Matter 1.6 arrives: NFC setup, Joint Fabric and a security baseline for smart home devices

The Connectivity Standards Alliance (CSA) has released Matter 1.6 together with a new version of its Product Security specification. Neither is a flashy feature drop for gadget fans, but both address real irritations in the connected home: stickers hidden behind lampshades, platforms that fight over who is in charge, and cheap devices with no thought given to security.

What is new in Matter 1.6

• NFC setup before power-on. A device can be commissioned by tapping it with a phone before it has any power. The CSA’s example is a light bulb that you can add to your home before screwing it into the socket, which avoids the classic problem of a QR code that is hidden once the product is installed.
• Joint Fabric. An extension of multi-admin that lets several user-authorised controllers co-administer a single shared Matter network. It is aimed at new-build handovers, households that mix platforms and professionally managed properties.
• Thermostat Suggestions. A thermostat can weigh a command from another device against the owner’s preferences instead of obeying blindly. A thermostat set to favour energy saving could, for example, decline an automation that would override that choice.
• Smarter certificate revocation. Matter already supports certificate revocation lists (CRLs), which let the ecosystem block compromised or misbehaving devices. Version 1.6 allows a CRL to be split into smaller chunks that update independently, which should help the system scale as the number of certified devices grows.

Product Security 1.1: a baseline for manufacturers

The Product Security specification is designed to pull several international cybersecurity standards into one baseline, so manufacturers can show a minimum level of security without juggling different national schemes. Version 1.1 introduces two assessment levels:

• Level 1: a self-assessment by the supplier, reviewed by an Authorised Test Laboratory (ATL).
• Level 2: an independent assessment and functional testing carried out by an ATL.

The requirements include unique passwords for every device, protection against brute-force attacks, no critical security parameters hard-coded in the source code, modern cryptography, support for erasing user data, removal of unused or test interfaces, input validation, and verified, automatic software updates. For anyone who remembers the default-password era of IP cameras, that is a welcome list.

Matter, Thread and Zigbee: how they fit together

The CSA’s retailer guide is a useful reminder of how the pieces relate. Matter is the language devices use to talk to each other; Thread is a low-power wireless mesh network that Matter can run over, alongside Wi-Fi and Ethernet. Thread devices reach your home network through a Thread Border Router, often built into smart speakers, hubs and routers, and always-powered Thread devices act as mesh extenders that strengthen the network.

And Zigbee? Thread and Zigbee use the same 802.15.4 radio technology, and Matter’s data model borrows heavily from the Zigbee Cluster Library, but they are different protocols with no native interoperability. Instead, Matter defines bridges so that existing Zigbee (and Z-Wave) devices can appear in a Matter ecosystem. If you already own a lot of Zigbee sensors and bulbs, there is no need to replace them: a bridge, or a hub with one built in, is the route to Matter.

Setup normally uses a QR or numeric code and Bluetooth Low Energy, with NFC as an option, and multi-admin lets you share one device across several platforms while choosing which apps can control it. Matter-only devices still need a home controller, such as a speaker or hub, for remote access when you are away.

What it means for your home

• Nothing breaks. Matter 1.6 is a specification: devices and platforms adopt it at their own pace through firmware and app updates, so expect features to arrive gradually through 2026 and 2027.
• Home Assistant users already benefit from the platform’s fast Matter updates. The new Matter server we covered recently is the part that will need to support new device features as they appear.
• Look for the security label. Over time, a Product Security certification on the box should become a useful tiebreaker between two otherwise identical smart plugs or sensors, particularly in the UK where the PSTI Act already requires basic security for connected products.
• Multi-admin gets easier. If you share a home between iPhone and Android users, or run Home Assistant alongside a manufacturer’s own app, Joint Fabric is designed to make that coexistence less fragile.

Our take

Matter 1.6 is evolutionary, and that is fine. The NFC setup and Joint Fabric work fix everyday pain points, while Product Security 1.1 is the quiet but important piece: a smart home is only as trustworthy as its least secure device. We will test the first 1.6 devices as soon as they reach UK shops.

Source: Privacy Guides, summarising the CSA announcement of June 2026.