Most people who buy a smart lock don’t think much about cybersecurity. They just want to stop searching for their keys. But behind a product like the Yale Doorman sits the EU’s Cyber Resilience Act (CRA), a cybersecurity law that has already shaped how ASSA ABLOY chooses components, writes supplier agreements and plans how long a product will keep receiving updates – long before the requirements apply in full.
We spoke with Andreas Elvstam Cantner, Security Engineer at ASSA ABLOY Smart Residential. He is responsible for product security for the Yale products sold in EMEIA – smart door locks, alarm systems and video cameras for consumers.
Article in brief:
- Why ASSA ABLOY joined the CRA standardisation work early
- Why forty products and differing national requirements make planning ahead essential
- How the CRA has changed product development, from approval processes and supply chain traceability to support periods and risk analysis
- The challenge of building products before the standards are final
- Andreas’s role as ASSA ABLOY’s voice in ETSI, through the trade association ARGE
Andreas Elvstam Cantner, Security Engineer, Yale EMEIA at ASSA ABLOY
Forty products, different rules in every country
When the Cyber Resilience Act (CRA) was formally adopted in 2024, ASSA ABLOY decided to get involved in the standardisation work straight away, rather than waiting for the final requirements. The reason is decidedly practical.
Smart locks are built to fit the cylinders and door constructions that are standard in each country. The oval cylinder profile common in Sweden, for example, differs from the oval one used in Finland – and neither matches the round profile used in Denmark. A lock must also meet local rules on, for example, fire safety and evacuation, so in practice it has to be redesigned for each market. A smart security camera, by contrast, can be developed once and sold across the whole region.
With a portfolio of around forty products, a change rarely stops at a single product. It has to be repeated, market by market, across the range.
– Adapting forty products takes a long time, and if a standard is published only a year before you have to comply with it, you’re left with too little time – especially given the lead times in the supply chain. It’s far better to know where things are heading early on, while you can still change course, says Andreas.
A journey that began before the CRA
Andreas himself has been at ASSA ABLOY for two years, but the company’s work on cybersecurity regulation goes back further. Before the CRA, the main focus was the delegated act on cybersecurity under the Radio Equipment Directive (RED), which applied from August 2025.
To manage the growing volume of regulation, the company has developed a group-wide framework, the ASSA ABLOY Digital Compliance Framework. It translates regulatory requirements into policies and clear ownership. Product management is responsible for security requirements throughout the product lifecycle, research and development for secure design and implementation, and legal and digital compliance for interpreting the regulations and for conformity assessment.
Standardisation work, too, is nothing new for ASSA ABLOY. On the mechanical side, the company has a long tradition of contributing to burglary-protection standards, such as the classification systems that the Swedish Theft Prevention Association (SSF) and its counterparts in other countries use to rate how well locks resist break-ins.
– We’ve helped write standards before, on the mechanical side, and that gave us a head start over companies that have never taken part in standardisation work like this, says Andreas.
From legislation to product decisions
In practical terms, the CRA has changed how ASSA ABLOY runs its product development – not through a radical overhaul, but through new steps in an established process.
The project governance structures have been updated, which gives product owners more to consider before a new product can be approved for launch.
One clear effect is stricter traceability requirements. Things that used to be handled informally now have to be documented and written into supplier agreements. According to Andreas, that has a practical upside: any disagreement over who is responsible for what comes up when the contract is drawn up, rather than further down the line.
Support periods are another area where this shows. The CRA requires manufacturers to keep handling vulnerabilities and providing security updates for a set period after launch – at least five years, unless the product’s expected lifetime is shorter. Previously, that period could be set as the need arose. Now ASSA ABLOY has to know, already during development, how long a product will be supported, and be able to tell component suppliers and customers.
– We’re talking about products that need to last for many years. Maybe none of us working on the project today will still be at the company by then, but the product still has to be able to get updates. It’s tricky to plan for technology that far ahead, says Andreas.
The same forward planning applies to risk analysis. It is no longer enough to consider only how a product is meant to be used. ASSA ABLOY also has to factor in how it is likely to be misused, from the very start of development.
Building products before the standards are final
The hardest part of the CRA so far, says Andreas, is developing products while the standards that will spell out exactly what is required aren’t finished yet.
– We can’t put all product development on hold until the standards are in place. We still have to decide which way to go, without knowing exactly how high we’ll need to jump, he says.
The difficulty isn’t in the broad strokes but in the details: products that fall between categories, and boundaries that aren’t yet clear-cut.
Andreas also sees a risk ahead. If many manufacturers need independent testing bodies to assess their products at the same time, a bottleneck could form.
– There’s a risk that the test houses won’t be able to keep up, especially in certain product categories. The same kind of expertise is needed both to write the standards and to test products against them, says Andreas.
A voice in ETSI’s work on smart home products
ASSA ABLOY takes part in ETSI’s work indirectly, through its membership of ARGE, the European trade association for lock and hardware manufacturers. ARGE has long worked on standards for mechanical locks within CEN, but once locks and alarms became connected, that was no longer enough. In 2020, ARGE joined ETSI specifically to gain access to its cybersecurity expertise.
Andreas represents ARGE in the EUSR working group (EU Standardisation Requests) of ETSI’s TC CYBER. Among other things, he follows the standard that covers his own products: smart locks, alarms and cameras (EN 304 632). He doesn’t write the standard text himself, but brings his perspective on how products are actually built, so that the standard reflects how they are developed in practice.
The involvement also gives ASSA ABLOY an edge in its own work.
– We can see where the requirements are heading before they’re finalised. That makes it easier to get the priorities right, rather than being caught unprepared once the standard applies, says Andreas.
He also points out how few people take part in the vertical working groups:
– I’m surprised by how few people get involved. I expected to be a passive observer in a room full of people. Unfortunately, there are far fewer than you’d expect, given how many companies are actually affected.
The best time to start was twenty years ago
Asked what he would tell companies that still see the CRA as something to deal with later, Andreas reaches for a classic saying.
– It’s like planting a tree. The best time was twenty years ago. The second best time is now.
For companies that don’t know where to begin, he recommends the checklists and self-assessment tools that are already available, rather than diving straight into the legal text. A natural priority is the reporting obligations, which began to apply on 11 September. The point is to have an organisation where it is clear who is responsible for reporting a vulnerability or incident once it has been discovered.
Read more about the CRA’s reporting obligations: 24 hours to act – how the CRA’s incident reporting works
Standardisation is largely invisible to consumers, but Andreas hopes that some of what it has already changed inside ASSA ABLOY, such as clearer support periods, will in time become visible to them.
– Right now it’s a guessing game whether a connected device will still be supported a year from now. If it were clearer how long different products are supported, I think more consumers could make informed choices based on that, much as they already do when weighing other quality factors, he says.
Want to help secure the future of connected products?
Find out how to get involved in shaping digital communication in Sweden.
Read more articles in the same series:
Inside ETSI TC CYBER – Kim Nordström on turning CRA law into finished standards
CRA standards play different roles – Angelo D’Amato explains which one will be decisive
Approved product under the CRA – Ted Strandberg on how companies can start preparing now
