CRA vs PSTI

The two market-access laws a consumer device meets first when it ships to Europe and Britain. PSTI is three concrete requirements on the product; the CRA is a full lifecycle obligation on the manufacturer. Meeting PSTI is roughly the first afternoon of a CRA programme, not a substitute for one.

	EU Cyber Resilience Act	UK PSTI Act
Applies when	Any product with digital elements placed on the EU market, consumer or industrial	Consumer connectable products sold in the UK
Who demands it	Market access, mandatory (CE marking)	Market access, mandatory
What it is	Regulation	Act plus 2023 regulations
Scope	Security by design, SBOMs, 24-hour reporting of actively exploited vulnerabilities to the CSIRT and ENISA, coordinated disclosure, post-market monitoring for the support period	Three requirements: no universal default passwords, a published vulnerability disclosure policy, and a published minimum security-update period
In force	In force 10 Dec 2024; reporting duties from 11 Sep 2026; main obligations from 11 Dec 2027	Regime in force 29 Apr 2024
Penalties	Up to EUR 15M or 2.5% of global turnover	Up to GBP 10M or 4% of worldwide revenue
Authoritative text	CRA text ↗ · on this site	PSTI text ↗

What a product team should do

Design for the CRA and you have PSTI covered, with one exception: PSTI's published support period must be stated on the UK listing, which the CRA's support-period duty does not itself require you to publish in that form.

Worked example: a Sonos Era 100 in both markets

Take a Sonos Era 100: a Wi-Fi and Bluetooth speaker set up from the Sonos app with a Sonos account, sold in every EU country and in the UK. It is a consumer connectable product under PSTI and a product with digital elements under the CRA, so both laws bind it. Walk through what each one asks.

What PSTI asks, since 29 April 2024

Three things, and the UK regulator can check all three from the outside. First, no universal default password: an app-driven setup that creates no device password at all meets this, as does a unique per-unit credential printed on the label. Second, a published vulnerability disclosure policy: a page with a security contact and the timelines for acknowledging and fixing reports. Third, the minimum period for which security updates will be provided, stated where a buyer can see it before purchase, which in practice means the UK product listing and the box.

What the CRA adds, in stages

From 11 September 2026 the reporting duties apply: an actively exploited vulnerability in the speaker's firmware, or a severe incident affecting it, must reach ENISA's single reporting platform within 24 hours as an early warning, with a fuller notification at 72 hours and a final report within 14 days. From 11 December 2027 the main obligations apply. The speaker needs a documented cybersecurity risk assessment, secure-by-default configuration, a software bill of materials for its firmware, a vulnerability-handling process, a support period that reflects its expected lifetime (at least five years unless the product is expected to be used for less), and a technical file behind an EU declaration of conformity and the CE mark. For a speaker, the default category, the conformity assessment can be the manufacturer's own.

Date	What changes for this product
29 Apr 2024	PSTI regime live. No default password, disclosure policy published, support period on the UK listing.
11 Sep 2026	CRA reporting duties. 24-hour early warning, 72-hour notification, 14-day report for actively exploited vulnerabilities and severe incidents.
11 Dec 2027	CRA main obligations. Risk assessment, SBOM, vulnerability handling, support period, technical file, declaration of conformity, CE marking.

The PSTI work is a page on the website and a line on the listing. The CRA work is an engineering process and a document set that has to exist before the product is placed on the market, and a reporting rota that has to exist afterwards. That is the difference between an afternoon and a programme.

When to use this comparison, and when not

Use it when a consumer product ships to both Britain and the EU and someone asks whether the UK work is already done, when a UK-only product is about to add its first EU market, and when a compliance budget has to be defended: the table above is the difference in scope, and the timeline is the difference in urgency.

Do not use it for industrial, medical or automotive products. PSTI does not cover them, and the CRA classes many of them as important or critical products with a third-party conformity route, which changes the plan. Do not use it as the ETSI EN 303 645 checklist either: this page compares two laws, and the PSTI vs ETSI comparison covers the standard both of them lean on.

Frequently asked questions

Does complying with the UK PSTI Act mean I comply with the EU Cyber Resilience Act?

No. PSTI is three requirements: no universal default passwords, a published vulnerability disclosure policy, and a published minimum security-update period. The CRA requires those and much more: a documented risk assessment, secure-by-default configuration, a software bill of materials, a vulnerability-handling process, 24-hour reporting of actively exploited vulnerabilities, a support period of at least five years in most cases, and CE marking backed by a technical file. Meeting PSTI is a small subset of a CRA programme.

If I sell only in the UK, does the Cyber Resilience Act apply to me?

The CRA applies to products placed on the EU market, so a product sold only in the UK is outside it. The moment a distributor or a marketplace listing puts a unit in front of an EU customer, that product is placed on the EU market, and the importer or distributor will pass the manufacturer's obligations back to you by contract. Plan for the CRA before the first EU order, not after.

What must be reported under the CRA, and how quickly?

Two things: any actively exploited vulnerability in the product, and any severe incident that affects the product's security. The early warning is due within 24 hours of becoming aware, a fuller notification within 72 hours, and a final report within 14 days for a vulnerability or one month for an incident. Reports go through ENISA's single reporting platform to the national CSIRT. These duties apply from 11 September 2026.

How long a security-update period do the two laws require?

PSTI sets no minimum. It requires the period to be published at the point of sale, and a published period of zero would be legal if unattractive. The CRA requires a support period that reflects the time the product is expected to be in use, and says it should generally be at least five years unless the product is expected to be used for less. The period must be stated in the information that accompanies the product.

Which law has the bigger penalties?

On paper the UK's: PSTI fines run to GBP 10 million or 4% of worldwide revenue, against the CRA's EUR 15 million or 2.5% of global turnover. In practice the CRA's larger exposure is market access. A product without a valid declaration of conformity cannot carry the CE mark and cannot be placed on the EU market at all, whatever the fine.

Check your own product

The IoT security scorecard grades a product against these frameworks in 19 questions, and the requirements generator turns the applicable ones into PRD-ready requirements. Both cite the same provisions this page does. The full map is on the regulatory landscape reference.

Sources: EU Cyber Resilience Act (official text) and UK PSTI Act (official text). Educational reference, not legal advice. See Chapter 18 and Chapter 19 of Tangibles.

← All comparisons