Just got forwarded this link to a proposed IoT device end-of-life law for the US:

The proposed Connected Consumer Product End of Life Disclosure law addresses these growing risks by raising the bar for smart device manufactures and Internet service providers. Among other mandates, the law requires smart device manufacturers to:

 

 

• Clearly disclose the minimum guaranteed support time frames for products during which the manufacturer will provide security and software updates by placing that date on the product package and/or disclosing that information at the point of sale.  
• Proactively notify consumers when their connected consumer products will lose support
• Provide information to customers as to how they should handle the connected consumer product’s end of life. 
• Notify device owners about the end of product support, providing a list of features lost, and vulnerabilities and security risks that are likely to result from the end of support.
• Provide device owners with clear information about actions they can take if they want to continue using the product in a secure manner

The law also addresses the problem of smart, connected devices that are no longer supported, but that remain Internet connected, making them easy prey for hackers.

Since it's the US it has zero chance of passing but it'd be nice to have NZ adopt something like it.