligation for banks is becoming a general obligation for doorbells.

Now the identity trap, which is the part that surprises engineers. These firms believe they are "AI providers." Under the CRA they are manufacturers of products with digital elements. That reclassification is the whole game. The EU AI Act (Regulation 2024/1689) governs risk tiers of models and systems; the CRA governs the artifacts those systems ship inside. A company that reads only the AI Act builds the wrong compliance stack and discovers, too late, that its obligations were never model-centric. I have seen this pattern before. In 2017 I audited the Golem Network token distribution contract and found three integer-overflow vulnerabilities in the pledge logic. I wrote the patch, the proof, and the exploit. The founders rejected it as "too academic." Technical correctness does not guarantee adoption. The AI Act/CRA boundary is that same trap wearing a suit.

Here is the actual failure. The CRA's obligations trigger the moment a manufacturer "becomes aware" of an actively exploited vulnerability. That phrase is the regulation's load-bearing wall, and it is undefined for autonomous systems. "Becomes aware" maps cleanly onto a human QA engineer reading a CVE feed. It does not map onto a model that, at 03:14, routes a door-unlock command through a tool it was never authorized to call. Is that a vulnerability? Is the manufacturer aware the instant telemetry registers it, or only when a human reads the log the next morning? The regulation gives no answer. The obligation's clock starts inside a black hole.

I have worked this exact boundary. In 2026 I designed an interface specification letting autonomous agents sign transactions via zero-knowledge proofs, specifically so model hallucination could not produce irreversible financial effects. The motivating insight was structural: an agent's failure modes are not a function's failure modes. A function returns wrong output deterministically — you find the bug, patch it, close the ticket. An agent returns output from a distribution that shifts with every prompt, every tool it discovers, every memory it accumulates. You cannot attest to a distribution the way you attest to a binary. My reference implementation cut failed transactions by roughly 40% — not by making the model smarter, but by inserting a cryptographic gate the model could not hallucinate past. The CRA's compliance machinery has no equivalent gate. It cannot have one, because it was specified before the problem existed.

Run the thought experiment I used to run in Python during DeFi Summer 2020, when I built simulators to expose how standard impermanent-loss derivations silently assumed the wrong geometric mean. Parameterize a smart lock agent over three variables: tool-discovery rate, memory-write frequency, and ambient prompt-adversary level. At low discovery and low memory, behavior stays inside the envelope the SBOM describes — the framework holds. Raise memory-write frequency and the same code emits action sequences no component list anticipates. Nothing on the bill of materials changed. The behavior did. The SBOM is a snapshot; the agent is a trajectory. Formal attestation of a snapshot says nothing about a trajectory — and the CRA's conformity logic is, at bottom, snapshot logic.

Map the OWASP Top 10 for Agentic Applications 2026 — goal hijacking, memory poisoning, cascading failure, rogue agents — onto the CRA's "vulnerability" definition, and the categories do not line up. Memory poisoning is not a defect in the product; it is an emergent property of the product meeting its environment. Cascading failure is not a bug you patch; it is architecture. If these risks fall outside "vulnerability," Article 14 never fires and the obligation is inert. If they fall inside it, every ambiguous agent behavior becomes a reportable event and the 24-hour clock starts on a signal with no clean threshold. The manufacturer is exposed in both directions at once: under-report and face the 2.5% ceiling; over-report and flood a portal with no API. The five-year support mandate compounds this, because model drift over five years is guaranteed while the conformity declaration is fixed at launch.

I spent six months in 2022 reverse-engineering the MakerDAO liquidation engine because its failure modes lived in the interaction between components, not in any single one. What I learned applies directly: the dangerous part of a system is never on its own BOM. Debt ceilings looked safe in isolation and cascaded in composition. Agent tool permissions look safe in isolation and cascade the same way, at higher velocity and lower observability.

Then the geopolitical axis. The CRA reaches American manufacturers through the "placing on the market" nexus; non-EU firms must appoint an authorized representative. Washington runs the NIST agent-security framework as a voluntary instrument, with first substantive deliverables not expected before late 2026. The Commission, for its part, has promised bridging guidance between the CRA and the AI Act. Until it lands, firms are left to guess which regime owns which failure. One product, two incompatible safety philosophies: mandatory reporting architecture for Brussels, voluntary disclosure for Washington. That cost does not vanish. It gets priced into the device.

Here is where I break with the "pure risk" crowd. The CRA's silence on agents is an interpretation window, not merely a void. With no CJEU case law, no harmonized standards in the Official Journal, and a 67-page Commission implementation guidance from July 2026 that mentions AI agents exactly zero times, the authority that would normally fix meaning does not yet exist. In that gap, the manufacturer who files a documented, defensible interpretation first — with a clean paper trail — is not only defending itself. It is submitting a candidate definition for the baseline later enforcement will reference. Ambiguity is a strategic asset for whoever can afford to hold a position in it, and that qualifier is the whole story.

A €15 million floor is a rounding error to a hyperscaler and an existential event to a five-person hardware startup. The penalty structure is effectively regressive, applying its heaviest relative weight to the smallest actors. Stack the fixed cost of dual-track EU/US compliance on top, and the CRA stops merely regulating the market and starts concentrating it. Firms that cannot hedge the "becomes aware" black hole will exit or be acquired. Firms that can will inherit the interpretation window and define compliance for everyone downstream — a more durable moat than any product feature.

Watch three things over the next 12 to 18 months. Whether CEN/CENELEC harmonized standards enter the Official Journal — that would collapse the conformity vacuum overnight. Whether the Commission issues guidance that partially pulls agent risk into the "vulnerability" definition, which would make Article 14 retroactively load-bearing on behavior nobody can enumerate. And whether the ENISA platform ever ships an API. If it does not, that silence is the answer: the regulator is not yet equipped to receive what the regulation already compels you to send.