Since 11 September 2026, actively exploited vulnerabilities must be reported within 24 hours.If it applies, how ready are we? Find your CRA gaps (6 questions, 2 min) →Find your CRA gaps
System 3 / 6
Signed, staged, with a stop button
For firmware leads, DevOps, and whoever tells customers what changed
What it is
Every update is digitally signed, so products only accept the real thing. Updates go out in stages: a few homes, then more, then everyone.
Why it matters
One faulty or fake update can break thousands of products at once. In 2016 a thermostat update left homes without heating.
It works when
A fix reaches every product within days, and a bad update can be stopped halfway.
What the law says
The CRA requires products to protect their software against unauthorised modification (Annex I, Part I (2)(f)), mechanisms to distribute updates securely (Annex I, Part II (7)), and security updates disseminated without delay and free of charge (Annex I, Part II (8)). Signing and staged rollout are our recommended way of meeting that duty; staging itself is not a legal requirement.
Example: ABC Heating Systems, a fictional Danish maker of connected thermostats.
Firmware lead
Engineering team
Makes sure every update is signed and that products refuse anything unsigned. Rolls updates out in stages and can press stop.
Kasper Nørgaard
DevOps engineer
Keeps the signing key locked away, so only the approved release process can use it.
Line Vestergaard
Head of Sales
Tells installers and customers what was fixed and what, if anything, they need to do.
A small team can run this system too. Here is what it takes.
Do it yourself
Staged rollout: the first 20 percent of units before the rest. The device keeps a log of what it installed.
Half a day of help
A firmware engineer who has set up update signing before, to do it once with your developer.
Where SPS Digital Tech helps
We help your developer set up update signing and a staged rollout with a stop button.
The story behind it: The thermostat that went cold, January 2016
3 a.m. in January. The radiator under the window was cold.
Read the storyWe will send you the step-by-step checklist we use with clients, and answer any questions about your setup.