Nordic Semiconductor launches a lifetime flat-rate FOTA solution to help IoT manufacturers meet the 2027 EU Cyber Resilience Act mandates.
Why FOTA Is Now a Compliance Requirement
Firmware over the air (FOTA) is no longer a nice-to-have for connected products. The EU Cyber Resilience Act expects manufacturers to keep devices secure after they ship, which means they need a reliable way to deliver patches, revoke weak defaults, and close newly found flaws without recalling hardware. For battery-powered and constrained IoT nodes, that update path has to work over limited bandwidth, survive interrupted transfers, and leave the device in a known-good state if something fails mid-write.
Nordic Semiconductor’s lifetime flat-rate FOTA offering is aimed at that exact problem: giving product teams a predictable way to push firmware for as long as the device is in the field, rather than treating updates as a one-time launch feature. Meeting a 2027 compliance deadline is less about a single release and more about proving you can maintain the product for years after the first customer unboxes it.
What a Lifetime Flat-Rate Model Changes for Product Teams
Traditional update pipelines often hide cost and complexity in the wrong places. You pay for cloud storage, device certificates, queueing, and retries; you also absorb engineering time every time the modem stack, crypto library, or bootloader needs a fix. A flat-rate, lifetime-style FOTA arrangement shifts planning from “how many updates can we afford this year?” to “how do we design so every shipped unit can receive the updates it will need?”
That matters for bill-of-materials and total cost of ownership. If update capacity is capped or billed per campaign, teams delay non-urgent security work or ship SKUs that cannot be patched after a certain date. A model priced for the device’s useful life encourages the opposite: smaller, more frequent firmware releases, better telemetry on failure rates, and a clearer story for auditors who ask how long you will support a given hardware revision.
Design Choices That Make CRA-Ready FOTA Work
Compliance is not only “can we push a binary?” It is whether the whole update chain is trustworthy and operable at scale. Practical designs usually share a few traits:
- Signed images and a secure boot path so only authorized firmware runs.
- Dual-bank or A/B slots (or an equivalent recovery partition) so a bad image does not brick the fleet.
- Resume and integrity checks so flaky links do not corrupt flash.
- Version and rollback policy so support can reason about what is deployed where.
- Staging by cohort so you never roll a risky build to every device on day one.
Nordic’s platform focus—low-power wireless SoCs used widely in IoT—makes these constraints familiar: keep the transfer small, keep radio time short, and keep the device fail-safe. A managed FOTA service that lasts for the product’s life is most useful when your firmware pipeline already produces signed, differential or slot-aware builds and when manufacturing can provision each unit with unique credentials rather than a shared key baked into every board.
How to Use This Toward 2027 Without Overbuilding
Start from the devices you will still be selling or supporting when the Cyber Resilience Act obligations fully apply. Map each SKU to an update channel, a support window, and a minimum security baseline (crypto, bootloader, default credentials). Treat the flat-rate FOTA capability as the delivery rail; the work that still belongs to you is firmware quality, vulnerability response, and the operational runbooks for staged rollout and emergency patching.
Then close the loop between engineering and compliance. Document how a customer or regulator would verify that updates are available, how you authenticate the update source, and what happens when a device is offline for months. Lifetime update economics only help if you actually ship the patches. The manufacturers who will be ready for 2027 are the ones who treat FOTA as part of the product definition—bootloader, keys, and service plan included—not as a feature added after certification paperwork is already due.