UK PSTI vs EU Cyber Resilience Act

Use the PSTI workstream when a manufacturer, importer, or distributor makes a relevant connectable product available to UK consumers. The regime has applied since 29 April 2024. Confirm the password requirement, published security-issue reporting route, published minimum security-update period, statement of compliance, and actor-specific supply checks.

Use the EU Cyber Resilience Act workstream for a product with digital elements made available on the EU market when its intended or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. The CRA can cover standalone software, embedded software, hardware, and a remote data-processing solution on which a product depends for a function. Check Article 2 exclusions before classifying the product.

Run both workstreams when the same product is supplied in both markets. A connected home camera is a representative dual-market example. Standalone commercial software may be a CRA product even when it is not a UK consumer connectable product. The product may have a shared bill of materials, threat model, vulnerability process, update mechanism, test suite, and support plan, but it still needs jurisdiction-specific scope findings and outputs.

Record exclusions narrowly. PSTI Schedule 3 and the CRA Article 2 exclusions use different sector, product, and legal conditions. Free and open-source software supplied outside a commercial activity is outside the CRA's main product obligations, while open-source software stewards have separate duties. Neither framework creates a general exemption merely because another cybersecurity standard or sectoral rule applies.

The CRA requires the manufacturer to perform and document a cybersecurity risk assessment, design and produce the product in accordance with Annex I, handle vulnerabilities throughout the support period, prepare technical documentation, complete the applicable conformity assessment, issue an EU declaration of conformity, and affix CE marking. Importers and distributors have verification, identification, cooperation, and corrective-action duties.

Product classification affects the conformity route. The CRA distinguishes default products, important products in classes I and II, and critical products. Classification depends on Annexes III and IV and any delegated acts, not on a general impression that a product is high risk. Most products can use the internal-control route, while important and critical categories may need a harmonised-standard route, EU-type examination, full quality assurance, or another route specified by Article 32.

The CRA support period normally must be at least five years unless the product is expected to be used for less than five years. The manufacturer must base it on expected use, product and market characteristics, user expectations, component support, and other Article 13 factors. PSTI instead requires the manufacturer to publish the minimum period for which security updates will be provided, expressed with an end date. One operational period can serve both only when its reasoning and publication satisfy both rules.

Article 14 reporting starts before the general product obligations. From 11 September 2026, manufacturers must use the CRA process for actively exploited vulnerabilities and severe incidents affecting product security. Most other CRA provisions apply from 11 December 2027; Chapter IV on notification of conformity-assessment bodies has applied since 11 June 2026.

Article 14 treats an incident as severe if it harms, or can harm, the product's ability to protect the availability, authenticity, integrity or confidentiality of sensitive or important data or functions, or has led or can lead to malicious code in the product or a user's network and information systems. For CRA Article 14 reporting, record when the manufacturer became aware of the actively exploited vulnerability or severe incident. Send the early warning without undue delay and within 24 hours of awareness, and the vulnerability or incident notification without undue delay and within 72 hours of awareness unless that information has already been provided. Use the single reporting platform to notify the coordinating computer security incident response team (CSIRT) and the EU Agency for Cybersecurity (ENISA) simultaneously.

The final-report clocks differ: for an actively exploited vulnerability, report no later than 14 days after a corrective or mitigating measure is available; for a severe incident, report within one month after submitting the incident notification, unless the relevant information has already been provided. Also assess the Article 14 duty to inform impacted users and, where appropriate, all users. Preserve awareness, submission, mitigation and user-communication timestamps.