UK device makers: the PSTI regime and the EU Cyber Resilience Act

The Cyber Resilience Act (CRA) is EU law, so it doesn't apply to products you sell only in Great Britain. It does apply to every connected product you make available in the EU, wherever your company is based (Article 2(1)). In the UK you already follow the product security regime under the Product Security and Telecommunications Infrastructure (PSTI) Act 2022, in force since 29 April 2024. The CRA asks for a lot more.

The UK rules you already follow

The PSTI product security regime has two parts: Part 1 of the PSTI Act 2022 and the PSTI (Security Requirements for Relevant Connectable Products) Regulations 2023. According to gov.uk, it covers consumer products that can connect to the internet or a network, and sets three security requirements:

1. no universal default or easily guessable passwords;
2. published information on how to report security issues, including how quickly you'll acknowledge a report and give updates;
3. published information on the minimum security update period, with an end date.

Manufacturers must also produce a statement of compliance that accompanies the product, and importers and distributors mustn't sell a product without one. The Office for Product Safety and Standards (OPSS) enforces it.

The gov.uk guidance lists products the regime doesn't cover, including electric vehicle charge points, medical devices, smart meter products, and desktops, laptops and tablets without cellular connectivity (unless designed exclusively for children under 14). It also excludes certain products made available in Northern Ireland under the Windsor Framework. If you sell there, check with OPSS which rules apply.

PSTI and the CRA side by side

	UK PSTI regime	EU Cyber Resilience Act
Status	In force since 29 April 2024	Reporting since 11 September 2026; the rest from 11 December 2027
Products	Consumer connectable products	Hardware and software products that connect to a device or network, for consumers and businesses alike (Article 2(1))
Passwords	Unique per product or set by the user	Part of broader rules: secure by default (Annex I, Part I, (2)(b)) and access control ((2)(d))
Reporting security issues	Publish how to report, with response times	A vulnerability contact (Annex I, Part II, (6)), a single point of contact (Article 13(17)) and a disclosure policy (Part II, (5))
Update period	Publish a minimum period with an end date	A support period of at least five years in most cases (Article 13(8)), end date shown at purchase (Article 13(19))
Parts list	Not among the three requirements	A machine-readable SBOM (Annex I, Part II, (1))
Incident reporting	Not among the three requirements	24-hour early warning, 72-hour notification, final report (Article 14)
Paperwork	Statement of compliance	Technical file (Annex VII), EU declaration of conformity, CE mark
Enforced by	OPSS	National market surveillance authorities in each EU country

If you meet PSTI, you've made a start on a few CRA topics. Most of Annex I, the SBOM, the reporting duty and the technical file are still ahead of you.

When you sell into the EU

You remain the manufacturer under the CRA if you market the product under your name or trademark (Article 3(13)), and the duties in Articles 13 and 14 sit with you.

Your EU importer has checks to make before selling your product (Article 19(2)). It must make sure that:

• you carried out the right conformity assessment;
• you drew up the technical documentation;
• the product carries the CE mark and comes with the declaration of conformity and the Annex II user information;
• your product identification, contact details and support end date are in place.

An importer who believes the product doesn't meet the rules mustn't place it on the market (Article 19(3)). So your importer will want evidence from you before it lists the product.

You may also appoint an authorised representative, a person or company established in the EU with your written mandate to act for you on specified tasks (Article 18(1) and Article 3(15)). It's optional. Your core duties, such as building to Annex I and handling vulnerabilities, can't be handed to them (Article 18(2)).

Reporting from outside the EU

Reporting under Article 14 already applies, including for products you placed on the EU market in earlier years (Article 69(3)). You report through ENISA's Single Reporting Platform to a national CSIRT, a computer security incident response team.

Without a main establishment in the EU, you pick the CSIRT by a fixed order (Article 14(7)): the country of your authorised representative, then that of the importer, then the distributor, each for the largest number of your products, and finally the country with the most users of your products.

The UK government and the CRA

Nothing on gov.uk says the UK will adopt the CRA. In February 2026 the Department for Science, Innovation and Technology ran a survey on the CRA and the AI Act for organisations, which shows the government is studying their effect. For products sold in Great Britain, PSTI remains the law.

What Proofsheet does here

Proofsheet is a web app. Upload one firmware image, phone app or desktop app, and in minutes it lists the parts and versions it can see, matches exact versions against the NVD, marks CVEs on CISA's known exploited list and maps the evidence to the 22 Annex I points of the CRA as evidenced, partial or open. The parts list comes as CycloneDX 1.5 and SPDX 2.3.

The generated report is built around the CRA. It doesn't produce a PSTI statement of compliance. Some findings, such as an outdated component with a known CVE, matter under both laws. No human reviews the file, and it is deleted within 24 hours. It's technical evidence, not a legal certificate.

Generate a report, or read the guides on manufacturer obligations and reporting.