What happens when a smart device stops getting updates?
What happens when a connected device stops getting updates or its cloud shuts down, with documented cases, owner options and what the law requires.
Photo: Tasha Kostyuk / Unsplash
After reading this article you will be able to:
- Tell apart the end of security updates from the shutdown of a cloud service and what each one breaks
- Check a device for local control and other escape routes before its maker drops it
- Explain what EU, UK and US rules require from manufacturers about support periods
On this page
When a smart device reaches the end of support, one of two things ends, and sometimes both. The maker stops shipping firmware and security updates, so the device keeps working but becomes riskier every month. Or the maker shuts the cloud service the device depends on, and the device loses features or stops working entirely, regardless of how well the hardware still runs.
Which outcome you get depends on how much of the product lives on the maker’s servers. A thermostat with buttons keeps heating the house; a camera that only streams through the vendor’s cloud becomes a paperweight. This guide covers documented cases, what owners can do and what the law requires.
What actually ends when support ends?
“End of support” is a bundle of separate services that can stop on different dates:
- Security and firmware updates. Vulnerabilities found later stay open. The device usually keeps working.
- The cloud service. Remote access, schedules, automations, notifications and anything else processed on the vendor’s servers.
- The app. Even a device that could work locally may have no way to be configured once the app drops it.
- Integrations. Voice assistant skills and partner links often go first.
- Customer service and replacements. Faulty units are no longer swapped.
A device that does its core job locally degrades gracefully. A thin client of a cloud service does not.
What has happened to real devices?
Five recent cases, each from the manufacturer’s own support page, show the range.
| Product | What ended | What kept working |
|---|---|---|
| Google Nest Secure alarm | Cloud, app and updates | Nothing useful; Google advises against continued use |
| Hive View cameras, HomeShield | Everything, on 1 August 2025 | Nothing |
| Nest Learning Thermostat, 1st and 2nd gen | App connection and updates, from 25 October 2025 | Control on the device itself |
| Belkin Wemo (Wi-Fi models) | App and cloud, from 31 January 2026 | Units set up in Apple HomeKit beforehand; Thread models |
| Bose SoundTouch speakers | Cloud features, from 6 May 2026 | Local app control, Bluetooth, AirPlay, Spotify Connect, AUX |
Google’s Nest Secure support page says the alarm system no longer connects to the cloud, does not work in the Google Nest app, cannot send alarm notifications and will no longer receive software or security updates. Hive’s product news page states that its cameras and HomeShield alarm would stop working when their support period ended on 1 August 2025, after the Nano 1 hub lost its server connection on 1 August 2023.
The other three cases ended better because the products had a local path. Google’s page for the first and second generation Nest Learning Thermostat says that from 25 October 2025 the units no longer work in the Nest or Home apps and get no more software or security updates, but they can still be controlled on the thermostat. Belkin’s Wemo notice ended cloud and app support for select products on 31 January 2026; devices already set up with Apple HomeKit keep working locally, Thread-based models are unaffected, and owners with products still under warranty may qualify for a refund. Bose extended its SoundTouch shutdown from 18 February to 6 May 2026, shipped an app update that controls speakers on the local network, and published the SoundTouch Web API documentation so independent developers can build their own tools. Presets and in-app music browsing stopped working.
The lesson is architectural: the survivors had a local path, either an existing ecosystem such as HomeKit or a documented API.
Why does an unsupported device become a security problem?
A device that still works but gets no updates is the more dangerous outcome, because nothing forces you to notice it. Every vulnerability published after the last update stays exploitable, on a device that sits on the home network next to laptops and phones and may have a camera, a microphone or door control. Unpatched connected devices are the raw material of botnets such as Mirai, which grew by scanning for exactly this kind of neglected hardware.
A device whose cloud has gone dark is not automatically safe either: its firmware may still answer on the local network, and it will never be fixed. Google’s advice for Nest Secure is to stop using it.
What can you check before buying?
The cheapest time to deal with end of support is at the checkout.
- Look for a stated support period, ideally an end date. In the UK the manufacturer must publish one, and EU rules will require it (see below). If no period is stated, assume the shortest plausible one. In a 2024 review of 184 smart products, FTC staff found that nearly 89% did not disclose how long they would get software updates. A study of EU online stores found the same gap at the point of sale. The security support period entry explains the term.
- Prefer local control. Devices that work through Matter, Apple HomeKit, a documented local API or a hub such as Home Assistant have a path that does not run through one company’s servers.
- Separate the core function from the extras. Remote viewing may need a cloud; turning on the heating should not.
What can you do when the notice arrives?
The order of steps often matters.
- Note what stops and when. Separate the update end date from the cloud end date.
- Do the migrations before the deadline. Belkin’s notice is a clear example: HomeKit setup had to happen before 31 January 2026, because it could not be done afterwards.
- Claim what you are offered. Refunds, credits and upgrade discounts usually have conditions and their own deadlines.
- Look for a local route. Published APIs, Home Assistant integrations and maintained community firmware can keep hardware useful.
- Contain what you keep. If an unsupported device stays in use, put it on a separate network or guest Wi-Fi, or block its internet access at the router. Network segmentation limits what an attacker can reach through it.
- Retire it properly. Factory reset the device, remove it from your account, and take it to an electronics recycling point.
What does the law require now?
No rule in the EU, the UK or the US obliges a company to keep a cloud service running indefinitely. The rules focus on security updates and on telling buyers how long they will get them.
EU consumer law. Under the Sale of Goods Directive, Article 7(3), the seller of goods with digital elements must make sure the consumer is informed of and supplied with the updates, including security updates, needed to keep the goods in conformity, for the period the consumer may reasonably expect. The claim runs against the seller.
EU Cyber Resilience Act. The Cyber Resilience Act, Regulation (EU) 2024/2847, applies in full from 11 December 2027. Article 13(8) sets a support period of at least five years, or the expected use time if shorter. Article 13(19) requires the end date, at least month and year, to be stated at the time of purchase, and asks manufacturers to notify users when support ends where that is technically feasible. Security updates must be free of charge.
UK. Under the PSTI product security regulations, in force since 29 April 2024, manufacturers of consumer connectable products must publish a defined support period and may extend it but not shorten it.
US. There is no general federal rule. FTC staff have warned that failing to disclose support duration may, depending on the facts, violate the Magnuson-Moss Warranty Act for products sold with a written warranty, or the FTC Act if the maker implied how long the product would remain usable. The voluntary Cyber Trust Mark registry is designed to show a support end date. The IoT security regulation guide covers all of these regimes in more depth.
Where to go next
- IoT security regulation explains the CRA, PSTI and Cyber Trust Mark in full.
- EU online stores rarely say how long IoT devices get security updates shows how support periods appear, or do not, at the point of sale.
- Home Assistant explained covers the most common way to keep devices under local control.
- Device management and over-the-air updates shows what delivering updates for years takes on the maker’s side.
Topics: end of support, security updates, smart home, consumer rights, Cyber Resilience Act, PSTI, everyday questions