“Local first” means that lights, heating and access control work even without internet and that data stays at home or on site, with the cloud only as an option. This is the principle stated by the Open Home Foundation: devices must work locally, use open standards and outlast the commercial life of the product.
The stack in brief
- Home Assistant: version 2026.9 of 2 September 2026 (patch 2026.9.4 of 27 September); a stable release on the first Wednesday of every month. 2026.9 adds a Matter network map and an MQTT panel. Source: release notes.
- Matter: the current specification is 1.6, announced on 17 June 2026 (commissioning via NFC, Joint Fabric). In Home Assistant, Matter devices work locally over Wi-Fi, Thread or Ethernet, and IPv6 and mDNS are required. Source: CSA and Matter integration.
- MQTT 5 with Mosquitto: MQTT 5.0 has been an OASIS standard since 2019; Mosquitto 2.1.2 (9 February 2026) is the broker recommended by Home Assistant, which requires a broker with MQTT 5 for the MQTT integration. Source: MQTT integration and Mosquitto website.
Recommended architecture
- A separate device network (VLAN) from the main network, with explicit access rules.
- A local broker with TLS and authentication for every client.
- Home Assistant (and Node-RED for flows) on your own hardware, with automatic backup.
- Remote access only through a VPN or an encrypted channel, never with ports opened directly.
- Optional cloud only for the functions that need it.
Practical security
The ETSI EN 303 645 standard (version 3.1.3, September 2024) sets out 13 baseline requirements for consumer IoT, including: no universal default passwords, software updates, securely stored credentials, protected communications, a minimised attack surface, resilience to network outages and deletion of data. They are a good checklist also for those choosing devices.
The Cyber Resilience Act
Regulation (EU) 2024/2847 has been in force since 10 December 2024. Reporting obligations for manufacturers start on 11 September 2026: actively exploited vulnerabilities and severe incidents with an early warning within 24 hours and a notification within 72. Full application is from 11 December 2027. It covers products with digital elements placed on the market in the course of commercial activity. Source: Commission summary.
It does not apply to a private installation; for those who integrate and resell products, it should be assessed case by case with legal advice. For those choosing devices, the practical advice is to prefer products with declared support and updates.
Purchase checklist
- Does it work without the manufacturer’s cloud?
- Does it use open standards (Matter, MQTT, Zigbee)?
- Is an update period declared?
- Is the password unique or must it be changed at first start-up?
- Can the data be deleted and backed up?
What has not been verified
The date of the next Home Assistant version, Mosquitto releases after 2.1.2, the exact wording of the MQTT 5 requirement and the value of EN 303 645 as a presumption of conformity with the CRA are not confirmed.
To design or secure a system, see Home automation and IoT.