UPDATED! UK and EU Cyber Security Legislation for Connected Devices

UPDATED: Our exclusive walkthrough of connected device legislation, which affects all connected products on the UK and EU markets, has been updated ahead of the April 29th deadline.

Get your copy now which:

From the requirements on all parts of the chain, to the criteria and standards you need to meet, we break down the issues in simple, straightforward language and outline the actions and solutions you need to put in place today.

Get it here

Beko selects SafeShark as ‘clear choice’ for compliance partner

Beko is the latest brand to demonstrate its connected device compliance using SafeShark’s proprietary PSTI testing – the quick, simple way to prove products are in line with legislation before the April 29th conformance deadline.

“Working with SafeShark has been a great experience for us at Beko,” said Arcelik Head of IoT Security Çağatay Büyüktopçu.  “As pioneers in IoT Cyber Security, ensuring compliance with PSTI is paramount for our business. SafeShark's dedication to device security aligns perfectly with our values, and their 'as-a-service' model provides us with the peace of mind for ongoing and continuous compliance.”

“From the outset, their agility and enthusiasm for IoT security stood out, making them the clear choice for our strategic partnership. SafeShark's fast response times, flexibility, and excellent communication have made them a trusted ally in securing our IoT products in line with the new legislation. We wholeheartedly recommend SafeShark to any organisation seeking a reliable and efficient compliance partner for connected devices.”

Manufacturers, distributors and retailers now have less than two months to ensure all connected consumer devices they sell meet the new legislative requirements. From April 29th this year they risk fines of up to £10m or 4% of global turnover (whichever is larger) and losing access to the UK market.

SafeShark’s quick, simple testing service ensures that won’t happen, issuing the government-mandated Statement of Compliance that must stay with the product throughout every stage of the distribution chain. Plus, thanks to our ongoing monitoring service, we can ensure that compliance throughout the lifetime of the product.

Beko is just one of the international brands passing their compliance burden to us to take care of, including the likes of LG, Philips, Lutron, Panasonic and many more.

Get in touch today and talk to one of our experts who can help determine if you’re in scope and what your next steps need to be.

Connected devices MUST comply from April 29th

On April 29th 2024, the UK will make history as the first country in the world to introduce ground-breaking protections for consumers using connectable devices, from smart phones and games consoles to smart doorbells, connected appliances and home systems.   

The regulatory regime, introduced through the Product Security and Telecommunications Infrastructure Act (PSTI) 2022 and the PSTI Regulations 2023, will position the UK as the global pioneer in enforcing new minimum cyber security standards, signalling a substantial leap forward in consumer protection. 

The Act and Regulations introduce a raft of new, common-sense protections like eliminating universal and easily guessable default passwords, providing a way to report issues to the manufacturers and ensuring manufacturers are transparent about how long a product will receive security updates.  Manufacturers, retailers and importers of smart devices must now ensure they comply with the law and all products must carry a ‘Statement of Compliance’ at all stages of the supply chain.

Unsure if your company or your products are in scope? Need help from the experts to guarantee your compliance and continued access to the UK market? Want to avoid a £10m penalty (or 4% of global turnover whichever is greater) if you aren’t compliant after April 29th? Get in touch today and we can help immediately with a free call with one of our dedicated experts.

New draft RED standards through the first review phase

SafeShark has been taking part in the latest standards development work in CEN/CENELEC, preparing for the introduction of the RED cyber security requirements in Aug 2025.

Three new standards have been developed EN 18031-1, -2, -3 which cover:

The first review involved national administrations e.g. BSI in the UK, reviewing the drafts and submitting comments. The comments are now being triaged and responded to before a second round of review.

Through our involvement in the work SafeShark is ensuring that its customers will have plenty of notice as to how they can prepare for the RED requirements.

Recording: DSIT and OPSS enforcement update

In this SafeShark webinar with the Department for Science, Innovation and Technology (DSIT), and the Office for Product Safety & Standards (OPSS) - the enforcement authority responsible for ensuring compliance with the PSTI regulations on behalf of DSIT - we asked those responsible for shaping the legislation, driving device safety and enforcing compliance to answer your questions.

Watch the recording of this insightful and lively session below.

The government-mandated deadline for compliance is April 29th 2024, with potential enforcement action including fines for those that fail to act set at £10million or 4% of global turnover – whichever is greater.

So, if you manufacture a consumer device that connects to the internet, or to other devices that connect to the internet (both wired and wireless), you need to act now. And SafeShark is here to help.

‘Smart’ is a major driver for those looking to move

A survey, carried out by Samsung, of 1,000 adults looking to move home in the next five years, combined with Google search trends analysis between March 2022 and March 2023, has shown that Smart is a key criteria for those looking for their next home.

A third of respondents would be much more likely to buy or rent a smart home (and pay up to 6.5% more for one) with a further third saying they would look to retrofit smart technology afterwards. A huge 86% said that ‘smart’ would be a consideration when selecting their next property.

The boom in demand and proliferation of devices and systems is, in part, what has driven the introduction of the Product Security and Telecommunications Bill by UK Government.

The legislation affects every single connectable device on the UK market and the deadline for compliance has now been confirmed as April 29th 2024.

Failure to comply with the requirements could result in products not being able to access the UK market and/or fines impacting global turnover.

This is in addition to EU market access requirements which are coming in from the 1st of August 2024 via the Radio Equipment Directive (RED).

SafeShark’s testing and certification service provides an efficient and trusted one-stop route to compliance for both the UK and EU markets.

We have worked with NCSC and UK Government since the outset of the Secure By Design initiative and throughout the legislative process, are active in standards bodies writing the requirements that underpins the legislation – ETSI EN 303 645 and trusted by major brands such as LG who have certified their TV platforms via SafeShark.

To find out more and start your compliance get in touch today.

Compliance deadline announced

Following the introduction of the Product Security and Telecommunications Bill last December, the UK Government has now set a date for when new cyber security regulations will apply to connectable products.

Businesses involved in the supply chains of connectable will need to be compliant with the new regime from the 29th April 2024. Failure to comply with the requirements could result in products not being able to access the UK market and/or fines impacting global turnover.

This is in addition to EU market access requirements which are coming in from the 1st of August 2024 via the Radio Equipment Directive (RED).

SafeShark’s testing and certification service backed by the British Standards Institute (BSI) provides a complete one-stop route to compliance for both the UK and EU markets.

SafeShark has been working with NCSC and UK Government since the outset of the Secure By Design initiative and is also active in standards bodies writing the requirements that underpins the legislation – ETSI EN 303 645.

We are trusted by major brands such as LG who have certified their TV platforms via SafeShark. To find out more and start your compliance get in touch today.

Full details on the UK requirements can be read here.

Three quarters of connected device manufacturers will be non-compliant

New research published today shows that the majority (73%) of IoT and connected device manufacturers would not be compliant with the imminent requirements of the Product Security and Telecoms Infrastructure bill. In fact, only just over one in four can rest easy knowing they will meet the initial bar. Read more here and get in touch if you want to move from non-compliant to competitive edge…

UPDATE: Draft EU rules target smart devices with cybersecurity risks

Smart devices connected to the internet such as fridges and TVs will have to comply with tough European Union cybersecurity rules or risk being fined or banned from the bloc. The EU executive announced its proposal, known as the Cyber Resilience Act, today (September 15). It is likely to become law following input from EU countries.

The announcement said:

The proposal for a regulation on cybersecurity requirements for products with digital elements, known as the Cyber Resilience Act, bolsters cybersecurity rules to ensure more secure hardware and software products.

Hardware and software products are increasingly subject to successful cyberattacks, leading to an estimated global annual cost of cybercrime of €5.5 trillion by 2021.

Such products suffer from two major problems adding costs for users and the society:

  1. a low level of cybersecurity, reflected by widespread vulnerabilities and the insufficient and inconsistent provision of security updates to address them, and
  2. an insufficient understanding and access to information by users, preventing them from choosing products with adequate cybersecurity properties or using them in a secure manner. 

While existing internal market legislation applies to certain products with digital elements, most of the hardware and software products are currently not covered by any EU legislation tackling their cybersecurity. In particular, the current EU legal framework does not address the cybersecurity of non-embedded software, even if cybersecurity attacks increasingly target vulnerabilities in these products, causing significant societal and economic costs.

Two main objectives were identified aiming to ensure the proper functioning of the internal market: 

  1. create conditions for the development of secure products with digital elements by ensuring that hardware and software products are placed on the market with fewer vulnerabilities and ensure that manufacturers take security seriously throughout a product’s life cycle; and
  2. create conditions allowing users to take cybersecurity into account when selecting and using products with digital elements.

Four specific objectives were set out:

  1. ensure that manufacturers improve the security of products with digital elements since the design and development phase and throughout the whole life cycle;
  2. ensure a coherent cybersecurity framework, facilitating compliance for hardware and software producers;
  3. enhance the transparency of security properties of products with digital elements, and
  4. enable businesses and consumers to use products with digital elements securely.

More information and downloads available here.