Security rules for connected products: the EU's Cyber Resilience Act and the UK's PSTI

For most of the history of connected products, security was a feature you could choose to pay for. In Europe and the UK it is now law, and the law reaches well beyond European manufacturers. The EU's Cyber Resilience Act applies to products with digital elements made available on the EU market, wherever the manufacturer is based (McCann FitzGerald). A South African company selling a connected device into Germany, or a UK company selling into Ireland, is a manufacturer under it.

What the CRA requires now

The reporting obligations started on 11 September 2026. When a manufacturer becomes aware of an actively exploited vulnerability in its product, or a severe incident affecting its security, it must send an early warning within 24 hours and a fuller notification within 72 hours. A final report follows within 14 days of a fix being available for a vulnerability, or within a month of the notification for an incident. Reports go to the national CSIRT and to ENISA together, through ENISA's single reporting platform (McCann FitzGerald).

Two details catch people out. The duty covers in-scope products already on the EU market, not only new ones. And manufacturers must tell their users as well, which is far easier when the fix has already arrived by over-the-air update (Espressif).

What the CRA requires from December 2027

From 11 December 2027 the full act applies. Products placed on the EU market from that date must meet its essential cybersecurity requirements, pass conformity assessment and carry the CE marking on that basis (Espressif). Fines for breaching the essential requirements can reach €15 million or 2.5% of worldwide annual turnover, whichever is higher (Bird & Bird).

Products in development now will be on sale in 2027 and 2028, so the design decisions being made today are the ones that will be assessed.

The rule that already applies to radios

Products with a radio did not have to wait for the CRA. Since 1 August 2025, the cybersecurity requirements of the EU's Radio Equipment Directive have applied to internet-connected radio equipment, to equipment that processes personal data and to equipment that handles payments. Manufacturers can declare conformity themselves only by fully applying the harmonised EN 18031 standards; otherwise a notified body must be involved (Applus+).

The UK's PSTI regime

The UK went first. Since 29 April 2024, consumer connectable products made available in the UK have had to meet three requirements (techUK):

• No default passwords. Passwords must be unique to each product or set by the user, and must not be based on counters, public information or the serial number.
• A published way to report security issues, with timeframes for acknowledging reports and for status updates until they are resolved.
• A published minimum period for security updates, as a duration or an end date, in words a non-technical buyer can understand.

Desktop and laptop computers, tablets without a cellular connection, smart meters, medical devices and EV charge points are excluded because other rules cover them (techUK). Penalties can reach £10 million or 4% of qualifying worldwide revenue (Burges Salmon). A product sold only to businesses falls outside PSTI, but not outside the CRA if it is also sold in the EU.

What to build in

The regimes differ in detail, but they ask for the same engineering. Build it in once, and each set of paperwork becomes a description of what you already do.

Unique credentials for every device, set at the factory, with no shared default password anywhere in the product.

Secure boot and signed firmware, so a device runs only code you released.

Over-the-air updates with rollback, so a fix reaches the field in days and a bad update cannot take the fleet down. Without them, a support period is a promise you cannot keep.

A software bill of materials, so that when a vulnerability is announced in a library you can tell within hours which of your products contain it. Espressif, for example, offers a tool that checks an ESP32 project's bill of materials against known vulnerabilities (Espressif).

Fleet monitoring that can spot exploitation: devices rebooting in waves, unexpected outbound traffic, logins that should not happen. You cannot report within 24 hours what you cannot see.

A vulnerability intake that works: a published address, someone who reads it, and the response times you promised.

A support period you can afford. Five years on the box means five years of patching the firmware, the libraries and the cloud services the product depends on. Price it before you print it.

The 24-hour drill

The quickest way to find out whether you are ready is a drill. Pretend a researcher has emailed to say one of your products is being exploited. Who reads that email on a Saturday? Who decides whether it is real? Who holds the ENISA reporting account, with two-factor authentication already set up? Who knows which firmware versions are in the field, and how many units run each one? If the answers take more than a day to find, the process needs work before the first real report.

We are engineers, not lawyers, so take legal advice on your own obligations. If you make connected products for Europe or the UK and want the engineering side done properly, send us a brief, or write to hello@handee.co.za.