3 a.m. in January. The radiator under the window was cold.

Birgit was eighty-one and lived alone, and her son had put in a smart thermostat that Christmas so he could keep an eye on her heating from his flat across town. She liked it. It glowed a soft orange when the heat came on, and she said goodnight to it, which made him laugh.

One night in January she woke at three and could see her breath. The radiator under the window was cold. The little screen on the wall was dark. She did not want to wake anyone, so she found a second blanket and sat up in bed with her hands tucked under her arms, waiting for morning.

What neither of them knew was that the thermostat had been dying for two weeks. Back in December it had quietly received an update, the same kind of automatic change your phone gets overnight, and hidden inside that update was a mistake that drained the battery a little at a time. The update had gone to homes everywhere at once, and by the time anyone noticed, it could not be taken back. In the morning her son drove over and followed instructions from the internet to restart and recharge it by hand, and Birgit made coffee and told him she had been fine, which was not quite true.

Under the Cyber Resilience Act, products must protect the functions people depend on, and updates must be distributed securely. In practice that means sending an update to one home in a hundred first, then one in ten, with someone watching in between, the way a cook tastes the soup before serving the whole room. The mistake shows up in a few hundred homes, the update stops, and Birgit sleeps through the night.