Why I didn’t wait for 2027
Posted: November 5, 2026
Centro delivers energy savings, through lighting HVAC and shading automations controlling the energy usage within the spaces.
Every light switch, thermostat and door controller in a modern hotel is now a computer on a network. For years, their security came down to a supplier's word. That is changing.
The EU Cyber Resilience Act sets security rules for connected products sold in Europe. Its reporting duties have applied since 11 September 2026, and the rest follows in December 2027. I didn't want to wait.
Since March I've been working through the Act, requirement by requirement, against the Centro Box and writing down the evidence. The honest answer was "not ready yet". The product was in decent shape, but the gaps were in process.
Every gap became a task. Every Centro Box release now ships with a software bill of materials. Our builds refuse components with known serious vulnerabilities. There's a published security contact on every site. And every Centro Solution gets security updates for five years from purchase.
We're not finished. The risk assessment and our procedure for reporting exploited flaws are still being written, so I won't call Centro "compliant". I'll show the rest as we go.
This is the first of five articles on our road to the Act, gaps included. Read the full article on lightingcontrol.co.uk.
You can see our evidence on our security page.