A thermostat that turns off the heating when you open the window, a camera that sends an alert to your phone at 10 PM, a bracelet that vibrates after thirty minutes of inactivity: we interact every day with connected devices without always understanding what happens between the sensor and the smartphone screen.
Behind these automations, there is a precise assembly of components, protocols, and, recently, European regulatory constraints that change the game for manufacturers as well as users.
What distinguishes a connected device from a traditional electronic device
An electric radiator with a dial heats, period. A connected radiator heats, measures the ambient temperature, transmits this data to an application, and adjusts its power according to a schedule or a remote command. The difference lies in three technical bricks stacked in the same casing.
The first brick is the sensor that collects a physical quantity: temperature, movement, brightness, humidity, heart rate. The second is an embedded microcontroller that processes the raw information locally (filtering, triggering threshold, formatting). The third is the communication module (Wi-Fi, Bluetooth, Zigbee, 4G/5G mobile network) that sends the data to a remote server or to another device on the home network.
Without this third brick, you have an autonomous sensor. With it, you enter the Internet of Things (IoT): the device can receive instructions, transmit data, and trigger actions remotely. To delve deeper into the definition and functioning of connected devices, it is clear that it is this capacity for bidirectional exchange that shifts an object from passive status to intelligent status.
Communication protocols: choose based on range and consumption
You plug in a connected bulb, it appears in the app, and you forget about it. Except on the day when the signal drops between the box and the garage, or when the door sensor’s battery runs out in three weeks instead of six months. The communication protocol chosen by the manufacturer directly affects the range, autonomy, and responsiveness of the device.
Wi-Fi, Bluetooth, and Zigbee in the connected home
Wi-Fi offers high speed and immediate compatibility with the Internet box, but it consumes a lot of energy. It is found in surveillance cameras and connected speakers, devices that are permanently plugged in.
Bluetooth Low Energy (BLE) consumes little and is suitable for battery-powered objects (temperature sensors, activity trackers). Its range remains limited to about ten meters indoors, which requires staying close to the smartphone or a hub.
Zigbee operates in a mesh network: each device relays the signal from its neighbors, which extends coverage without adding a repeater. It is the preferred protocol for smart home systems where multiple sensors are used (shutters, lighting, opening detectors). Feedback on this point varies depending on the density of load-bearing walls and the layout of the rooms.
Long-range networks for outdoor uses
For a humidity sensor installed in a field or a GPS tracker on a vehicle, neither Wi-Fi nor Bluetooth is sufficient. LPWAN networks (LoRa, Sigfox) and cellular networks (4G/5G) take over:
- LoRa transmits small amounts of data over several kilometers with very low consumption, suitable for agricultural sensors or smart meters.
- The 4G/5G cellular network offers higher speed and national coverage, used for construction site cameras or embedded telemedicine.
- Sigfox focuses on short and infrequent messages, typically for the geolocation of industrial assets or alert notifications.
The choice of protocol is not trivial: it determines the battery life and the reliability of the link between the object and the rest of the system.
Cyber Resilience Act: what the European regulation changes for connected objects
Until recently, the software security of a thermostat or a connected lock depended on the goodwill of the manufacturer. The European regulation Cyber Resilience Act (CRA), referenced (EU) 2024/2847, changes this logic. It makes cybersecurity mandatory for all products containing digital elements sold in the European Union.
Two concrete deadlines directly concern consumer connected devices:
- From September 11, 2026, manufacturers must notify within 24 hours any actively exploited vulnerability and any serious incident affecting the security of their products.
- From December 11, 2027, only devices compliant with the CRA requirements and bearing a CE marking that includes the cybersecurity aspect will be allowed to be marketed in the European market.
In practice, this means that manufacturers will have to provide free security updates for the entire expected support duration of the product. Industry practices are converging towards several years of support for consumer connected devices. A device without a commitment to updates will no longer be legally sold in the EU after the end of 2027.
Home network security: concrete actions that protect your data
The CRA imposes obligations on manufacturers, but the security of a connected home network also depends on the user-side configuration. A few actions significantly reduce the attack surface.
Changing the default password of the router and each connected object remains the first reflex. Many devices leave the factory with generic identifiers (admin/admin, 0000) that are listed in public databases exploited by attackers.
Creating a separate Wi-Fi network for connected objects isolates IoT traffic from the rest of the digital activity (computer, smartphone). Most recent boxes allow configuring a second SSID in a few minutes. If the camera or bulb is compromised, the attacker does not access personal files or banking sessions.
Applying firmware updates as soon as they are available fixes identified vulnerabilities. With the CRA, these patches will become more systematic, but they still need to be installed. Enabling automatic updates when the option exists helps avoid forgetfulness.
The proliferation of connected devices in the home (lighting, heating, health, security, music) makes the home network as sensitive as a small information system. Treating it as such, with unique passwords, a segmented network, and regular updates, protects both personal data and the proper functioning of each device.