Explainer · Checked 1 Nov 2026

The EU Cyber Resilience Act and OTA updates for ESP32

From 11 December 2027, connected products sold in the EU must be able to receive security updates, delivered securely. Here is what that means for an ESP32 product, in plain language.
Not legal advice. This page summarises the regulation in plain language; the regulation's text is what applies. otalite will help you deliver security updates; it does not make your product meet the Cyber Resilience Act, and conformity assessment and CE marking remain the manufacturer's responsibility.
The dates

Two dates that matter.

The Cyber Resilience Act entered EU law as Regulation (EU) 2024/2847. Its obligations arrive in stages.
11 Sep 2026

Reporting began

Manufacturers must report actively exploited vulnerabilities and severe incidents in their products, with a first warning within 24 hours.
11 Dec 2027

Full obligations apply

The essential requirements, conformity assessment and CE marking apply to products with digital elements placed on the EU market.
Security updates

What the CRA expects from updates.

Among the regulation's essential requirements (Annex I), several concern how a connected product is updated. In plain language:

Vulnerabilities fixed by security updates

A product must be able to receive security updates, where applicable automatically by default, with a way for the user to opt out.

Updates distributed securely

Updates must reach devices through a secure mechanism, so that what arrives is what the manufacturer released.

Fixes without delay, free of charge

Security updates are to be made available promptly, and free of charge, throughout the product's support period.

A support period

Manufacturers state how long they provide security updates: generally at least five years, or less for shorter-lived products.
Summarised from the regulation; read Annex I in the text on EUR-Lex for the exact wording.
On an ESP32

Where OTA updates fit.

For an ESP32 product, the update mechanism is the over-the-air path. ETSI EN 303 645, the consumer IoT security standard, asks the same of it in provision 5.3: authenticity and integrity checks on updates delivered over a network. Espressif publishes its own CRA resources for its chips, including SBOM tooling (esp-idf-sbom).

Signing

Each update signed, and checked on the device before it installs: integrity and authenticity.

Rollback

An update that fails to start is undone by the device, so pushing a fix never strands a fleet.

No going backwards

A device refuses older, vulnerable releases, so a fixed vulnerability can't be reintroduced.

Reaching sleeping devices

A device that wakes rarely still needs the fix: schedules and update windows decide how fast it reaches the fleet.
otalite's plans

How otalite's planned design lines up.

otalite is designed with the CRA's update requirements in mind, and its planned vulnerability advisories support the CRA's vulnerability-handling and security-update expectations. None of it is available yet; each line carries its roadmap status.
Secure distribution
Ed25519-signed releases in COSE manifests, verified on the device before install
In development
Keys under your control
Sign with your own key and keep it offline, or managed signing as a lighter option
In development
Integrity in transit
Check-ins encrypted and authenticated end to end with OSCORE; replays refused
In development
Fixes that reach the fleet
Staged rollouts with an automatic pause on failures, and rollback
In development
Timely updates on battery devices
Update windows and install conditions per device group
In development
Knowing what breaks in the field
Device issue reporting, grouped into issues
Planned
Vulnerability handling
Vulnerability advisories: each release's contents matched daily against published CVEs, with the update that fixes each
Planned
Knowing what's in each release
An SBOM export of each release's inventory, in CycloneDX or SPDX
Planned
otalite security ›The roadmap ›
Sources

Read the primary sources.

Checked 1 Nov 2026. Where this page and a source differ, the source is right.
Regulation (EU) 2024/2847, the Cyber Resilience Act (EUR-Lex) ›European Commission: the Cyber Resilience Act ›European Commission: CRA reporting obligations ›Espressif developer blog: ESP32 CRA obligations and deadlines (Sep 2026) ›Jones Day: CRA 24-hour reporting duties start 11 September 2026 ›Ireland's National Cyber Security Centre: the CRA ›Zephyr Project: ETSI EN 303 645 mapping (provision 5.3, secure updates) ›
Not legal advice. This page summarises the regulation in plain language; the regulation's text is what applies. otalite will help you deliver security updates; it does not make your product meet the Cyber Resilience Act, and conformity assessment and CE marking remain the manufacturer's responsibility.
© 2026 otalite · Coming soon
FeaturesBatterySecurityRolloutsInsightsWorkflowRoadmapMicroPython OTA optionsBattery life calculatorCyber Resilience ActAboutRegister interestDiscordGitHub