EU Cyber Resilience Act Puts Cheap Wireless Mice Under Pressure

What the rules actually require

The CRA does not mandate encryption of every radio link. It requires protecting the confidentiality and integrity of data, guarding against unauthorised access and limiting the risk of exploited vulnerabilities. Encryption is one way to get there, but the exact measures depend on a risk assessment.

The risk is real. In 2016 researchers at Bastille disclosed the MouseJack vulnerabilities, in which some wireless devices accepted forged commands that a computer read as keystrokes, from up to 100 metres away. Secure links already exist, for example Logitech's Logi Bolt.

Manufacturers must also document risks, handle reported vulnerabilities and provide security support, generally for at least five years unless a shorter expected product lifetime is justified. Rules on reporting serious incidents and actively exploited vulnerabilities have applied since 11 September 2026.

Costs, not encryption, are the real issue

Large makers can extend existing processes, but small firms selling cheap mice built on off-the-shelf controllers and subcontracted firmware may struggle. An ENISA survey of 194 organisations published in June 2026 found that 66% had heard of the CRA, yet 142 said they needed financial help to prepare. It was not limited to peripheral makers.

Older mice will not be pulled from shops after 11 December 2027. Units placed on the EU market earlier generally need not meet the new design requirements unless substantially modified, though reporting duties still apply to them. Newly placed units must comply even if the design is older.

The likely outcomes are higher prices, fewer ultra-cheap models or more interest in wired designs. Wireless mice are not going away, but the rules for designing and selling them are changing.