Cyber Resilience Act comparison CRA vs UK PSTI Act
Use separate scope tests and legal evidence for the EU CRA and the UK PSTI product-security regime, even when the same engineering controls support both.
The UK regime has applied since 29 April 2024 to relevant UK consumer connectable products. Most CRA product duties apply from 11 December 2027, with Article 14 reporting from 11 September 2026.
The EU Cyber Resilience Act (CRA) and the UK Product Security and Telecommunications Infrastructure (PSTI) product-security regime can both apply to one connected product, but they answer different legal questions. The CRA broadly covers products with digital elements made available on the EU market and imposes lifecycle, conformity, support, vulnerability-handling, and reporting duties. The UK regime applies to relevant connectable products made available to UK consumers, subject to statutory scope conditions and excepted products. It currently specifies three baseline security requirements, requires a to accompany the product, and gives manufacturers, importers, and distributors separate supply-chain duties.
Side-by-side comparison
EU CRA vs UK PSTI product-security regime
Use the matrix to separate product scope, actors, security duties, evidence, dates, and enforcement before reusing technical controls across the EU and UK.
CRA applies to products with digital elements made available on the Union market, including software, hardware, and covered remote data-processing solutions necessary for product functions, subject to CRA exclusions and special rules.
Covers a relevant connectable product that meets the UK consumer conditions in section 54. A relevant connectable product is an internet-connectable or network-connectable product that is not an excepted product.
Run both tests. CRA can cover non-consumer software and hardware outside PSTI scope; PSTI turns on statutory connectability, UK consumer-market facts, and listed exceptions.
CRA requires manufacturers to address Annex I product security properties and vulnerability-handling requirements, including secure development, vulnerability remediation, security updates, component documentation, and user information.
Manufacturers must meet the applicable security requirements and statement duties. Importers and distributors have their own duties, including checking that the required statement accompanies the product and responding to compliance failures.
Map the legal entity and role in each market. Shared corporate ownership does not make the EU manufacturer, EU importer, UK manufacturer, and UK importer the same legal actor.
CRA evidence should include the cybersecurity risk assessment, Annex I mapping, vulnerability-handling process, SBOM or component records where applicable, support-period rationale, test reports, technical documentation, EU declaration of conformity, and CE marking records.
The current specified requirements cover passwords, publication of a vulnerability-reporting route and response times, and publication of a minimum security-update period with an end date. A must accompany the product unless a valid deemed-compliance route applies.
Reuse test and process evidence only after mapping it to the exact CRA requirement and UK Schedule 1 requirement. Keep the CRA conformity artifacts and UK separate.
CRA Chapter IV applies from 11 June 2026, Article 14 reporting applies from 11 September 2026, and the Regulation applies in full from 11 December 2027.
The UK product-security regime came into force on 29 April 2024. The 2025 vehicle exceptions took effect on 25 February 2025, and further deemed-compliance amendments took effect on 4 December 2025.
Use 29 April 2024 for current UK supply decisions. Use the CRA's staged dates only for EU duties, and check later UK amendments when relying on an exception or deemed-compliance route.
CRA conformity work can lead to EU declaration of conformity and CE marking for covered products with digital elements that satisfy the applicable requirements.
The manufacturer prepares a containing the prescribed information and stating its opinion that it complied with the applicable security requirements. Unless a valid statutory deemed-compliance route applies, the statement must accompany the product; manufacturers and importers retain it for the longer of 10 years or the defined support period.
CRA enforcement can involve market-surveillance authorities, corrective action, restriction or withdrawal of products, and administrative fines under the CRA enforcement framework.
OPSS can use information, compliance, stop, and recall measures and monetary penalties. The statutory penalty maximum is the greater of GBP 10 million and 4% of qualifying worldwide revenue, subject to the Act's calculation rules.
Use CRA sources when the decision turns on EU scope, Annex I requirements, vulnerability handling, support period, Article 14 reporting, technical documentation, conformity assessment, EU declaration of conformity, CE marking, or CRA enforcement.
Use the PSTI Act, the revised 2023 Regulations, and current OPSS or DSIT guidance for UK scope, requirements, statements, actors, dates, penalties, and enforcement powers.
Build shared product-security controls, then issue separate EU CRA and UK PSTI conclusions with their own evidence indexes, responsible actors, and release gates.
CRA applies to products with digital elements made available on the Union market, including software, hardware, and covered remote data-processing solutions necessary for product functions, subject to CRA exclusions and special rules.
PSTI overlaps technically through credentials, vulnerability reporting, and update-support information, but its current statutory baseline is narrower than the CRA lifecycle and conformity framework.
Reuse a control only where the evidence satisfies both mapped requirements. Do not infer PSTI scope from CRA scope, infer CRA conformity from the three UK requirements, or use either regime's declaration as the other's legal artifact.
CRA applies to products with digital elements made available on the Union market, including software, hardware, and covered remote data-processing solutions necessary for product functions, subject to CRA exclusions and special rules.
If the item is a relevant connectable product, apply the section 54 UK consumer test and Schedule 3 exceptions. Then identify the manufacturer, importer, distributor, security requirements, accompanying statement, retention, and compliance-failure duties.
CRA applies to products with digital elements made available on the Union market, including software, hardware, and covered remote data-processing solutions necessary for product functions, subject to CRA exclusions and special rules.
Covers a relevant connectable product that meets the UK consumer conditions in section 54. A relevant connectable product is an internet-connectable or network-connectable product that is not an excepted product.
Run both tests. CRA can cover non-consumer software and hardware outside PSTI scope; PSTI turns on statutory connectability, UK consumer-market facts, and listed exceptions.
CRA requires manufacturers to address Annex I product security properties and vulnerability-handling requirements, including secure development, vulnerability remediation, security updates, component documentation, and user information.
Manufacturers must meet the applicable security requirements and statement duties. Importers and distributors have their own duties, including checking that the required statement accompanies the product and responding to compliance failures.
Map the legal entity and role in each market. Shared corporate ownership does not make the EU manufacturer, EU importer, UK manufacturer, and UK importer the same legal actor.
CRA evidence should include the cybersecurity risk assessment, Annex I mapping, vulnerability-handling process, SBOM or component records where applicable, support-period rationale, test reports, technical documentation, EU declaration of conformity, and CE marking records.
The current specified requirements cover passwords, publication of a vulnerability-reporting route and response times, and publication of a minimum security-update period with an end date. A must accompany the product unless a valid deemed-compliance route applies.
Reuse test and process evidence only after mapping it to the exact CRA requirement and UK Schedule 1 requirement. Keep the CRA conformity artifacts and UK separate.
CRA Chapter IV applies from 11 June 2026, Article 14 reporting applies from 11 September 2026, and the Regulation applies in full from 11 December 2027.
The UK product-security regime came into force on 29 April 2024. The 2025 vehicle exceptions took effect on 25 February 2025, and further deemed-compliance amendments took effect on 4 December 2025.
Use 29 April 2024 for current UK supply decisions. Use the CRA's staged dates only for EU duties, and check later UK amendments when relying on an exception or deemed-compliance route.
CRA conformity work can lead to EU declaration of conformity and CE marking for covered products with digital elements that satisfy the applicable requirements.
The manufacturer prepares a containing the prescribed information and stating its opinion that it complied with the applicable security requirements. Unless a valid statutory deemed-compliance route applies, the statement must accompany the product; manufacturers and importers retain it for the longer of 10 years or the defined support period.
CRA enforcement can involve market-surveillance authorities, corrective action, restriction or withdrawal of products, and administrative fines under the CRA enforcement framework.
OPSS can use information, compliance, stop, and recall measures and monetary penalties. The statutory penalty maximum is the greater of GBP 10 million and 4% of qualifying worldwide revenue, subject to the Act's calculation rules.
Use CRA sources when the decision turns on EU scope, Annex I requirements, vulnerability handling, support period, Article 14 reporting, technical documentation, conformity assessment, EU declaration of conformity, CE marking, or CRA enforcement.
Use the PSTI Act, the revised 2023 Regulations, and current OPSS or DSIT guidance for UK scope, requirements, statements, actors, dates, penalties, and enforcement powers.
Build shared product-security controls, then issue separate EU CRA and UK PSTI conclusions with their own evidence indexes, responsible actors, and release gates.
CRA applies to products with digital elements made available on the Union market, including software, hardware, and covered remote data-processing solutions necessary for product functions, subject to CRA exclusions and special rules.
PSTI overlaps technically through credentials, vulnerability reporting, and update-support information, but its current statutory baseline is narrower than the CRA lifecycle and conformity framework.
Reuse a control only where the evidence satisfies both mapped requirements. Do not infer PSTI scope from CRA scope, infer CRA conformity from the three UK requirements, or use either regime's declaration as the other's legal artifact.
CRA applies to products with digital elements made available on the Union market, including software, hardware, and covered remote data-processing solutions necessary for product functions, subject to CRA exclusions and special rules.
If the item is a relevant connectable product, apply the section 54 UK consumer test and Schedule 3 exceptions. Then identify the manufacturer, importer, distributor, security requirements, accompanying statement, retention, and compliance-failure duties.
Use the CRA column as the cited EU work plan for products with digital elements.
Use the UK PSTI column to test connectability, UK consumer-market status, exceptions, actors, the three specified requirements, the , and supply-chain duties.
Reuse engineering controls where they genuinely overlap: credentials, vulnerability disclosure, updates, secure configuration, dependency tracking, and support-period communication.
Keep the CRA technical documentation and declaration separate from the UK , even where both cite the same test or control evidence.
For the CRA, ask whether a software or hardware product, separately placed component, or necessary remote data-processing solution is a product with digital elements made available on the Union market. Then check the CRA's exclusions and special rules. A consumer purpose or internet connection is not required in every CRA case.
For UK PSTI, ask whether the item is an internet-connectable or network-connectable product under sections 4 and 5 of the Act, whether it is or will be a under section 54, and whether Schedule 3 to the 2023 Regulations excepts it. The government guidance lists medical devices, smart meter products, electric-vehicle charge points, certain computers without cellular connectivity, specified Northern Ireland supplies, and, since 25 February 2025, specified vehicle categories among the exclusions or exceptions. Apply the exact legal conditions rather than relying on those labels alone.
A business-only product can still be a when identical products are also made available to UK consumers and the section 54 conditions are met.
A general-purpose software product may enter CRA scope but not UK PSTI scope because the UK definition turns on a connectable product and the consumer-market conditions.
A cellular tablet or a computer designed exclusively for children under 14 does not fall within the specific non-cellular computer exception described in the UK guidance.
Record the scope conclusion, excluded-product analysis, intended markets, and first supply or market-placement facts for each product.
Recommended next step
Separate CRA evidence from UK PSTI evidence
Use separate scope decisions, actor maps, and evidence indexes for the EU CRA and UK PSTI regime, then link any shared test or control to the requirement it supports in each market.
A CRA manufacturer must connect its cybersecurity risk assessment to the Annex I product-security and vulnerability-handling requirements, establish a support period, prepare technical documentation, complete the applicable conformity assessment, issue an EU declaration of conformity, affix CE marking, provide required user information, and meet the CRA's reporting and cooperation duties.
A UK PSTI manufacturer must meet the applicable Schedule 1 security requirements. Passwords must meet the specified unique-per-product or user-defined rules. The manufacturer must publish, free of charge and without prior request, clear English information on how to report security issues and the expected acknowledgement and status-update times. It must also publish the minimum security-update period, including an end date, in clear English that a non-technical reader can understand.
Before making an in-scope product available in the UK, the manufacturer must ensure that a accompanies it. The statement records the Schedule 4 information and the manufacturer's opinion that it complied with the applicable security requirements. It may be digital if it still accompanies the product and meets the legal requirements. The 2025 amendments also created specified deemed-compliance routes, so teams using one must document the exact conditions rather than assume that any certification replaces the statement.
CRA evidence: risk assessment, Annex I mapping, vulnerability-handling records, component information including an SBOM where required, support-period rationale, tests, technical documentation, conformity decision, declaration, CE marking, and Article 14 reporting process.
UK PSTI evidence: product-scope analysis, Schedule 1 control evidence, published vulnerability-reporting information, published security-update end date, , supply-chain checks, and records of any compliance failure and response.
UK statement retention: manufacturers and importers keep a copy for the longer of 10 years from issue or the defined support period.
Do not state that the UK rules require security updates for a fixed statutory minimum duration. They require the manufacturer to define and publish the minimum period; other legal or contractual duties may affect what duration is adequate.
3
Section 3
Supply-chain and enforcement differences
Both regimes assign duties beyond the manufacturer, but the checks and documents differ. CRA importers and distributors verify specified CRA conformity and traceability matters and must respond to suspected non-conformity. Under PSTI, importers and distributors must not make an in-scope product available unless the required statement accompanies it; the Act also sets investigation, notification, remediation, prevention, and record duties for compliance failures.
EU market-surveillance authorities enforce the CRA. In the UK, the Office for Product Safety and Standards (OPSS) enforces the PSTI product-security regime. UK powers include compliance, stop, and recall notices, information requirements, and monetary penalties. The statutory maximum for a penalty is the greater of GBP 10 million and 4% of qualifying worldwide revenue, subject to the Act's calculation rules; that is a maximum, not an automatic fine.
Share technical evidence for credentials, vulnerability intake, update delivery, secure configuration, dependency tracking, and support commitments where it proves the relevant requirement.
Keep legal outputs separate: a CRA technical file, EU declaration, and CE mark do not replace the UK .
Keep incident and defect workflows separate: CRA Article 14 notifications follow the CRA triggers and reporting platform, while PSTI compliance-failure duties follow the UK Act.
Name the manufacturer, importer, distributor, and any authorised representative for each market; do not assume that one entity has the same legal role in both regimes.
4
Section 4
Practical dual-market approach
Start with one product-security baseline, then create separate EU and UK evidence indexes. Shared tests can reduce duplicate engineering work, but every legal conclusion must point to the correct instrument and actor.
The UK regime has applied since 29 April 2024. CRA Article 14 reporting applies from 11 September 2026, and most CRA product and conformity duties apply from 11 December 2027. Apply the dates to the actual supply or market-placement event rather than to the model's original launch date.
Create one security-control register for credentials, updates, vulnerability disclosure, secure configuration, dependency tracking, and support commitments.
Create a CRA evidence index for Annex I mappings, support-period rationale, SBOM or dependency evidence, test results, technical documentation, conformity documents, and reporting readiness.
Create a UK PSTI evidence index for scope, exceptions, actor roles, password design, vulnerability-reporting publication, security-update end date, , retention, and compliance-failure handling.
Release to each market only after that market's scope, actor, date, evidence, and accompanying-document checks are complete.
Binding source for manufacturer, importer, distributor, authorised-representative, statement, investigation, notification, remediation, and record duties.