UK leads global charge on connected device security

The UK has cemented its role as a global leader in connected device security, with new agreements announced during Singapore International Cyber Week set to align international standards and boost consumer protection.

Under a major deal between the UK and Singapore, devices meeting Singapore’s cybersecurity standards will now be recognised under the UK’s Product Security and Telecommunications Infrastructure (PSTI) regime – the world’s first legislation to introduce minimum cyber requirements for consumer devices.

The PSTI regime, built on the ETSI EN 303 645 standard, mandates key protections such as banning default passwords and ensuring transparency over software update support. This alignment will simplify compliance, reduce costs, and accelerate the rollout of secure products globally.

The announcement forms part of a wider Global Cyber Security Labelling Initiative launched by a coalition of countries including the UK, Singapore, Australia, Germany, Finland, Japan, and South Korea. The initiative aims to harmonise standards across markets, delivering safer devices to consumers and a clearer compliance framework for manufacturers.

Cyber Security Minister Liz Lloyd CBE said the initiative will provide “safer products for people, clearer rules for business and less duplication across borders.”

Domestically, the UK is also embedding cybersecurity more deeply into business governance through the Good Business Charter, which now includes cyber resilience as a key accreditation criterion. The forthcoming Cyber Security and Resilience Bill will further strengthen protections for essential and digital services, reinforcing the UK’s leadership in the global cybersecurity landscape.

As more nations adopt the UK’s approach, the PSTI framework – and the EN 303 645 standard that underpins it – continues to set the global benchmark for smart device security, supporting innovation while protecting consumers.

For more on compliance with this, The Radio Equipment Directive and the upcoming Cyber Resilience Act in the EU get in touch today.

CRA in brief – what you need to know

The EU’s Cyber Resilience Act (CRA) is here, setting out tough new cybersecurity requirements for products with digital elements (PwDEs). While obligations are phased, preparation is vital. Here are the three big takeaways manufacturers need to know straight away:

What is the CRA?

The CRA is EU legislation designed to strengthen the resilience of digital products. It sets essential cybersecurity requirements for any product with digital elements placed on the EU market.

Who does it apply to?

Manufacturers, importers, and distributors of products with digital elements, from connected devices and operating systems to apps, software libraries, and cloud services, all fall within scope.

How is it different from the Radio Equipment Directive (RED)?

The RED Delegated Act introduces cybersecurity requirements for radio products with wireless technologies such as Wi-Fi and Bluetooth. From 1 August 2025, these products must be tested against EN 18031 standards.

The CRA goes further. It applies to all PwDEs and extends compliance obligations to include associated software and processes. Manufacturers must demonstrate how they assess and mitigate risks across a product’s entire lifecycle and how they handle vulnerabilities.

When does it come into force?

What does compliance involve?

Organisations will need to:

  1. Implement risk assessments covering planning, design, development, production, and maintenance.
  2. Test products against essential requirements, such as access controls and authentication mechanisms.
  3. Create a vulnerability management process, including reporting and maintaining a software bill of materials (SBOM).

European Standards Bodies (CEN/CENELEC and ETSI) are developing supporting standards to help demonstrate compliance. Products meeting requirements can then be CE marked and backed up with technical files including test reports and declarations of conformity.

How SafeShark can help

SafeShark supports companies preparing for CRA compliance through pre-assessments mapped to ENISA’s requirements. We are directly involved in the standards process, so we can provide the latest insights on how requirements are evolving.

Until CRA deadlines apply, manufacturers must still comply with RED. From 1 August 2025, connected radio products entering the EU market must be tested against EN 18031 standards. SafeShark offers straightforward EN 18031 compliance testing at our dedicated cybersecurity lab in central London, helping ensure your products are ready for market.

The top five RED compliance pitfalls and how to avoid them

by Steven Gallivan, Account Manager, SafeShark

If you’re a manufacturer bringing connected products to market, compliance with the Radio Equipment Directive (RED) isn’t optional, it’s essential. But in my work helping companies navigate the process, I see the same avoidable mistakes crop up time and again. Each one can mean delays, extra costs, or even products being pulled from shelves.

Here are the top five pitfalls and, more importantly, how to avoid them.

1. Leaving compliance until the last minute
Compliance isn’t a quick add-on at the end of development. Tackling it too late often leads to redesigns and costly delays. The best approach is to plan for compliance from the start, building requirements into your design and testing roadmap.

2. Misunderstanding cybersecurity obligations
The RED now includes essential requirements on security, privacy, and protection against fraud. These aren’t just technical extras, they’re core to product safety. A common pitfall is underestimating the scope of cybersecurity testing, which can lead to non-conformities when the product is reviewed by a Notified Body.

3. Overlooking documentation
Technical documentation is more than a formality. If it’s incomplete or inaccurate, your product cannot be properly assessed, and it may not be legally sold in the EU or UK. Keep detailed, up-to-date records of design, testing, and risk assessment to avoid unnecessary setbacks.

4. Assuming RED and PSTI are interchangeable
While the UK’s PSTI legislation and RED overlap in some areas, they are not the same. Treating them as interchangeable is a recipe for non-compliance. Understanding where they differ, particularly in scope and enforcement, is crucial if you want to sell into both markets smoothly.

5. Going it alone
The RED is complex, and self-assessment isn’t always enough. Working with a trusted partner who can provide expert guidance, testing, and direct links to a Notified Body makes the whole process smoother and more robust.

At SafeShark, we’ve seen how avoiding these pitfalls helps companies save time, cut costs, and get to market with confidence. Compliance doesn’t have to be a hurdle, with the right planning and support, it becomes a competitive advantage. Feel free to get in touch if you think we can help.

SafeShark joins the IoT Security Foundation

SafeShark is proud to announce that it has joined the IoT Security Foundation (IoTSF), the international not-for-profit organisation dedicated to driving security excellence in the Internet of Things (IoT).

SafeShark’s mission has always been clear: empowering connected device manufacturers to help secure the Internet of Things and make it safe to connect. Joining IoTSF reflects this commitment and underlines the company’s role in:

At SafeShark, compliance is made simple through practical, agile, end-to-end solutions. Using automation and a unique testing platform, SafeShark supports manufacturers and service providers to meet today’s evolving standards, from the Radio Equipment Directive (RED) to the upcoming Cyber Resilience Act, while ensuring they stay one step ahead of tomorrow’s challenges.

SafeShark Director Alex Buchan said:“SafeShark’s mission is to help secure the Internet of Things and make it safe to connect. Joining IoTSF reflects our commitment not only to supporting customers with end-to-end compliance solutions, but also to contributing to a stronger, more resilient global IoT ecosystem. We look forward to collaborating with IoTSF and its members to raise standards, build confidence and deliver value to businesses and consumers alike.”

UK smart home market grows to £3.1bn, driven by home cinema and luxury demand

The UK’s professional smart home market has reached an estimated value of £3.1bn, marking a 7% increase from 2023, according to the latest Professional Smart Home Market Analysis from the industry association. Produced in partnership with Ancrage Consulting LLC, the report combines verified sales input from manufacturers and distributors with data from residential integrators and quoting platforms WeQuote and Specifi.

Growth in the sector is being led by strong consumer demand for home cinema, lighting and shading, and networking solutions. Meanwhile, interest in security systems and outdoor AV has seen a relative decline. The report also notes increased momentum in the luxury and uber-luxury segments, with 30% of respondents now focused on high-end clientele.

Service agreements are becoming a standard part of business models, with 80% of integrators offering them. Looking ahead, optimism remains high – half of all surveyed companies plan to recruit additional technical staff in the next year.

Matt Nimmons, EMEA Managing Director, said: “The report doesn’t just reflect the state of the market, it helps shape its future,” highlighting how the analysis gives members a clearer view of both opportunities and challenges.

Cyber Resilience Act - latest updates from the European Commission 

Yesterday the EC Policy team gave an update on the Cyber Resilience Act (CRA) which is set to become the latest cyber security regulation to govern connected products. Points to note are:

In general the CRA is a new set of cybersecurity rules for placing of products on the EU - it will expand on RED requirements (coming into force Aug 1st 2025) by massively increasing the range of products that fall into its scope - products with "Digital Elements" will include software products, apps, and remote data processing solutions as well as hardware. Another key element is that the CRA is centred around the premise that compliance is maintained throughout the product lifetime.

CRA will come into force in two stages which are:

To prepare for CRA - SafeShark is providing product testing against the EC mapping for current standards e.g. EN 303 645 and EN 18031, that can already provide a level of conformity for CRA - helping you get ahead of the legislation.

SafeShark also provides straightforward PSTI and RED compliance testing, that allows you to quickly prove your consumer electronic product is ready for UK or EU market access in order to meet the 1st Aug deadline. Get in touch to find out more from our experts.

SafeShark partners with CyberWhiz to expand compliance services across Europe

SafeShark, the UK’s leading cybersecurity compliance and assurance provider for connected devices, has announced a new partnership with CyberWhiz, a specialist IoT cybersecurity solutions provider and compliance consultancy, to expand its services in Europe. CyberWhiz will act as an official agent for SafeShark’s services in the EU supporting manufacturers in ensuring regulatory compliance and cybersecurity resilience in an increasingly complex global market.

The partnership enables even more manufacturers across Europe to access SafeShark’s industry-leading compliance solutions, including testing against EN18031 for the EU Radio Equipment Directive (RED) and UK PSTI regulations. With CyberWhiz’s deep local expertise and industry relationships, the collaboration will help businesses navigate evolving regulatory requirements while maintaining product security and market access.

SafeShark Director and DTG CTO Alex Buchan said: “This partnership with CyberWhiz is a key milestone in SafeShark’s mission to support manufacturers worldwide in meeting the highest cybersecurity and compliance standards. CyberWhiz’s extensive customer base in Europe’s major manufacturing hubs such as Turkey makes it essential that these businesses have access to robust, streamlined compliance solutions, and we are delighted to work with CyberWhiz to provide this support.”

CyberWhiz CEO Çağatay Büyüktopçu said: “We are delighted to launch this strategic partnership with SafeShark. Our goal is to support manufacturers across Europe, particularly in major production hubs like Turkey, in meeting increasingly complex cybersecurity regulations. By combining SafeShark’s comprehensive testing and certification processes with CyberWhiz’s holistic IoT Cyber Security expertise and regional leadership, we will provide manufacturers with a fast, cost-effective, and efficient compliance journey. This collaboration marks a significant step in our mission to ensure the highest standards of IoT security.”

SafeShark provides a unique end-to-end compliance service in partnership with a Notified Body, helping manufacturers achieve full assurance from initial assessment to certification. This latest expansion reinforces SafeShark’s commitment to enabling global compliance and security across the connected technology sector.

Download our comprehensive compliance guides or book a test here.

IoT cyber security standards finally approved (nearly)

The new EN 18031 set of standards which are needed to demonstrate conformity to the upcoming IoT cyber security laws in RED, have finally been cited (with restrictions) in the OJEU* meaning that they can go a long way to provide a presumption of conformity to the RED cyber security articles 3.3 d, e, and f once the product has been tested against them.

This comes after months of discussions between the EC and standards body CEN/CENELEC whose industry working groups (which includes SafeShark), created the standards.

However, not all the comments that the EC raised as concerns regarding the EN 18031 standards could be resolved during the discussions which means the standards have some restrictions and cannot fully be taken as providing conformity depending on the product.

These restrictions relate to categories such as password strengths, parental or guardian access controls, and in the case of 18031-3 for products that support financial transactions, assessment criteria of secure updates. The full details of the implementation decision can be read here.

As such, a Notified Body will be required to sign off any elements of the product test results that relate to the restrictions, which in the case of 18031-3 will be likely mean all products.

For 18031-1 and 18031-2 it will be required to check whether the restrictions apply to the product under test and therefore whether a Notified Body assessment will be required.

SafeShark can test all the EN 18031 standards at our Central London test lab and works with Notified Body KL Certification to provide you with clear and accurate guidance as to whether Notified Body certification is required.

Due to our unique automated cyber security test platform, templates for completing pre-test information, example documents for a typical IoT device, and detailed knowledge of the standards, our test service is fast, efficient, and cost effective.

Book your product in for testing today and ensure you're ready for RED cyber security which comes into effect on the 1st Aug 2025

*The OJEU is the Official Journal of the EU which is essentially an index of standards that can be tested against to demonstrate conformity to the various articles of RED which cover criteria such as health and safety, EMC, RF and spectrum, and from 1st Aug 2025 - cyber security

Calling all manufacturers – EU connected device consultation

Further to the political agreement reached by the co-legislators on the Cyber Resilience Act (CRA), and pending its formal adoption and entry into force, the European Commission is currently taking preparatory steps for the CRA implementation. This includes initial informal consultations and a series of virtual events for manufacturers.

This is without prejudice to the formal consultation that will take place later in the process. These informal exchanges would, in particular, focus to identify any specificities regarding certain product category that should be addressed by the definition to provide manufacturers with legal certainty allowing them to understand whether the products they place on the market fall into the categories set out in Annex III and Annex IV of the CRA.

More information, timings and registration here.

SafeShark Exposes Alarming Non-compliance Rates in Connected Consumer Devices

Following this week’s conformance deadline (April 29th), SafeShark, the leading authority in connected product testing, has conducted analysis of more than 100 connected consumer devices currently on the market. The results show that a staggering three-quarters of these devices are still not compliant with the legal requirements set out in the Product Security and Telecoms Infrastructure Act.

SafeShark's testing revealed the concerning statistic that 92 of the 124 products (74%) we have checked in the past 24 hours fail to meet the necessary requirements. Plus,

The findings underscore the urgent need for manufacturers, retailers, and distributors to prioritise compliance to ensure consumer safety and satisfaction.

Non-compliance carries potentially severe penalties, including withdrawal from UK market access and fines of £10m or 4% of global turnover, whichever is higher. That’s before any legal repercussions or damage to brand reputation. As consumers increasingly rely on connected devices in their daily lives, it is imperative for businesses to uphold the standards of quality and safety set out in the legislation as a minimum.

Commenting on the results, SafeShark Director Alex Buchan said: "The level of non-compliance we've uncovered is deeply concerning. It's clear that many manufacturers are falling short in meeting the essential requirements for connected consumer devices. The legislation provides businesses with explicit guidance on what compliance entails, and the OPSS can enforce stringent penalties against companies that fail to adhere to these regulations. We urge all stakeholders in the industry to take immediate action to address these issues."

SafeShark stands ready to assist manufacturers, retailers, and distributors in navigating the complexities of compliance and ensuring their products meet the necessary standards. By partnering with SafeShark, businesses can streamline their compliance journey and safeguard their reputation in the marketplace.

For more information on SafeShark's testing services and how we can help your business achieve compliance please contact our team directly.