Cyber Resilience Act comparison CRA vs UK PSTI Act

For the CRA, ask whether a software or hardware product, separately placed component, or necessary remote data-processing solution is a product with digital elements made available on the Union market whose intended purpose or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. Then check the CRA's exclusions and special rules. A consumer purpose or internet connection is not required in every CRA case.

For UK PSTI, ask whether the item is an internet-connectable or network-connectable product under sections 4 and 5 of the Act, whether it is or will be a UK consumer connectable product under section 54, and whether Schedule 3 to the 2023 Regulations excepts it. The government guidance lists medical devices, smart meter products, electric-vehicle charge points, certain computers without cellular connectivity, specified Northern Ireland supplies, and, since 25 February 2025, specified vehicle categories among the exclusions or exceptions. Apply the exact legal conditions rather than relying on those labels alone.

A CRA manufacturer must connect its cybersecurity risk assessment to the Annex I product-security and vulnerability-handling requirements, establish a support period, prepare technical documentation, complete the applicable conformity assessment, issue an EU declaration of conformity, affix CE marking, provide required user information, and meet the CRA's reporting and cooperation duties.

A UK PSTI manufacturer must meet the applicable Schedule 1 security requirements. Passwords must meet the specified unique-per-product or user-defined rules. The manufacturer must publish, free of charge and without prior request, clear English information on how to report security issues and the expected acknowledgement and status-update times. It must also publish the minimum security-update period, including an end date, in clear English that a non-technical reader can understand.

Before making an in-scope product available in the UK, the manufacturer generally must ensure that a statement of compliance accompanies it. The statement contains the Schedule 4 information and may be digital if it still accompanies the product and meets the legal requirements. Schedule 2 provides routes for deemed compliance with the security requirements; using one does not by itself remove the statement duty. Regulation 4A and Schedule 2A separately treat section 9(2) as met when the product has a current, unexpired Japan JC-STAR STAR-1 conformance label or a current, unexpired label at any level of the Singapore Cybersecurity Labelling Scheme. Importers and distributors relying on that route must be satisfied that its conditions are met under sections 15(5) and 22(3).

Both regimes assign duties beyond the manufacturer, but the checks and documents differ. CRA importers and distributors verify specified CRA conformity and traceability matters and must respond to suspected non-conformity. Under PSTI, importers and distributors generally must not make an in-scope product available unless the required statement accompanies it. Under sections 15(5) and 22(3), where the Schedule 2A route applies, they must instead be satisfied that its conditions are met. The Act also sets investigation, notification, remediation, prevention, and record duties for compliance failures.

EU market-surveillance authorities enforce the CRA. In the UK, the Office for Product Safety and Standards (OPSS) enforces the PSTI product-security regime. UK powers include compliance, stop, and recall notices, information requirements, and monetary penalties. The statutory maximum for a penalty is the greater of GBP 10 million and 4% of qualifying worldwide revenue, subject to the Act's calculation rules; that is a maximum, not an automatic fine.

Start with one product-security baseline, then create separate EU and UK evidence indexes. Shared tests can reduce duplicate engineering work, but every legal conclusion must point to the correct instrument and actor.

The UK regime has applied since 29 April 2024. CRA Article 14 reporting applies from 11 September 2026, and most CRA product and conformity duties apply from 11 December 2027. Under Article 69, products placed on the market before 11 December 2027 are generally subject to the other requirements only if substantially modified from that date; Article 14 reporting also covers earlier in-scope products. Use the actual supply, placement, modification, and reporting facts rather than the model's original launch date.