The European Cyber Resilience Act requires the reporting of actively exploited vulnerabilities via a platform managed by ENISA starting from September 11, 2026. This obligation transforms the way manufacturers design, maintain, and document their digital products. This year’s high-tech trends are not just about gadgets showcased at trade shows: they are also playing out in regulatory and architectural backrooms.
Cyber Resilience Act: what mandatory vulnerability reporting changes
The operational phase of the Cyber Resilience Act redefines the lifecycle of connected devices sold in Europe. The reporting of an exploited vulnerability must occur within 24 hours, followed by a detailed notification within 72 hours, and a final report within 14 days after a fix is made available.
For a serious incident, the final report deadline extends to one month. These constraints do not only apply to large corporations: any manufacturer selling a product with digital elements on the European market is affected.
We observe that this regulation pushes product teams to integrate incident detection and reporting pipelines from the design phase. A connected device firmware or surveillance camera must now include an automated reporting mechanism, or risk non-compliance. The cost of compliance impacts the software architecture well before the product hits the shelves.
Keeping track of these regulatory developments in real-time is a full-time job, and tech articles on Web Hebdo regularly cover these topics as the texts come into effect.
Right to repair smartphones and tablets: new European obligations
European repair rules now explicitly extend to smartphones and tablets. This extension requires manufacturers to provide spare parts and technical documentation for a minimum duration after the product is placed on the market.
Repairability becomes a design criterion, not a marketing argument. Manufacturers must publish disassembly guides, ensure access to critical components (battery, screen, charging connector), and refrain from using software locks that prevent replacement with compatible third-party parts.
For professional buyers managing fleets of devices, this change is game-changing. A smartphone whose battery can be replaced by an internal technician significantly extends its useful life. We recommend checking manufacturers’ compliance sheets before any fleet renewal in 2026.
What this means for connected accessories
The directive is not limited to phones. Smartwatches, wireless earbuds, and graphic tablets are gradually coming under its scope. Manufacturers who anticipate these requirements gain a real competitive advantage in the European market, while those who delay risk marketing restrictions.
AI agents and personal assistants: beyond demonstration
Meta continues to deploy agents integrated into its social networks. The underlying trend in artificial intelligence this year is no longer text or image generation, but the autonomous orchestration of chained tasks without human intervention.
The transition from a conversational chatbot to an agent capable of executing actions (booking a slot, sending a message, modifying a file) requires a much more complex layer of authentication and permissions. An agent accessing your email must have limited, revocable OAuth tokens that are auditable.
- Managing granular permissions (read-only, send, delete) becomes a top security issue for every AI agent integration.
- The data processed by these agents often passes through third-party servers, raising questions about GDPR compliance and transfers outside the EU.
- “Vibe coding,” which involves creating applications by describing them in natural language, accelerates prototyping but generates code whose maintainability remains to be proven in the long term.
A useful AI agent is measured by the reliability of its actions, not the fluidity of its conversation. Initial implementations show that the error rate on chained tasks (for example: reading an email, extracting a date, creating an event, sending a confirmation) remains too high for unsupervised use in a professional environment.
Smart glasses and new interfaces: the battle for contextual data
Meta continues to develop its smart glasses equipped with cameras and microphones. The promise is of a interface that overlays contextual information onto the visual field, relying on embedded or remote artificial intelligence models.
The real technical issue is not the display (micro-screens have existed for several generations) but the real-time processing of the captured video stream. Analyzing what the user sees to offer a translation, identify a product, or summarize a document requires computing power and bandwidth that current mobile networks struggle to provide with acceptable latency.
Privacy and constant capture
Wearing a camera on one’s face in public space raises unresolved legal questions. GDPR requires a legal basis for any processing of personal data, including capturing images of third parties. No specific framework currently governs continuously capturing glasses in Europe.
Manufacturers are integrating light indicators signaling recording, but their visibility remains limited. The gap between the speed of adoption of these products and the slow pace of regulatory adaptation creates a gray area that concerns both users and those filmed without their knowledge.
Disruptive technologies and signals to watch
Several hardware axes will structure the coming months:
- Rollable screens are moving from the prototype stage to commercial products, with mechanical durability constraints still poorly documented by manufacturers.
These new technologies share a common point: they generate and consume increasing volumes of data. The ability to store, secure, and make this data portable (in accordance with the European Data Act) will become a selection criterion as crucial as the product’s technical specifications themselves.
