| Scope boundary | CRA applies to products with digital elements made available on the Union market, including software, hardware, and covered remote data-processing solutions necessary for product functions, subject to CRA exclusions and special rules. | Treat UK PSTI scope as a separate UK-law question. The available sources support consumer IoT baseline context through ETSI EN 303 645, but they do not establish the legal PSTI scope. | A connected product can need both workstreams, but do not use a CRA in-scope decision as proof of UK PSTI coverage or a UK consumer IoT baseline as proof of CRA coverage. |
|---|
| Covered actors | CRA requires manufacturers to address Annex I product security properties and vulnerability-handling requirements, including secure development, vulnerability remediation, security updates, component documentation, and user information. | For UK PSTI planning, compare only high-confidence product-security themes until UK sources are reviewed: password design, vulnerability reporting, software-update support, and consumer-facing security information. | One engineering control can support both programs, but the CRA obligation map should cite Annex I and the UK PSTI obligation map should wait for UK primary-source confirmation. |
|---|
| Trigger | CRA evidence should include the cybersecurity risk assessment, Annex I mapping, vulnerability-handling process, SBOM or component records where applicable, support-period rationale, test reports, technical documentation, EU declaration of conformity, and CE marking records. | UK PSTI evidence should be held as a separate workstream. Exact statement content, responsible actor checks, product information records, and enforcement evidence are blocked until UK PSTI sources are reviewed. | Reuse control evidence only after labeling which facts prove CRA compliance and which facts still need UK PSTI source support. |
|---|
| Core obligations | CRA Chapter IV applies from 11 June 2026, Article 14 reporting applies from 11 September 2026, and the Regulation applies in full from 11 December 2027. | UK PSTI timing is not grounded by the available CRA source set. Do not publish or rely on UK PSTI start dates, transition dates, response windows, or enforcement dates from this page. | Use CRA dates for EU planning only. Add a separate UK PSTI calendar after primary UK sources confirm the relevant dates and clocks. |
|---|
| Evidence record | CRA conformity work can lead to EU declaration of conformity and CE marking for covered products with digital elements that satisfy the applicable requirements. | UK PSTI should not be described as CE marking or CRA-style conformity assessment without UK-source support. Keep any UK product statement or labeling conclusion separate. | A CE mark or CRA declaration should not be presented as evidence that UK PSTI legal obligations have been met. |
|---|
| Timing and deadlines | CRA enforcement can involve market-surveillance authorities, corrective action, restriction or withdrawal of products, and administrative fines under the CRA enforcement framework. | UK PSTI enforcement notices, penalties, powers, thresholds, and limitation periods are not grounded here and should not be stated without UK primary sources. | Escalate EU risk using CRA market-surveillance and penalties provisions; open a separate UK legal review before describing UK enforcement exposure. |
|---|
| Enforcement | Use CRA sources when the decision turns on EU scope, Annex I requirements, vulnerability handling, support period, Article 14 reporting, technical documentation, conformity assessment, EU declaration of conformity, CE marking, or CRA enforcement. | Use UK PSTI sources, not this CRA-grounded page alone, when the decision turns on exact UK product scope, statutory security requirements, statements, dates, responsible actors, penalties, or enforcement powers. | The safest dual-market answer is usually: build shared product-security controls, then issue separate EU CRA and UK PSTI conclusions with separate citations. |
|---|
| Overlap and reuse | CRA applies to products with digital elements made available on the Union market, including software, hardware, and covered remote data-processing solutions necessary for product functions, subject to CRA exclusions and special rules. | Treat UK PSTI scope as a separate UK-law question. The available sources support consumer IoT baseline context through ETSI EN 303 645, but they do not establish the legal PSTI scope. | A connected product can need both workstreams, but do not use a CRA in-scope decision as proof of UK PSTI coverage or a UK consumer IoT baseline as proof of CRA coverage. |
|---|
| Practical decision rule | CRA applies to products with digital elements made available on the Union market, including software, hardware, and covered remote data-processing solutions necessary for product functions, subject to CRA exclusions and special rules. | Treat UK PSTI scope as a separate UK-law question. The available sources support consumer IoT baseline context through ETSI EN 303 645, but they do not establish the legal PSTI scope. | A connected product can need both workstreams, but do not use a CRA in-scope decision as proof of UK PSTI coverage or a UK consumer IoT baseline as proof of CRA coverage. |
|---|