A connected wireless product sold in both markets may need EU RED conformity and a separate UK PSTI product-security assessment.
RED controls EU radio-equipment market access. PSTI controls specified security and statement duties for relevant consumer connectable products supplied to UK consumers.
Structured answer sets in this page tree.
Cited legal and guidance references.
Many Wi-Fi, Bluetooth, cellular, and other connected consumer products sold in the EU and UK need both workstreams. EU RED applies to radio equipment and covers safety, EMC, spectrum, activated cybersecurity requirements, conformity assessment, the EU declaration, and CE marking. The RED cybersecurity category act applies to covered equipment from 1 August 2025 through 10 December 2027 and is repealed from 11 December 2027, with surveillance preserved for equipment placed on the Union market during that period. The UK PSTI product-security regime has applied since 29 April 2024 to a and imposes password, vulnerability-reporting, security-update transparency, statement-of-compliance, record, and corrective-action duties. Neither regime establishes compliance with the other.
Use RED for EU radio-equipment conformity and PSTI for UK consumer connectable product security. Keep the legal conclusions and market deliverables separate.
Binding EU radio-equipment law covering Article 3 requirements, conformity assessment, technical documentation, the EU declaration, CE marking, and market surveillance.
Binding UK product-security law for relevant consumer connectable products, with security requirements, statements, supply-chain checks, records, corrective action, and OPSS enforcement.
| Dimension | EU RED | UK PSTI | Operational implication |
|---|---|---|---|
| Scope | Radio equipment made available on the EU market or put into service in the Union. | Relevant consumer products that can connect to the internet or a network and are made available to UK consumers, subject to exclusions. | Write one scope record per market; do not infer either result from the other. |
| Security requirements | Network protection, privacy and personal-data safeguards, and fraud protection for specified radio-equipment categories. | Password controls, published vulnerability-reporting information, and published minimum security-update support information. | Some controls overlap, but the required legal evidence and wording differ. |
| Actors | RED assigns duties to manufacturers, authorised representatives, importers, and distributors in the EU chain. | PSTI assigns duties to UK manufacturers, importers, distributors, and, for specified failures, authorised representatives. | Map the real commercial chain in each market instead of copying role names. |
| Market documents | RED technical documentation and an EU declaration of conformity support CE marking. | Unless the Schedule 2A deemed-compliance conditions are met, a PSTI statement of compliance must accompany the product and include the Schedule 4 information. | A RED declaration does not replace the PSTI statement of compliance or deemed-compliance evidence. |
| Application dates | The RED cybersecurity delegated requirements apply from 1 August 2025 through 10 December 2027; the category act is repealed from 11 December 2027, with surveillance preserved for equipment placed on the market during that period. | The UK consumer connectable product security regime applies from 29 April 2024. | Both dates have passed; covered products need current evidence before market placement. |
| Reusable evidence | Threat models, credential tests, update evidence, vulnerability records, privacy analysis, fraud controls, and RED conformity records. | Password evidence, reporting-channel publication, response timing, update-support publication, statement or deemed-compliance evidence, actor checks, records, and failure actions. | Bridge shared controls at requirement level and keep each market's missing deliverables visible. |
Radio equipment made available on the EU market or put into service in the Union.
Relevant consumer products that can connect to the internet or a network and are made available to UK consumers, subject to exclusions.
Write one scope record per market; do not infer either result from the other.
Network protection, privacy and personal-data safeguards, and fraud protection for specified radio-equipment categories.
Password controls, published vulnerability-reporting information, and published minimum security-update support information.
Some controls overlap, but the required legal evidence and wording differ.
RED assigns duties to manufacturers, authorised representatives, importers, and distributors in the EU chain.
PSTI assigns duties to UK manufacturers, importers, distributors, and, for specified failures, authorised representatives.
Map the real commercial chain in each market instead of copying role names.
RED technical documentation and an EU declaration of conformity support CE marking.
Unless the Schedule 2A deemed-compliance conditions are met, a PSTI statement of compliance must accompany the product and include the Schedule 4 information.
A RED declaration does not replace the PSTI statement of compliance or deemed-compliance evidence.
The RED cybersecurity delegated requirements apply from 1 August 2025 through 10 December 2027; the category act is repealed from 11 December 2027, with surveillance preserved for equipment placed on the market during that period.
The UK consumer connectable product security regime applies from 29 April 2024.
Both dates have passed; covered products need current evidence before market placement.
Threat models, credential tests, update evidence, vulnerability records, privacy analysis, fraud controls, and RED conformity records.
Password evidence, reporting-channel publication, response timing, update-support publication, statement or deemed-compliance evidence, actor checks, records, and failure actions.
Bridge shared controls at requirement level and keep each market's missing deliverables visible.
RED applies when the finished product intentionally emits or receives radio waves for radio communication or radiodetermination and is made available on the EU market. Delegated Regulation (EU) 2022/30 activates RED Article 3(3)(d), (e), and (f) for specified radio-equipment categories from 1 August 2025 through 10 December 2027. Delegated Regulation (EU) 2026/339 repeals the category act from 11 December 2027 and preserves RED surveillance for covered equipment placed on the market during that period.
The PSTI Regulations apply to relevant consumer products that can connect to the internet or a network and are made available to UK consumers. A network-only product can still qualify when it can connect directly to an internet-connectable product using an Internet Protocol suite protocol, or when it can both connect directly to two or more products at once and connect directly to an internet-connectable product using a non-Internet Protocol suite protocol. The Act also treats certain input products designed to be used with a computer as meeting the second condition, so Bluetooth or hub-mediated operation needs the statutory test rather than a Wi-Fi-only shortcut.
Official guidance lists exclusions, including electric-vehicle charge points, medical devices, smart meters, specified non-cellular desktop, laptop, and tablet computers, certain products supplied in Northern Ireland, and vehicle categories added by the 2025 amendment. The computer exclusion does not cover a listed computer with cellular connectivity, and it does not cover one designed exclusively for children under 14. A product can be RED radio equipment but outside PSTI, or a PSTI product but outside RED.
The PSTI security requirements address three outcomes, but a manufacturer is treated as complying where the product is currently assigned a non-expired Japan JC-STAR STAR-1 conformance label or currently awarded a non-expired label under any level of the Singapore Cybersecurity Labelling Scheme. Products must not use universal default passwords or easily guessable passwords in the prohibited way. Manufacturers must publish information that allows security issues to be reported and state when reporters can expect acknowledgement and status updates. Manufacturers must also publish the minimum period for which security updates will be provided, including an end date. The Regulations do not impose one universal minimum support duration; the manufacturer declares the period and must present it clearly.
A statement of compliance must accompany the product unless the Schedule 2A deemed-compliance conditions are met. The PSTI Act treats it as a document, and official guidance says it can be digital, but where a statement is required the manufacturer, importer, and distributor must ensure it accompanies the product and contains the required information. Schedule 4 covers product identification, manufacturer details, a compliance statement, the defined support period and end date, signatory details, and place and date of issue.
Where a statement is required, manufacturers and importers must retain it for whichever is longer: 10 years from issue or the defined support period. Investigation and compliance-failure records have their own 10-year retention duty. The record should identify the suspected failure, investigation outcome, confirmed failure, corrective steps, and whether those steps worked.
RED cybersecurity focuses on network protection, privacy and personal-data safeguards, and fraud protection for the categories activated by Delegated Regulation (EU) 2022/30. The EN 18031 standards cited for RED have stated restrictions. PSTI focuses on its enacted password, vulnerability-reporting, update-period, statement, supply-chain, record, and corrective-action duties. Shared engineering facts do not make the legal deliverables identical.
The evidence bridge should link credential design, vulnerability intake, update policy, product architecture, security tests, and customer information to each applicable requirement. Keep the RED Article 3 matrix, conformity route, technical file, EU declaration, and CE evidence on the EU side. Keep the PSTI scope record, security-requirement evidence, statement of compliance or deemed-compliance evidence, actor checks, records, and compliance-failure actions on the UK side.
Map shared security controls to RED and PSTI separately, with the correct product, market, legal source, actor, statement, owner, and review trigger.