A connected wireless product sold in both markets may need EU RED conformity and a separate UK PSTI product-security assessment.
RED controls EU radio-equipment market access. PSTI controls specified security and statement duties for relevant consumer connectable products supplied to UK consumers.
Many Wi-Fi, Bluetooth, cellular, and other connected consumer products sold in the EU and UK need both workstreams. EU RED applies to radio equipment and covers safety, EMC, spectrum, activated cybersecurity requirements, conformity assessment, the EU declaration, and CE marking. The RED cybersecurity category act applies to covered equipment from 1 August 2025 through 10 December 2027 and is repealed from 11 December 2027, with surveillance preserved for equipment placed on the Union market during that period. The UK PSTI product-security regime has applied since 29 April 2024 to a and imposes password, vulnerability-reporting, security-update transparency, statement-of-compliance, record, and corrective-action duties. Neither regime establishes compliance with the other.
Side-by-side comparison
RED vs UK PSTI for connected radio products
Use RED for EU radio-equipment conformity and PSTI for UK consumer connectable product security. Keep the legal conclusions and market deliverables separate.
Binding EU radio-equipment law covering Article 3 requirements, conformity assessment, technical documentation, the EU declaration, CE marking, and market surveillance.
Second framework
UK PSTI
Binding UK product-security law for relevant consumer connectable products, with security requirements, statements, supply-chain checks, records, corrective action, and OPSS enforcement.
Articles 18 and 19 and Annex V cover the declaration, CE marking, and technical documentation.
Unless the Schedule 2A deemed-compliance conditions are met, a PSTI statement of compliance must accompany the product and include the Schedule 4 information.
The RED cybersecurity delegated requirements apply from 1 August 2025 through 10 December 2027; the category act is repealed from 11 December 2027, with surveillance preserved for equipment placed on the market during that period.
Official guidance confirms the 29 April 2024 start date.
The RED cybersecurity start date and the PSTI start date have passed. Apply the separate 2027 RED repeal transition to the relevant market-placement date.
Articles 18 and 19 and Annex V cover the declaration, CE marking, and technical documentation.
UK PSTI
Unless the Schedule 2A deemed-compliance conditions are met, a PSTI statement of compliance must accompany the product and include the Schedule 4 information.
Schedules 2A and 4 state the deemed-compliance conditions and required statement content.
Operational implication
A RED declaration does not replace the PSTI statement of compliance or deemed-compliance evidence.
Application dates
EU RED
The RED cybersecurity delegated requirements apply from 1 August 2025 through 10 December 2027; the category act is repealed from 11 December 2027, with surveillance preserved for equipment placed on the market during that period.
Official guidance confirms the 29 April 2024 start date.
Operational implication
The RED cybersecurity start date and the PSTI start date have passed. Apply the separate 2027 RED repeal transition to the relevant market-placement date.
Reusable evidence
EU RED
Threat models, credential tests, update evidence, vulnerability records, privacy analysis, fraud controls, and RED conformity records.
RED applies when the finished product intentionally emits or receives radio waves for radio communication or radiodetermination and is made available on the EU market. Delegated Regulation (EU) 2022/30 activates RED Article 3(3)(d), (e), and (f) for specified radio-equipment categories from 1 August 2025 through 10 December 2027. Delegated Regulation (EU) 2026/339 repeals the category act from 11 December 2027 and preserves RED surveillance for covered equipment placed on the market during that period.
The PSTI Regulations apply to relevant consumer products that can connect to the internet or a network and are made available to UK consumers. A network-only product can still qualify when it can connect directly to an internet-connectable product using an Internet Protocol suite protocol, or when it can both connect directly to two or more products at once and connect directly to an internet-connectable product using a non-Internet Protocol suite protocol. The Act also treats certain input products designed to be used with a computer as meeting the second condition, so Bluetooth or hub-mediated operation needs the statutory test rather than a Wi-Fi-only shortcut.
Official guidance lists exclusions, including electric-vehicle charge points, medical devices, smart meters, specified non-cellular desktop, laptop, and tablet computers, certain products supplied in Northern Ireland, and vehicle categories added by the 2025 amendment. The computer exclusion does not cover a listed computer with cellular connectivity, and it does not cover one designed exclusively for children under 14. A product can be RED radio equipment but outside PSTI, or a PSTI product but outside RED.
Record the EU and UK product versions, radio technologies, network functions, intended users, sales channels, and supply-chain actors.
Complete the RED radio-equipment and Article 3(3) decision independently from the PSTI relevant-connectable-product and exclusion decision.
Do not use EU CE marking as evidence that the UK PSTI duties have been met; PSTI has its own statement and supply-chain requirements.
Repeals the RED cybersecurity category act from 11 December 2027 and preserves surveillance for covered equipment placed on the market through 10 December 2027.
Binding UK regulations defining relevant connectable products, exclusions, security requirements, deemed compliance, and statement content.
2
Section 2
Meet the three PSTI security requirements and statement duty
The PSTI security requirements address three outcomes, but a manufacturer is treated as complying where the product is currently assigned a non-expired Japan JC-STAR STAR-1 conformance label or currently awarded a non-expired label under any level of the Singapore Cybersecurity Labelling Scheme. Products must not use universal default passwords or easily guessable passwords in the prohibited way. Manufacturers must publish information that allows security issues to be reported and state when reporters can expect acknowledgement and status updates. Manufacturers must also publish the minimum period for which security updates will be provided, including an end date. The Regulations do not impose one universal minimum support duration; the manufacturer declares the period and must present it clearly.
A statement of compliance must accompany the product unless the Schedule 2A deemed-compliance conditions are met. The PSTI Act treats it as a document, and official guidance says it can be digital, but where a statement is required the manufacturer, importer, and distributor must ensure it accompanies the product and contains the required information. Schedule 4 covers product identification, manufacturer details, a compliance statement, the defined support period and end date, signatory details, and place and date of issue.
Where a statement is required, manufacturers and importers must retain it for whichever is longer: 10 years from issue or the defined support period. Investigation and compliance-failure records have their own 10-year retention duty. The record should identify the suspected failure, investigation outcome, confirmed failure, corrective steps, and whether those steps worked.
Test every password path in the product and associated software against the Regulations, including factory and privileged credentials.
Publish a durable vulnerability-reporting route and response timing information that security researchers can find without buying the product.
Publish the security-update support period before purchase where required and, unless the Schedule 2A deemed-compliance conditions are met, keep the statement of compliance with the supplied product.
Part 1 establishes duties for manufacturers, importers, distributors, and authorised representatives, including statements, records, investigations, and action on compliance failures.
Official guidance summarizes the three requirements and says a statement of compliance may be digital; its statement discussion predates the December 2025 deemed-compliance amendment.
3
Section 3
Bridge security controls without merging legal files
RED cybersecurity focuses on network protection, privacy and personal-data safeguards, and fraud protection for the categories activated by Delegated Regulation (EU) 2022/30. The EN 18031 standards cited for RED have stated restrictions. PSTI focuses on its enacted password, vulnerability-reporting, update-period, statement, supply-chain, record, and corrective-action duties. Shared engineering facts do not make the legal deliverables identical.
The evidence bridge should link credential design, vulnerability intake, update policy, product architecture, security tests, and customer information to each applicable requirement. Keep the RED Article 3 matrix, conformity route, technical file, EU declaration, and CE evidence on the EU side. Keep the PSTI scope record, security-requirement evidence, statement of compliance or deemed-compliance evidence, actor checks, records, and compliance-failure actions on the UK side.
Manufacturers, importers, and distributors have distinct PSTI duties; record the actual UK supply chain rather than copying EU economic-operator roles.
OPSS enforces the UK product-security regime. Prepare a UK corrective-action and authority-response owner separately from the EU RED market-surveillance owner.
Reopen both assessments after product, firmware, password, support-period, service, supplier, importer, distributor, market, standard, or legal-scope changes.
Repeals the RED cybersecurity category act from 11 December 2027 and preserves surveillance for covered equipment placed on the market through 10 December 2027.
Current official guidance for the 29 April 2024 regime, actors, exclusions, compliance, statements, and OPSS.
Official OPSS and DSIT guidance states the 29 April 2024 start date, covered actors and products, listed exclusions, and 2025 vehicle update.
Official guidance summarizes the three requirements and says a statement of compliance may be digital; its statement discussion predates the December 2025 deemed-compliance amendment.
Show 1 more
Official guidance identifies manufacturers, importers, distributors, authorised representatives, and OPSS roles.
Binding source for the RED cybersecurity repeal and preserved-surveillance transition.
Repeals the RED cybersecurity category act from 11 December 2027 and preserves surveillance for covered equipment placed on the market through 10 December 2027.
Binding UK Act for product-security duties, statements, records, compliance failures, and enforcement.
Part 1 establishes duties for manufacturers, importers, distributors, and authorised representatives, including statements, records, investigations, and action on compliance failures.