Every smart home device that connects to your broadband network is a potential entry point for an attacker. Your smart thermostat, your video doorbell, your internet-connected locks, your voice assistant, your security cameras: each one runs software, communicates with remote servers, and in many cases collects data about who is home, when they sleep, how they move through the house, and what they say within earshot. The security of these devices is not a technical abstraction. It is a direct question about the safety and privacy of the people inside the home.
For years, smart home device manufacturers operated without meaningful cybersecurity obligations. Devices shipped with default passwords that millions of users never changed. Firmware updates were irregular or nonexistent. Security vulnerabilities were discovered, publicised, and in many cases simply left unpatched. The result was a global market flooded with connected devices that worked reasonably well as consumer products but were fundamentally insecure as networked systems. The Mirai botnet attack of 2016, which weaponised hundreds of thousands of insecure home routers and cameras to knock major websites offline, was an early demonstration of what that insecurity looked like at scale.
The question this essay addresses is whether building codes, the legal framework governing how homes are constructed, should now be updated to mandate cybersecurity standards for smart home technology as a condition of lawful installation or sale. The argument has real force. But it also faces genuine complications, and the evidence from early regulatory experiments is instructive in both directions.
The Case For: Why Mandatory Standards Make Sense
The most compelling argument for mandatory smart home cybersecurity standards is that voluntary approaches have comprehensively failed to produce secure products at scale. The consumer IoT market grew rapidly throughout the 2010s on the back of price competition, not security investment. A manufacturer that spent time and money building secure firmware, implementing proper encryption, and maintaining a vulnerability disclosure programme was competing against rivals that did not, and the cheaper, less secure product usually won on the shelf. The market had no mechanism to correct this. Consumers could not easily evaluate the security of a connected device. Price and features were legible; firmware architecture was not.
The regulatory response that has emerged in the UK represents the most significant mandatory framework deployed so far. The Product Security and Telecommunications Infrastructure Act, which came into full effect on 29 April 2024, requires all consumer connectable products sold in the UK to meet three baseline security requirements: devices must have unique passwords rather than universal defaults; manufacturers must publish a contact for reporting security vulnerabilities; and manufacturers must disclose the minimum period for which they will provide security updates. Non-compliance carries fines of up to £10 million or 4% of global annual revenue, whichever is higher. That is a credible enforcement mechanism, not a voluntary suggestion.
The European Union went further with the Cyber Resilience Act, which entered into force in December 2024 with phased obligations extending over three years. The EU’s framework addresses secure development practices and post-market obligations for all products with digital elements, including smart home devices. The EU Data Act, applicable from September 2025, adds data access and management requirements. These are not light-touch frameworks. They represent a serious attempt to treat connected device security as a matter of public infrastructure rather than individual consumer choice.
The case for extending these principles into building codes specifically, rather than product safety law alone, rests on a straightforward argument: a home is a system, and the security of that system depends on the combined security of every device installed in it. Building codes already regulate electrical systems, plumbing, structural integrity, and fire safety. They do so because individual homeowners cannot reasonably be expected to evaluate whether a contractor’s work meets safety standards, and because the consequences of failure extend beyond the individual homeowner to their family, their neighbours, and emergency services. Smart home cybersecurity presents an analogous case. A connected device installed by a builder or contractor that creates a persistent network vulnerability is not a private matter between the homeowner and the manufacturer. It is a public safety issue with potential consequences for the broader network environment.
The Case Against: Why Building Code Mandates Create New Problems
The case against embedding cybersecurity mandates in building codes is not simply a libertarian objection to regulation. It rests on several practical arguments that deserve serious engagement.
The most fundamental is the pace problem. Building codes are inherently slow to update. The regulatory process for changing building regulations typically runs over years, involves extensive consultation, and results in standards that are then locked in for extended periods. Cybersecurity threats evolve in months, sometimes weeks. A building code requirement mandating specific security protocols that were considered robust in 2024 may be inadequate by 2026. Encoding specific technical requirements into building law risks creating a floor that rapidly becomes outdated and may even create a false sense of security by certifying compliance with standards that attackers have already found ways around.
There is also a definitional problem. Building codes regulate physical construction: the dimensions of a staircase, the load-bearing capacity of a floor, the fire rating of a wall. These are properties that can be inspected at the point of installation and remain largely stable over time. Cybersecurity is different. A device that was securely configured at installation may become vulnerable six months later when a new exploit is discovered. The security state of a connected device is not a fixed property that a building inspector can assess during a post-construction walkthrough. It is a continuously evolving characteristic that depends on software updates, network configuration, and threat intelligence that no building code can effectively govern.
The compliance cost argument also carries weight, particularly for the construction of new affordable housing. Adding cybersecurity certification requirements to the list of building code compliance obligations increases both the cost and the administrative complexity of construction. For large developers building premium properties, that cost is manageable. For smaller builders, housing associations, or local government housing programmes working on thin margins, additional compliance requirements create genuine friction. The risk is that a well-intentioned mandate ends up adding cost to exactly the segment of housing production that affordability needs most.
Finally, there is the enforcement problem. Building code compliance is currently inspected by local authorities with inspectors who have expertise in structural engineering, electrical systems, and fire safety. Cybersecurity assessment requires a different kind of expertise that is in short supply globally. Scaling cybersecurity inspection capacity across every local building authority in the UK, the US, or Australia within any realistic timeframe is not a straightforward administrative task.
What the Evidence From Early Regulation Shows
The evidence from the early regulatory frameworks is more positive than the sceptics predicted, but also more limited than the advocates hoped. The UK’s PSTI Act has produced measurable changes in manufacturer behaviour. Major consumer electronics companies have updated their default password policies, published vulnerability disclosure programmes, and in several cases committed to defined security update periods for the first time. The compliance rate among major manufacturers is high, driven both by the penalty structure and by the reputational cost of non-compliance in a market where security is increasingly a purchase criterion for informed buyers.
In the United States, the approach taken has been deliberately more cautious. The White House launched the Cyber Trust Mark in January 2025, a voluntary labelling programme for wireless IoT devices that operates similarly to the Energy Star efficiency label. Products meeting NIST-defined security criteria can display the mark, with a QR code linking to a security registry. The programme is voluntary, but industry uptake has been significant because major retailers have signalled preference for certified products. This creates a market incentive without a building code mandate.
The outcome difference between the UK’s mandatory approach and the US voluntary approach is not yet clear from the data, partly because both are recent and partly because consumer awareness of smart home security risks, while growing, remains limited. Most buyers of smart home devices do not know what firmware means, let alone whether their devices receive regular security updates. In that environment, labelling schemes reach only the minority of consumers who are actively looking for security information. Mandatory standards reach all products regardless of consumer knowledge levels.
The practical lesson from both approaches is that product-level regulation, whether mandatory or voluntary, is more tractable than building code integration. Setting minimum security standards that apply to all connected devices sold in a jurisdiction is administratively feasible, enforceable through existing product safety mechanisms, and capable of being updated more rapidly than building regulations. Building codes remain valuable for governing the physical infrastructure of smart homes, including the installation of dedicated network hardware, router placement, and wiring standards, but the cybersecurity of the software layer is better governed through product regulation than construction regulation.
The Verdict: Yes to Standards, With Caveats About the Vehicle
Building codes should mandate smart home cybersecurity standards by law, but the framing matters as much as the principle. The answer is yes to mandatory standards and yes to legal enforcement, but the most effective vehicle for that mandate is product safety and consumer protection law rather than building codes specifically.
The UK’s PSTI framework demonstrates that mandatory minimum standards for connected devices are enforceable, achievable by manufacturers, and effective at raising the floor of security across the market. The EU’s Cyber Resilience Act takes that approach further and addresses the full lifecycle of connected products, from secure design through ongoing update obligations. These are the right instruments for governing smart home cybersecurity at scale.
Building codes have a role to play in the adjacent physical infrastructure: mandating the installation of secure, dedicated network infrastructure in new residential construction, requiring that connected devices installed by contractors meet certified security standards at the point of installation, and ensuring that smart home systems are configured in accordance with minimum security baselines before a certificate of occupancy is issued. That is a building code role that aligns with what building inspectors can actually assess.
What building codes cannot do is govern the ongoing security of software after installation, and that is where the real vulnerability lies. The home that was securely configured in 2024 may be running unpatched firmware in 2027 because the manufacturer stopped issuing updates and the homeowner never noticed. That problem requires product lifecycle obligations imposed on manufacturers, not inspections imposed on buildings.
The broader smart home landscape also shapes the cybersecurity risk picture. As homes integrate more connected devices, from smart locks and cameras to voice-controlled assistants, the attack surface of a typical home network expands significantly. Each additional connected device is both a potential privacy benefit and a potential security liability. The case for mandatory standards is ultimately a case for recognising that the security of the networked home is a public interest matter, not merely a private consumer choice. The legal framework for enforcing that recognition is still being built, but the direction of travel is clear and, on the evidence, correct. As smart home data becomes more central to insurance underwriting, the question of whether AI-powered home insurance premiums are discriminating against older homeowners represents one of the most immediate real-world consequences of that unresolved regulatory gap.
Leave a Reply