Skip to content
Weekly digest · Issue 1

Matter settles in, the Cyber Resilience Act clock is running, and RedCap finds its niche

Launch issue of the weekly digest: where the smart home standard stands, what the EU's device security law means for makers, and why 5G RedCap matters for IoT.

This week in brief
  • Matter has moved from launch hype to steady releases; the interesting work is now in multi-admin, energy management and the slow arrival of cameras.
  • The EU Cyber Resilience Act applies to almost every connected product sold in Europe; reporting obligations arrive before the full conformity requirements.
  • 5G RedCap is settling into the mid-tier gap between LTE-M and full 5G, aimed at wearables, cameras and industrial sensors.
  • Thread networks keep growing because every Matter border router adds one, which is changing how smart home radios are chosen.

This is the first issue of the weekly digest, so it reads a little differently from the ones that will follow. Instead of reacting to a single week of announcements, it sets the baseline: the three or four threads we expect to keep pulling on through the autumn, and why. Future issues will be shorter and more specific.

Matter, four years in

Matter launched with the promise that any certified device would work with any certified controller. The promise held for the basics, lights, plugs, locks, thermostats, and the standard has kept a steady release rhythm since. What has changed is where the attention is. The early complaints were about setup friction and missing device types; the current conversation is about the things that make a smart home actually smart: energy management clusters for EV chargers, solar inverters and heat pumps, multi-admin so one device can be shared across ecosystems without re-pairing, and the long wait for cameras, which bring bandwidth and privacy questions the original spec deliberately avoided.

Why it matters: for device makers, Matter is now the default answer to “which ecosystem do we support”, and the differentiation has moved to the quality of the implementation. For buyers, the label still does not guarantee feature parity across apps, and our Matter guide explains why.

The Cyber Resilience Act is a product requirement, not a policy story

The EU’s Cyber Resilience Act covers nearly every product with a digital element sold in the Union, which in practice means most IoT devices and the software that runs them. The law phases in: manufacturers’ obligations to report actively exploited vulnerabilities and severe incidents arrive first, and the full set of conformity requirements, including secure-by-default configuration, vulnerability handling for the support period and a software bill of materials, follow later.

The practical consequence this autumn is that engineering teams are being asked for things they have not had to produce before: an SBOM per firmware release, a documented update policy, a coordinated vulnerability disclosure process. Our regulation guide compares the CRA with the UK’s PSTI regime and the U.S. Cyber Trust Mark, which overlap but are not identical.

5G RedCap finds its place

5G RedCap (reduced capability) strips 5G down for devices that do not need gigabit speeds: fewer antennas, narrower bandwidth, simpler modulation. The result sits between LTE-M and full 5G, and the use cases are the ones LTE-M could not reach comfortably: industrial cameras, wearables that stream, routers for small sites. Module availability and operator support are what decide whether a radio technology ships in products, and both have been improving through the year.

Why it matters: RedCap is also the planned successor for devices that today use LTE Cat-1, which gives it a built-in migration market as 4G networks age. See NB-IoT and LTE-M explained for how the low-power cellular options compare.

Thread grows by default

Every Matter controller that ships with a radio tends to include a Thread border router, which means Thread networks are appearing in homes whether or not anyone chose them. That has consequences for device makers choosing between Thread and Zigbee for the next product generation, and for anyone debugging a home where several border routers from different vendors coexist. The Thread Group’s work on credential sharing between border routers is the piece to watch. Background in Thread explained.

Also worth your time

  • The glossary is live with a few hundred terms, each on its own page with cross-links. Tell us what is missing.
  • The AI meets Things section opens with guides on edge AI and TinyML.

Sources

Topics: Matter, Cyber Resilience Act, 5G RedCap, smart home, regulation