A problem for software teams, IT departments and technical specialists.

But if you are developing a connected product, that separation is becoming increasingly difficult to justify.

A product that connects to an app, exchanges data, uses Bluetooth or Wi-Fi, receives software updates or relies on a cloud service -is no longer just a physical object.

Its digital architecture is part of the product experience, and increasingly, part of the designer’s responsibility.

The EU’s Cyber Resilience Act is making that much harder to ignore.

Since 11 September 2026, manufacturers selling products with digital elements in the EU have been required to report certain serious cybersecurity incidents, and actively exploited vulnerabilities.

For product designers, though, the interesting question is not how to file a cybersecurity report, it is what this changes at the drawing board.

Does it really need to be connected?

Connectivity has become almost instinctive in product development.

Could it have an app? Could we control it remotely? Could it collect data? Could it talk to another device?

Technically, the answer is increasingly yes.

Commercially, the answer deserves more thought.

Adding connectivity may improve the user experience or create an entirely new service around a physical product. But it can also introduce another layer of electronics, firmware, software, testing, maintenance and long-term responsibility.

Manufacturers are expected to consider cybersecurity during product development, document how risks have been addressed and continue dealing with vulnerabilities during the product’s stated support period.

So perhaps the question at concept stage should no longer be, “Can we connect it?”

It should be, “Does connecting it make the product meaningfully better?”

If the answer is yes, fantastic. If the answer is simply that connected products appear more sophisticated, it may be worth thinking again.

Cybersecurity starts with product architecture

This is where cybersecurity becomes surprisingly familiar territory for product designers.

Good design has always involved managing competing requirements.

We balance performance against cost. Strength against weight. Ease of assembly against aesthetics. Product life against material choice. Every decision affects something else.

Cybersecurity is becoming another requirement within that same process.

Imagine, for example, that a product depends on a smartphone app for basic operation. What happens if the app is no longer supported five years from now? If it receives remote firmware updates, how are those updates delivered safely? If it sends information to the cloud, does that information actually need to leave the product in the first place?

These are not simply software questions.

They influence the electronics architecture, user interface, component selection, development cost and even the commercial model behind the product.

And the earlier they are considered, the easier they are to resolve.

The cheapest solution is often an early design decision

Product development becomes expensive when important constraints are discovered late.

If cybersecurity requirements only enter the conversation once the enclosure, electronics and software architecture have effectively been decided, the result may be redesign, additional development or compromises that could have been avoided.

This is why the wider direction of the Cyber Resilience Act matters to product development businesses even before its main requirements apply in December 2027.

The EU’s intention is clear: products with digital elements should be designed with security in mind and supported throughout their lifecycle, rather than security being added at the end.

That changes the brief.

Connected product design is becoming systems design

Perhaps that is the bigger shift.

Industrial design, mechanical engineering, electronics and software can no longer always be treated as separate disciplines that meet somewhere near the prototype.

For connected products, the decisions are increasingly intertwined.

A seemingly small feature added during concept development can influence hardware, software, manufacturing, compliance and years of product support.

Cybersecurity therefore does not need to turn product designers into cybersecurity experts.

But it does require us to ask better questions earlier.

Because designing a successful connected product is no longer simply about making something desirable, functional and manufacturable.

It is also about designing something that can be responsibly supported long after the first one leaves the production line.

If you are developing a connected product and want to explore the design, engineering and commercial decisions that need to be made before development begins, book a product strategy call with ITERATE: https://iterate-uk.com/product-strategy-call/