2026-09-17
The Aqara Smart Lock U400 keeps first at 9.5 and the ranking carries forward. The regulatory milestone that matters most for locks landed on 11 September, when the vulnerability reporting duties of the EU Cyber Resilience Act became enforceable.
Here is what changed. Any manufacturer selling a connected product in the EU that learns of an actively exploited vulnerability must file an early warning within 24 hours, a fuller notification within 72 hours, and a final report within 14 days of a fix being available. Filings go through ENISA's Single Reporting Platform, and fines reach 15 million euros or 2.5 percent of global turnover. The part I find most important is scope. Tech Times and Skadden both note that the reporting duty covers products already on shelves, so the lock on your door today falls under it.
For a lock owner, that turns security response into a measurable, legally backed promise. A maker now has a clock running from the moment it learns a flaw is being used in the wild. The practical steps on my side are simple. Turn on automatic firmware updates in the lock app, keep the bridge or hub that relays those updates powered, and register the product so the maker can reach you.
This also strengthens the logic behind my top picks. The U400 and the Ultraloq Bolt Mission at fourth both carry Aliro certification, which runs through a formal security review, and the U400 pairs Apple Home Key and Samsung Wallet support with a fingerprint reader and a physical key backup. Schlage Encode Plus at 9.1 stays second for its sturdy deadbolt hardware, built in Wi-Fi and Apple Home Key.
The Matter 1.6 specification that shipped in June added Product Security 1.1, written to help makers align with the same law. Locks certified against it over the next year are the ones I expect to score highest on long term support.
CRA reporting went live 11 September
Makers selling in the EU must warn authorities within 24 hours of learning a flaw is being actively exploited.
Existing locks are covered
The reporting duty applies to products already on the market, including the lock on your door today.
Owner checklist
Enable automatic firmware updates, keep the relay hub powered and register the lock with its maker.
U400 leads on certified security
Aliro certification, Apple Home Key, Samsung Wallet support, a fingerprint reader and a key backup keep it first at 9.5.
Matter 1.6 security tier
Product Security 1.1 aligns certified devices with the same EU law, a strong signal for long term support.