Reference

IoT Regulations for Connected Products

Before you can spec features or choose an architecture, you need to know which cybersecurity frameworks bind your product. The answer depends on three things: what you are building, where you are selling, and who is buying.

Educational reference. This table maps the major frameworks. For product-specific requirements, use the companion tools below.

Framework Mapping

Each row links to the authoritative text. The "Applies when" column tells you the trigger. The "Who demands it" column tells you who will ask for proof.

Framework Applies when Who demands it Scope
ETSI EN 303 645 Consumer IoT sold in EU, UK, SG, AU, FI Market access – product baseline 13 outcome-focused provisions covering credentials, updates, encryption, resilience, and data protection for consumer connected products.
EU Cyber Resilience Act Any product with digital elements sold in EU Market access – mandatory SBOMs, 24-hour vulnerability reporting to ENISA, coordinated disclosure, post-market monitoring. Penalties up to EUR 15M or 2.5% of global turnover.
UK PSTI Act Products sold in UK Market access – mandatory Bans universal default passwords. Requires vulnerability disclosure policy and published support period.
GDPR Any product handling EU personal data Legal compliance Data minimization, consent, right to erasure, data protection by design. Applies whenever a device collects data tied to a person.
US Cyber Trust Mark Products sold in US (voluntary) Retail shelf positioning Voluntary labeling program modeled on Energy Star. Signals baseline security compliance to US consumers.
IEC 62443-4-2 Industrial / OT deployments Operator procurement Component-level security for industrial automation and control systems.
EU NIS2 Directive EU industrial deployments in essential/important sectors Operator obligations (flow-down) Cybersecurity risk-management and incident reporting for operators. Obligations flow down to component suppliers.
ISO/SAE 21434 Automotive products Type approval Cybersecurity engineering across the vehicle lifecycle, from concept through decommissioning.
FDA Premarket Cybersecurity Medical devices sold in US Regulatory approval Premarket cybersecurity expectations for networked medical devices.
IEC 81001-5-1 Health software / connected medical devices Regulatory approval Security lifecycle activities for health software and medical devices.
ISO 27001 / 27002 organizational Enterprise buyers requiring ISMS alignment Procurement / tender requirement Not a product-security standard. Covers organizational risk treatment, asset ownership, supplier agreements, and internal audit. Your product can pass every ETSI provision and still fail procurement if nobody owns the ISMS.
How to use this table: Identify your product archetype (consumer IoT, composite GP-OS, industrial/OT, medical). List your target markets (EU, UK, US, etc.). Check whether your buyer requires organizational security alignment (ISO 27001). The frameworks that match are your regulatory scope. The companion tools below automate this resolution and generate requirements or assessment questions scoped to your specific combination.

Companion Tools

Both tools start by resolving your regulatory landscape – then generate output scoped to the frameworks that bind you.

IoT Security Requirements Generator

Pick your archetype, environment, and markets. Get a PRD-ready requirements document, lifecycle-grouped, with every requirement cited to the standards that apply.

Launch Generator

IoT Security Scorecard

Assess a shipped product against the same archetype lens. Get a grade with regulatory flags and critical-failure ceilings.

Launch Scorecard

Worked example: a tado° smart thermostat

tado° is a Munich company that sells smart thermostats and radiator valves across the EU and in the UK. The thermostat talks to a bridge in the home, the bridge talks to tado°'s cloud, and the app uses your phone's location to turn the heating down when the last person leaves. Walk it down the table above, row by row.

FrameworkApplies?Why
ETSI EN 303 645YesConsumer IoT sold in the EU and the UK. Both markets use it as the product baseline, and the UK's PSTI regulations were written to line up with it.
EU Cyber Resilience ActYesA product with digital elements placed on the EU market. Reporting duties from 11 September 2026, the full obligations from 11 December 2027.
UK PSTI ActYesA consumer connectable product sold in the UK: no default passwords, a published disclosure policy, a published support period on the listing.
GDPRYesGeofencing is location data tied to a person, and a heating schedule reveals when a home is empty. Both are personal data.
US Cyber Trust MarkNoUS only, and voluntary. It would enter the scope the day tado° listed on a US shelf.
IEC 62443-4-2, NIS2NoHome environment. A building-management version of the same product, sold to a hospital's facilities team, would pull both in.
ISO/SAE 21434, FDA, IEC 81001-5-1NoNot a vehicle, not a medical device.
ISO 27001 / 27002Conditionaltado° also sells through energy retailers and to landlords. A utility's procurement team will ask about the ISMS even though no consumer ever will.

Result: four binding frameworks, one conditional, six that do not apply. That is the regulatory scope. Change one input and it moves. Add the US and the Cyber Trust Mark appears as a voluntary label worth having on the box. Sell the same hardware to a building operator and the scope jumps from four frameworks to six, with a different question bank. The scorecard and the requirements generator resolve this automatically from three inputs: archetype, environment and markets.

When to use this, and when not

Use it when

Do not use it when

Frequently asked questions

Is ETSI EN 303 645 mandatory?

Not on its own. It is a standard, not a law. It becomes binding through the laws and schemes that reference it: the UK PSTI regulations were written to align with its first three provisions, Singapore's Cybersecurity Labelling Scheme and Australia's code of practice use it as the baseline, and the EU CRA's harmonised standards are expected to build on it. Meeting it is the shortest route to meeting all of them.

Does the EU Cyber Resilience Act replace the UK PSTI Act?

No. They are different jurisdictions. PSTI applies to consumer connectable products sold in the UK and has been in force since 29 April 2024. The CRA applies to any product with digital elements placed on the EU market. A product sold in both meets both, and designing for the CRA covers PSTI with one exception: PSTI's support period must be published on the UK listing.

When does the Cyber Resilience Act start to apply?

It entered into force on 10 December 2024. The reporting obligations, including the 24-hour early warning on actively exploited vulnerabilities, apply from 11 September 2026. The main obligations, including conformity assessment and CE marking, apply from 11 December 2027.

Does GDPR apply to a device with no user account?

It applies whenever the device processes data that can be tied to a person, account or not. A camera that records a face, a thermostat that logs when a home is empty, a scale that stores a weight: each is personal data. A device that only reports its own temperature to a display, with nothing linking it to a household, is outside scope.

Do I need ISO 27001 to sell a connected product?

Not for market access. ISO 27001 is an organisational standard for the company, not a product standard, and no consumer regulator asks for it. Enterprise and public-sector buyers do, in tenders and supplier questionnaires. If your product sells through utilities, hospitals, schools or governments, plan for it.

Go further

The map is free. Get the updates.

New connected-hardware tools and chapter previews from Tangibles.