The All4 app on my 'smart' TV stopped working because the All4 server's GeoLocation code doesn't believe my IP address is in the UK any more, and no-one is taking responsibility to fix it.

Should've bought a dumb screen. The channel 4 website runs in a browser as do lots of "Fake my location" plug-ins.

This is why we have to have laws to enforce security, because otherwise people just buy any old shit.

But at least you might reasonably expect it to work for a TV genuinely located in the UK?

Sale of Goods act should apply, demand a replacement as not of sale quality and not fit for purpose.

And it works also for Humans.

== Bring us Dabbsy back! ==

..the desire to protect citizens, but who is going to want to launch a new tech product in Europe when the slightest mistake could result in a painful legal battle and fine?

Startups will go to America where "move fast and break things" works. Products will be launched where early fixes and revisions are tolerated, and maybe taken to Europe a few years later. Maybe.

Mistakes are allowed. You just need to fix them and provide updates in a reasonable time period. No company that does this will have to worry. Those selling junk that is insecure and unmaintained will not be in business for long.

Plenty of people will continue to launch and release products in Europe as it is a massive market that has money to spend. Equally of all the cheap and disposable junk stops being sold and nobody wants to ship new products to Europe then European businesses will launch their own products to fill the gaps. You do realise that plenty of products are designed and manufactured in Europe?

"Are designed and manufactured in Europe", or "Were designed and manufactured in Europe"?

I jest, but when you're a startup, there is not much of a line between cheap and disposable junk, and the next great innovation. You launch a product hoping you can get through the next three months whilst you figure out what needs to change, not committing to supporting that exact first revision for five years.

Clearly from your response you believe companies can magically afford to commit to a five year product support cycle when developing something new. I don't think that's true, and I suspect it's just going to cause more companies to close down early to avoid being dragged into legal battles. Or not launch in Europe in the first place.

This is not about the good intentions or otherwise of product developers, this is about the financial and legal realities of developing new products, which in the current economic environment means making pragmatic decisions about what and where you launch.

Startups depending on making money from a first version of their product that is likely defective will already have a hard time if they sell to consumers here.

They are liable for defects for 3 years and can choose to either repair or replace with a working version at their cost and if unable to do either in a reasonable time they have to refund the full price.

Many companies, in the smart devices startup arena, avoid this problem by recalling all the previous sales and substituting the old faulty version with an updated version.

Those selling junk that is insecure and unmaintained will not be in business for long.

Little in recent history suggests that is true. They'll just rebrand, hiding behind shell corporations, and continue to sell their tat directly via Alibaba and eBay.

It is rather better to have a limited quantity of quality, than a mess of total crap, as we have at the moment.

The problem is, you're trusting unseen bureaucrats to set the criteria for "quality products".

As I say, I can understand people wanting someone in power to make everything safe and reliable. But it's ridiculous to believe they have the power to do so, and there won't be unforeseen consequences in an industry that relies on innovation and experimentation.

It is aimed as a barrier of entry to stop the dumping into EU of shitty smart devices by cheap Chinese manufacturers, be it by direct export or repackaging the electronics with non value added importers in EU.

who is going to want to launch a new tech product in Europe when the slightest mistake could result in a painful legal battle and fine?

I hope we can tag Windows too as code attached to a device and fine the screaming cr*p out of Microsoft for providing code that other companies would not even dare release as alpha level dev test, but I know for a fact that especially in the country I live there is absolutely no chance of that.

..the desire to protect citizens, but who is going to want to launch a new tech product in Europe when the slightest mistake could result in a painful legal battle and fine? Reducing the amount of IoTrash out there, reducing the ability to just release the next buggy, insecure, unsupported, thoughtlessly designed and implemented and just overall shitty piece of IoTrash is a feature, not a bug.

The fact sheet gives an obligation of the expected lifetime or five years. Who decides that lifetime?

Also, it's "whichever is the shorter". It certainly seems ridiculous for a car manufacturer to have no requirement for what is in practice more than half the lifetime of a car.

While a car is probably the most extreme example, similar can probably be said for many products.

Cars are excluded as they are regulated separately.

This is a starting point. It will most likely be expanded over time. It is a good thing that suppliers will be expected to ensure products are secure for a reasonable time period.

We can expect products whose cyber security warranty will be void when connected to the Internet. Like some smartphones advertised waterproof whose warranty will not cover water damage. So everybody don’t worry, cheap crap will continue to flow into EU.

Should also be a rule that all devices should be either allowed to work offline so when they close the servers, all kit doesn't become useless. And would allow those who know to setup their own local or cloud based servers that they can point the device to.

Not sure that's technically or practically possible.

If my Magic Doohickey synchronises with my Phone using some discoverable server in a vendor specific cloud, there is no easy answer when the discoverable server stops existing.

"Sorry, we have failed as a company - here are the instructions for installing Couchbase, twenty microservices, an SMS relay and a proprietary speech to text tool we depend on. Also, here is the source code that we spent a million euros developing."

Which are supposed (in the UK) to have a 15 yr life, as opposed to the 40 years of "dumb" meters (before they are re-certified and can be reused)

OTOH the head of IT for a certain US energy company (in Congressional testimony) said they are computers, with a lifespan of about 7yrs before they need replacing.

But these are UK smart meters, which will be a special order.

Yeah. Right.

Still good start for the rest. And I do like the "Offline mode required" so if (when) the company goes TITSUP the product has some usability.

Quote #1: "The Act provides infosec requirements that must be met before products can reach Europe's markets, some covering their design, development and production."

Quote #2: "....having already led the world with the General Data Protection Regulation (GDPR)...."

Quote #2 first........The Royal Free Trust allowed Google/DeepMind to slurp 1.6 million personal medical records...not one single citizen was asked for their consent as required by GDPR. No penalties (yet) for the Royal Free or Google. So much for enforcement of GDPR.

Quote #1.....Now we get this suggestion that someone (unnamed) will be certifying the business processes inside device manufacturing companies. Really?? ......there are thousands of such manufacturers, many (most) of them in China. Not possible!!

Both laws have almost no possibility of enforcement. Both are simply government marketing of the sort -- "Someone is doing something". Like GDPR this latest suggestion is a joke.