CRA vs PSTI

The two market-access laws a consumer device meets first when it ships to Europe and Britain. PSTI is three concrete requirements on the product; the CRA is a full lifecycle obligation on the manufacturer. Meeting PSTI is roughly the first afternoon of a CRA programme, not a substitute for one.

	EU Cyber Resilience Act	UK PSTI Act
Applies when	Any product with digital elements placed on the EU market, consumer or industrial	Consumer connectable products sold in the UK
Who demands it	Market access, mandatory (CE marking)	Market access, mandatory
What it is	Regulation	Act plus 2023 regulations
Scope	Security by design, SBOMs, 24-hour reporting of actively exploited vulnerabilities to the CSIRT and ENISA, coordinated disclosure, post-market monitoring for the support period	Three requirements: no universal default passwords, a published vulnerability disclosure policy, and a published minimum security-update period
In force	In force 10 Dec 2024; reporting duties from 11 Sep 2026; main obligations from 11 Dec 2027	Regime in force 29 Apr 2024
Penalties	Up to EUR 15M or 2.5% of global turnover	Up to GBP 10M or 4% of worldwide revenue
Authoritative text	CRA text ↗ · on this site	PSTI text ↗

What a product team should do

Design for the CRA and you have PSTI covered, with one exception: PSTI's published support period must be stated on the UK listing, which the CRA's support-period duty does not itself require you to publish in that form.

Check your own product

The IoT security scorecard grades a product against these frameworks in 19 questions, and the requirements generator turns the applicable ones into PRD-ready requirements. Both cite the same provisions this page does. The full map is on the regulatory landscape reference.

Sources: EU Cyber Resilience Act (official text) and UK PSTI Act (official text). Educational reference, not legal advice. See Chapter 18 and Chapter 19 of Tangibles.

← All comparisons