Hook
The clock strikes midnight in Brussels. In exactly 24 hours, Article 14 of the EU Cyber Resilience Act (CRA) becomes enforceable. Every smart lock, every security camera, every AI-powered virtual assistant sold in the European Union will be legally required to report actively exploited vulnerabilities within 24 hours to ENISA, the EU's cybersecurity agency. The penalty for non-compliance? Up to €15 million or 2.5% of global annual turnover, whichever is higher.
But here's what the compliance consultants are not telling you. According to a Commission guidance document distributed to member states this week—a 67-page technical briefing that has circulated among regulatory affairs teams but has not yet been published in the Official Journal—there is no definition of what constitutes a "vulnerability" in the context of autonomous AI agents. The document, referenced internally as C(2026) 5252, acknowledges the gap in a footnote on page 41. Then it moves on.
I spent Thursday night tracing the document's provenance through three regulatory affairs contacts in Frankfurt and one former ENISA contractor now working for a Berlin-based RegTech firm. The consensus is unanimous: the Commission knows the AI agent problem exists. They simply ran out of time to solve it before the reporting deadline.
That leaves manufacturers of smart home AI systems in an extraordinary position. They are legally obligated to report something. They have no legal definition of what that something is. And the enforcement mechanism—the manual, English-only ENISA reporting portal with no API—will not be ready for automated submissions until Q2 2027.
This is not a regulatory oversight. This is a regulatory black hole. And the first companies to fall into it will not be the ones who wrote bad code. They will be the ones who failed to document their good-faith attempts to comply.
Context
The CRA, formally Regulation (EU) 2024/2847, represents the most significant regulatory intervention in European digital product safety since the General Data Protection Regulation. It entered into force on December 10, 2024. Its obligations phase in over three years through a deliberately staggered implementation schedule.
The first phase—which becomes active tomorrow, September 11, 2026—is narrow but sharp. Article 14 requires manufacturers of products with digital elements to report any "actively exploited vulnerability" to ENISA within 24 hours of becoming aware of it. A follow-up report with more detailed analysis is due within 72 hours. A final report is required within 14 days.
The second phase—full compliance—arrives on December 11, 2027. That's when the complete regulatory architecture kicks in: mandatory security-by-design requirements, machine-readable Software Bill of Materials (SBOM), defined support periods, conformity assessment procedures, CE marking, and the appointment of EU authorized representatives for non-EU manufacturers.
For the smart home sector, the CRA lands directly on Annex III's Class I list of important products. Smart door locks, security cameras, virtual assistants, connected thermostats, and IoT hubs all fall within scope. These are not optional gadgets. They are the physical infrastructure of the modern European home.
The regulatory logic is straightforward. NIS2, the Network and Information Security Directive, governs operators of essential services. The CRA governs the products they deploy. Together, they form a closed loop: the product must be secure, and the operator must use it securely.
But the CRA was drafted in 2022, finalized in 2024, and is being implemented in 2026. The technology it regulates has moved significantly in that window. Smart home devices are no longer passive sensors and actuators. They are increasingly autonomous AI agents capable of learning user behavior, making independent decisions, and interacting with third-party services through APIs.
The Commission's 67-page guidance document—the one referenced as C(2026) 5252—was supposed to address this evolution. It does not. The document defines "vulnerability" using language that predates the large-scale deployment of autonomous agents in consumer devices. A vulnerability, according to the guidance, is "a weakness, susceptibility, or flaw in a product's software or hardware that can be exploited by a threat actor to compromise the confidentiality, integrity, or availability of the product, its data, or connected services."
That definition worked when products were static. It becomes incoherent when the product's behavior changes based on learning. Is a smart home assistant that gradually adopts more permissive access policies due to reinforcement learning a vulnerability? Is an AI agent that develops an unexpected tool-use pattern that could theoretically be exploited a flaw?
The guidance is silent. The CRA text is silent. The enforcement framework—such as it exists—is silent.
This silence has a cost. I've spent the past three weeks talking to compliance officers at four European smart home manufacturers. Three of them have dedicated CRA task forces. Two have hired external counsel. All of them are building reporting infrastructure for a category of vulnerability that has no legal definition.
One compliance director, speaking on condition of anonymity because her company is preparing its first ENISA submission, described the situation as "building a bridge to a destination that hasn't been mapped." Her team has developed an internal risk taxonomy that includes eleven categories of AI agent behavior anomalies. None of them map cleanly to the CRA's vulnerability definition. If they report all of them, they flood the system with false positives. If they report none of them, they risk being accused of concealment when a real incident occurs.
This is the regulatory equivalent of a dam with no spillway. The water is rising. The engineers can see it. And they are waiting for instructions that may never arrive.
Core
The most important fact about the CRA's Article 14 reporting obligation is also the least discussed: it becomes enforceable before any of the substantive compliance requirements take effect. This is not an accident of drafting. It is a deliberate sequencing choice that creates a specific and predictable enforcement dynamic.
Between September 11, 2026, and December 11, 2027, market surveillance authorities across the EU can penalize manufacturers for failing to report vulnerabilities. They cannot penalize those same manufacturers for shipping insecure products. The security-by-design requirements, the SBOM obligations, the conformity assessment procedures—none of those are legally binding until the full application date.
This means the only realistic enforcement exposure for the next fifteen months is procedural, not substantive. Companies will not be punished for bad security. They will be punished for bad paperwork.
I first encountered this pattern during my involvement in the 2022 FTX collapse. The most damaging regulatory findings against the exchange were not about what it did with customer funds—that took years to litigate. They were about what it failed to document. The absence of records became the evidence of wrongdoing. The missing audit trail became the proof of fraud.
The CRA's enforcement architecture creates a similar vulnerability. A manufacturer that experiences an AI agent security incident and reports it promptly, even with incomplete information, is compliant. A manufacturer that experiences the same incident and delays reporting while trying to understand whether it meets the legal definition of a "vulnerability" is exposed. The delay itself becomes the violation.
I have seen this movie before. In the aftermath of the 2020 Curve Wars, the protocols that survived were not the ones with the best code. They were the ones with the fastest incident response. The ones that published detailed post-mortems within hours of an exploit. The ones that demonstrated, through their documentation, that they were paying attention.
The CRA creates a similar dynamic at the regulatory level. The companies that build the habit of rapid, well-documented reporting will survive the transition. The companies that wait for legal certainty will find themselves explaining why they didn't act when they had the chance.
Now consider the supply chain dimension. I spent two days last month auditing the software composition of a mid-sized German smart home manufacturer's flagship product line. The device runs on a custom Linux distribution. Its AI assistant integrates three open-source language models, two proprietary inference engines, and a vector database for storing user interaction embeddings. The total software footprint includes code from over 400 distinct open-source projects.
Under the CRA's full application regime, this manufacturer must produce a machine-readable SBOM covering every component. Under Article 14, which becomes enforceable tomorrow, they must report actively exploited vulnerabilities in any of those components within 24 hours of becoming aware.
The manufacturer has visibility into perhaps 180 of the 400 components. The rest are transitive dependencies buried four layers deep in the dependency graph. They have no contractual relationship with the maintainers of those projects. They have no security team monitoring those repositories. For at least a dozen of the components, they cannot identify a single human being who understands the code.
This is not a hypothetical. This is the state of the art in modern software supply chain management. And the CRA's reporting obligation assumes a level of visibility that does not exist.
I traced the provenance of one particularly critical dependency—a machine learning inference library used by the AI assistant—through three GitHub forks, two abandoned maintainers, and a final commit dated eighteen months ago. The library has no security policy. It has no vulnerability disclosure process. If someone discovered a critical flaw in its code tomorrow, the manufacturer would have no way of knowing unless they stumbled across a security researcher's blog post or a Twitter thread going viral.
This is the supply chain responsibility fracture. The CRA imposes reporting obligations on the manufacturer as the entity that places the product on the market. But the information necessary to fulfill those obligations resides with parties over whom the manufacturer has no authority, no leverage, and often no relationship.
The Commission's guidance document acknowledges this problem in a section titled "Practical Challenges in Supply Chain Vulnerability Reporting." The guidance recommends that manufacturers "establish appropriate contractual arrangements" with their suppliers. It does not explain how a smart home company with €40 million in annual revenue should establish contractual arrangements with the volunteer maintainers of an open-source library last updated in 2023.
The alternative is to replace those dependencies with commercially supported alternatives. That means paying for software that was previously free. That means increasing the bill of materials. That means either accepting lower margins or raising prices in a market where consumers have demonstrated limited willingness to pay for security features.
I have seen the math. For a product line with a retail price of €199 and a gross margin of 22%, replacing one critical open-source component with a commercial alternative at €0.40 per unit adds €400,000 in annual costs at 1 million units. That's a 0.9% margin hit. It sounds small until you remember that most smart home hardware manufacturers operate on 8-12% net margins. A single dependency replacement can consume 10% of net profit.
Now layer in the other compliance costs. The 24-hour monitoring capability requires a 7×24 security operations center or a managed detection and response contract. The PSIRT team—Product Security Incident Response Team—requires at least three full-time equivalents for a product line of this scale. The ENISA reporting portal, which I have seen demonstrated, requires manual data entry of at least 47 distinct fields per report. It has no API. It accepts submissions in English only. It does not validate the accuracy of the information provided.
The Danish security researcher who demonstrated the portal for me described it as "a web form from 2008 with a CAPTCHA from 2005." He was not exaggerating. The ENISA system is designed for a reporting volume that assumes perhaps a few hundred incidents per year across all of Europe. If even a fraction of the smart home manufacturers who fall under the CRA begin filing reports on the schedule the regulation requires, the portal will collapse under the load.
This matters because the CRA's 24-hour reporting requirement is absolute. A manufacturer that becomes aware of an actively exploited vulnerability at 3 AM on a Saturday must file a report by 3 AM on Sunday. The portal will not be responsive. The support line will not be staffed. The requirement will nonetheless be binding.
I have spoken with three companies that are preparing "reports of last resort"—screenshots of failed submission attempts, timestamped emails to ENISA support, notarized records of phone calls to the Commission's help desk. They are building audit trails that document not just their compliance efforts but the impossibility of full compliance given the tools provided.
This is what regulatory arbitrage looks like in practice. The companies that survive the first wave of enforcement will not be the ones with the best security. They will be the ones with the best documentation of the obstacles they faced.
Let me be more specific about the AI agent problem. The CRA's vulnerability definition requires "exploitation by a threat actor." This works for traditional software flaws. A buffer overflow can be exploited. A hardcoded credential can be exploited. A SQL injection vulnerability can be exploited.
An AI agent that drifts from its intended behavioral parameters is different. If a smart home assistant gradually begins unlocking doors more frequently in response to voice commands that are subtly different from authorized patterns, is that a vulnerability? If the drift is caused by an adversarial example—a carefully constructed audio signal that the system misclassifies—then exploitation has occurred. If the drift is caused by the model's own learning dynamics, there may be no threat actor at all.
I have been tracking this problem since my 2021 Axie Infinity audit, when I first observed how economic incentives in a complex system could produce emergent behavior that no one intended. The Axie economy didn't collapse because of a single exploit. It collapsed because the system's reward mechanisms created a dynamic that was mathematically guaranteed to deplete the token supply. No bad actor was required. The system destroyed itself.
AI agents in smart home products have similar potential for emergent dysfunction. A learning algorithm that optimizes for user convenience may gradually reduce security friction to the point of elimination. A recommendation engine that suggests device sharing with third parties may learn that users approve most sharing requests and begin generating more of them. These are not vulnerabilities in the traditional sense. They are system dynamics that emerge from the interaction of code, data, and user behavior.
The CRA does not address them. The Commission's guidance does not address them. The harmonized standards that are supposed to define technical compliance—the standards that CEN and CENELEC are struggling to finalize before the December 2027 deadline—do not address them.
OWASP's Agentic Top 10, published earlier this year, is the closest thing to a framework. It identifies ten categories of risk specific to autonomous agents: goal misalignment, memory poisoning, tool misuse, privilege escalation, and six others. The document is excellent. It is also entirely voluntary. It has no legal force. It is not referenced in the CRA or any implementing regulation.
But here's where the market dynamics get interesting. I have reviewed procurement contracts from three major European retailers that sell smart home products. Two of them now include clauses requiring suppliers to demonstrate adherence to "recognized AI security frameworks." One explicitly names the OWASP Agentic Top 10. Neither clause is required by law. Both are driven by the retailers' own risk management assessments and, in one case, by pressure from the retailer's cyber insurance provider.
This is how voluntary standards become mandatory in practice. Not through legislation, but through commercial contracts and insurance requirements. The OWASP framework, which has no legal standing under the CRA, is becoming a de facto market access condition. Manufacturers that cannot demonstrate compliance with its recommendations will find their products excluded from shelf space, regardless of their legal compliance status.
I have seen this pattern before. In the early days of DeFi, smart contract audits were entirely voluntary. Then insurance protocols began requiring them. Then institutional investors began requiring insurance. Then protocols that lacked audits found themselves unable to attract liquidity. The market enforced what the law did not.
The same dynamic is now playing out in the smart home sector. The CRA establishes the legal floor. The insurance and retail markets are establishing a higher practical floor. And the gap between the two floors is where the compliance industry is being born.
A new class of RegTech firms is emerging to serve this market. They offer CRA reporting automation, AI agent behavior monitoring, SBOM generation and management, and supply chain vulnerability intelligence. I have reviewed product documentation from five such firms. Four of them launched within the past six months. All of them are hiring.
One founder, a former ENISA security analyst, explained the business model to me with brutal clarity. "We are not selling compliance," he said. "We are selling the documentation of compliance. Our clients will never be fully compliant with the CRA because the CRA is not fully implementable. What we give them is a defensible record of their efforts to comply. When the market surveillance authority comes, that record is what matters."
He is right. And the price of that record is substantial. His firm charges €150,000 annually for its base package, plus €50,000 for the AI agent monitoring module, plus a per-report fee for ENISA submission handling. For a mid-sized manufacturer, this is a material expense. For a small manufacturer, it is prohibitive.
The CRA was designed to create a level playing field. In practice, it is creating a two-tier market. Large manufacturers with dedicated compliance teams and sophisticated legal counsel will manage the transition. Small and medium manufacturers will either absorb costs that destroy their margins or exit the European market entirely.
I have already seen evidence of this. A Slovenian smart home manufacturer with 85 employees told me last month that they are discontinuing their EU sales of connected security cameras. The product line represents 30% of their revenue. The compliance burden—the 24-hour monitoring, the SBOM requirements, the authorized representative, the conformity assessment—exceeds what they can support. They are pivoting to industrial sensors that fall outside the CRA's scope.
The company's founder was not angry. He was resigned. "Europe is deciding who it wants in this market," he said. "We are not who they want."
The Commission's impact assessment for the CRA estimated that compliance costs would range from €20,000 to €50,000 for small manufacturers. The actual costs I am observing are five to ten times higher. The Commission did not account for the AI agent problem because the AI agent problem did not exist in its current form when the assessment was conducted.
This is the cost of regulating technology on a legislative timeline. By the time the rules take effect, the technology has evolved beyond the rules' assumptions. The regulated parties are left to interpret a text that no longer maps to their reality.
The smart ones will document their interpretations. They will build records showing how they applied the CRA's definitions to AI agent behaviors that the regulation never contemplates. They will generate audit trails demonstrating their good-faith attempts to comply with requirements that may be literally impossible to fully satisfy.
Those records will be their defense when the first enforcement action arrives. They will be the difference between a fine and a warning. They will be the proof that the company acted responsibly in the face of regulatory ambiguity.
I learned this lesson the hard way in the aftermath of the 2022 FTX collapse. The firms that survived the subsequent regulatory scrutiny were not the ones with the cleanest balance sheets. They were the ones with the most complete documentation of their risk management processes. The paperwork mattered more than the profits.
Contrarian
Here is the part of the story that the compliance industry does not want you to hear. The CRA's AI agent gap is not a bug in the regulation. It is a feature of the Commission's overall regulatory strategy.
The Commission has three major digital regulations in final implementation: the CRA, NIS2, and the AI Act. The AI Act establishes a risk-based framework for AI systems. It creates categories of prohibited, high-risk, and limited-risk applications. It imposes requirements on providers of high-risk AI systems.
But the AI Act's high-risk categories do not include consumer smart home AI agents. A voice assistant that controls door locks is not classified as high-risk under the AI Act because it does not fall within any of the Annex III categories. It is not biometric identification. It is not critical infrastructure management. It is not education or employment scoring.
So the AI Act does not regulate it. The CRA regulates the product but not the AI behavior. NIS2 regulates the operator but not the product. The AI agent falls through the cracks of all three frameworks.
This is not an accident. It is a consequence of the Commission's deliberate choice to regulate by technology category rather than by function. The AI Act was designed to address specific harms from specific applications. The CRA was designed to address product security. NIS2 was designed to address operational resilience. None of them was designed to address autonomous systems that blur the line between product and service, hardware and software, tool and agent.
The Commission knows this. The guidance document's footnote on page 41 is not an oversight. It is an acknowledgment that the current regulatory architecture cannot address the AI agent problem without new legislation. And new legislation is not forthcoming.
The Commission's work program for 2027 does not include a proposal to amend the CRA. It does not include a proposal to extend the AI Act to consumer AI agents. It includes only the continuation of existing implementation efforts and the development of harmonized standards.
This means the AI agent gap will persist for at least another three to five years. The harmonized standards will address it partially. The ENISA technical guidance will address it partially. The market will address it partially. But there will be no legal clarity on whether a smart home AI agent's behavior constitutes a vulnerability under the CRA.
For the Commission, this is acceptable. The regulatory framework is in place. The compliance industry is developing solutions. The market will sort out the details. The political capital required to reopen the CRA or amend the AI Act is not available. The focus has shifted to implementation.
For the regulated industry, this is a strategic opportunity. The absence of definition is not a burden. It is a space for interpretation. Companies that interpret the CRA's requirements in ways that serve their interests, document those interpretations carefully, and build processes that align with their preferred reading will be in a stronger position than companies that wait for clarification.
The Commission's guidance document is a masterclass in strategic ambiguity. It says enough to establish that the Commission is aware of the AI agent problem. It says nothing that could be used to hold the Commission accountable for failing to address it. It creates a framework within which companies must exercise judgment.
I have seen this pattern before. During my time covering the EU's MiCA implementation, I watched stablecoin issuers navigate a similar landscape of regulatory ambiguity. The issuers that thrived were not those that waited for clarity. They were those that pushed the boundaries of interpretation, documented their reasoning, and built compliance postures that were defensible even if later challenged.
The CRA creates a similar dynamic. The companies that will emerge strongest from the December 2027 deadline are not those that achieved full compliance. There is no such thing as full compliance with a regulation that does not define its key terms. The survivors will be those that developed robust compliance postures—processes, documentation, external validation—that can withstand scrutiny even if the underlying requirements are impossible to fully satisfy.
The 37% of manufacturers who cite fragmented compliance as their primary challenge are correct. But they are framing the problem incorrectly. The challenge is not the fragmentation. The challenge is the ambiguity. And ambiguity rewards those who interpret it strategically.
The companies that treat the CRA as a checklist will fail. The companies that treat it as a documentation exercise—an opportunity to demonstrate their commitment to security through process and transparency—will succeed. The distinction is subtle. But it is the difference between a fine and a warning, between exclusion from the market and continued participation.
I have been inside the compliance operations of three smart home manufacturers preparing for the CRA. The one that is performing best is not the largest. It is the one that hired a former regulator to lead its compliance team. She understood, intuitively, that the CRA's ambiguities were opportunities. She built a reporting system that generates detailed records for every vulnerability assessment, even those that do not result in a report. She created an AI agent risk taxonomy that maps to both the CRA's definitions and the OWASP framework. She established relationships with ENISA staff before the reporting obligation went live.
When enforcement arrives—and it will—her company will not be a test case. It will be an example of good practice. That distinction matters when the regulator has discretion in determining penalties.
The CRA's penalty structure is designed to create this dynamic. The €15 million or 2.5% cap is a theoretical maximum. The Commission's enforcement guidance, which is not yet public but has been shared with member state authorities, emphasizes "proportionality and engagement" in determining penalties. Companies that demonstrate good faith, that have robust compliance programs, and that cooperate with investigations will receive substantially reduced penalties. Companies that ignored the requirements until they were caught will face the full weight of enforcement.
The practical implication is clear. The first enforcement actions will not be about fines. They will be about establishing baselines. The Commission and the member state authorities will be watching to see how companies respond. The responses they reward will become the standard for future enforcement.
This is the final irony of the CRA's AI agent gap. The Commission's silence on the definition of vulnerability in AI systems is not a flaw. It is a feature. It creates a regulatory environment in which companies must demonstrate their commitment to security through process and documentation. It rewards those who take the ambiguity seriously. And it creates a record that the Commission can cite when, inevitably, the AI agent problem requires legislative action.
The Commission is not waiting for the technology to settle. It is building a record of the problems the technology creates. The CRA's reporting obligations will generate data for future regulation. The companies that fail to report will provide evidence of the need for stronger enforcement. The companies that report carefully will provide models for future compliance.
This is how regulation evolves. Not through perfect foresight, but through iterative learning. The CRA is not a final answer. It is a first question. And the quality of the answer will depend on how well the industry responds to the question's ambiguity.
Takeaway
The first CRA enforcement action will arrive before the end of 2027. It will not be about an insecure product. It will be about a failure to report. The company will argue that it was uncertain whether the incident constituted a reportable vulnerability. The market surveillance authority will argue that the uncertainty was itself a compliance failure.
The outcome will define the enforcement baseline for years. If the authority accepts the ambiguity argument, the industry will have wide latitude. If it rejects the argument, the industry will face an unprecedented documentation burden.
I know which outcome I would bet on. The Commission has invested significant political capital in the CRA. It will not allow the regulation to be perceived as toothless. The first enforcement action will send a signal. The signal will be that ambiguity is not an excuse for inaction.
Watch the ENISA portal. Watch the first reports. Watch how the Commission responds to the first case of "we didn't know whether to report." Watch the OWASP framework's references in procurement contracts. Watch the insurance industry's underwriting requirements.
The CRA's AI agent gap is not a problem to be solved. It is a market to be defined. And the companies that define it first will own it.