EU Cyber Resilience Act
for UK manufacturers

Yes. Regulation (EU) 2024/2847 applies to all products with digital elements made available on the EU market, regardless of where the manufacturer is based. A UK manufacturer selling into Germany, France, or any other EU Member State must comply with the CRA from 11 December 2027, and with vulnerability reporting obligations from 11 September 2026.

Partially. Both regimes share three core requirements: no default or easily guessable passwords, a published vulnerability disclosure process, and a defined security update support period. Manufacturers compliant with PSTI and ETSI EN 303 645 have a foundation for CRA compliance. However, the CRA requires additional steps: a full cybersecurity risk assessment, technical documentation per Annex VII, an SBOM, CE marking, and an EU Declaration of Conformity. PSTI compliance alone is not sufficient for CRA.

Yes, significantly. The PSTI Act applies only to consumer connectable products — it does not cover purely business-to-business products where it is not reasonably foreseeable that consumers would purchase them. The EU CRA applies to all products with digital elements placed on the EU market, including industrial hardware, software components, and B2B products. The CRA also covers software products separately placed on the market — not only physical connected devices.

Under Article 15 of Regulation (EU) 2024/2847, a manufacturer not established in the EU must appoint an EU-based authorised representative before placing products on the EU market. The authorised representative acts on behalf of the manufacturer and must be named in the EU Declaration of Conformity and technical documentation. This is a key practical step for UK manufacturers exporting to the EU post-Brexit.