Cyber Resilience Act - latest updates from the European Commission

Yesterday the EC Policy team gave an update on the Cyber Resilience Act (CRA) which is set to become the latest cyber security regulation to govern connected products. Points to note are:

New cyber security standards expected from standards bodies by Dec 2026
A centralised vulnerability reporting database will be developed by Enisa by Sept 2026 - in time for CRA reporting requirements
Classifications of "Important" and "Critical" products are to be defined in more detail by Dec 2025

In general the CRA is a new set of cybersecurity rules for placing of products on the EU - it will expand on RED requirements (coming into force Aug 1^st 2025) by massively increasing the range of products that fall into its scope - products with "Digital Elements" will include software products, apps, and remote data processing solutions as well as hardware. Another key element is that the CRA is centred around the premise that compliance is maintained throughout the product lifetime.

CRA will come into force in two stages which are:

Vulnerability reporting obligations: 11th September 2026
Essential requirements: 11th December 2027

To prepare for CRA - SafeShark is providing product testing against the EC mapping for current standards e.g. EN 303 645 and EN 18031, that can already provide a level of conformity for CRA - helping you get ahead of the legislation.

SafeShark also provides straightforward PSTI and RED compliance testing, that allows you to quickly prove your consumer electronic product is ready for UK or EU market access in order to meet the 1st Aug deadline. Get in touch to find out more from our experts.

SafeShark partners with CyberWhiz to expand compliance services across Europe

SafeShark, the UK’s leading cybersecurity compliance and assurance provider for connected devices, has announced a new partnership with CyberWhiz, a specialist IoT cybersecurity solutions provider and compliance consultancy, to expand its services in Europe. CyberWhiz will act as an official agent for SafeShark’s services in the EU supporting manufacturers in ensuring regulatory compliance and cybersecurity resilience in an increasingly complex global market.

The partnership enables even more manufacturers across Europe to access SafeShark’s industry-leading compliance solutions, including testing against EN18031 for the EU Radio Equipment Directive (RED) and UK PSTI regulations. With CyberWhiz’s deep local expertise and industry relationships, the collaboration will help businesses navigate evolving regulatory requirements while maintaining product security and market access.

SafeShark Director and DTG CTO Alex Buchan said: “This partnership with CyberWhiz is a key milestone in SafeShark’s mission to support manufacturers worldwide in meeting the highest cybersecurity and compliance standards. CyberWhiz’s extensive customer base in Europe’s major manufacturing hubs such as Turkey makes it essential that these businesses have access to robust, streamlined compliance solutions, and we are delighted to work with CyberWhiz to provide this support.”

CyberWhiz CEO Çağatay Büyüktopçu said: “We are delighted to launch this strategic partnership with SafeShark. Our goal is to support manufacturers across Europe, particularly in major production hubs like Turkey, in meeting increasingly complex cybersecurity regulations. By combining SafeShark’s comprehensive testing and certification processes with CyberWhiz’s holistic IoT Cyber Security expertise and regional leadership, we will provide manufacturers with a fast, cost-effective, and efficient compliance journey. This collaboration marks a significant step in our mission to ensure the highest standards of IoT security.”

SafeShark provides a unique end-to-end compliance service in partnership with a Notified Body, helping manufacturers achieve full assurance from initial assessment to certification. This latest expansion reinforces SafeShark’s commitment to enabling global compliance and security across the connected technology sector.

Download our comprehensive compliance guides or book a test here.

IoT cyber security standards finally approved (nearly)

The new EN 18031 set of standards which are needed to demonstrate conformity to the upcoming IoT cyber security laws in RED, have finally been cited (with restrictions) in the OJEU* meaning that they can go a long way to provide a presumption of conformity to the RED cyber security articles 3.3 d, e, and f once the product has been tested against them.

This comes after months of discussions between the EC and standards body CEN/CENELEC whose industry working groups (which includes SafeShark), created the standards.

However, not all the comments that the EC raised as concerns regarding the EN 18031 standards could be resolved during the discussions which means the standards have some restrictions and cannot fully be taken as providing conformity depending on the product.

These restrictions relate to categories such as password strengths, parental or guardian access controls, and in the case of 18031-3 for products that support financial transactions, assessment criteria of secure updates. The full details of the implementation decision can be read here.

As such, a Notified Body will be required to sign off any elements of the product test results that relate to the restrictions, which in the case of 18031-3 will be likely mean all products.

For 18031-1 and 18031-2 it will be required to check whether the restrictions apply to the product under test and therefore whether a Notified Body assessment will be required.

SafeShark can test all the EN 18031 standards at our Central London test lab and works with Notified Body KL Certification to provide you with clear and accurate guidance as to whether Notified Body certification is required.

Due to our unique automated cyber security test platform, templates for completing pre-test information, example documents for a typical IoT device, and detailed knowledge of the standards, our test service is fast, efficient, and cost effective.

Book your product in for testing today and ensure you're ready for RED cyber security which comes into effect on the 1^st Aug 2025

*The OJEU is the Official Journal of the EU which is essentially an index of standards that can be tested against to demonstrate conformity to the various articles of RED which cover criteria such as health and safety, EMC, RF and spectrum, and from 1^st Aug 2025 - cyber security

Calling all manufacturers – EU connected device consultation

Further to the political agreement reached by the co-legislators on the Cyber Resilience Act (CRA), and pending its formal adoption and entry into force, the European Commission is currently taking preparatory steps for the CRA implementation. This includes initial informal consultations and a series of virtual events for manufacturers.

This is without prejudice to the formal consultation that will take place later in the process. These informal exchanges would, in particular, focus to identify any specificities regarding certain product category that should be addressed by the definition to provide manufacturers with legal certainty allowing them to understand whether the products they place on the market fall into the categories set out in Annex III and Annex IV of the CRA.

More information, timings and registration here.

SafeShark Exposes Alarming Non-compliance Rates in Connected Consumer Devices

Following this week’s conformance deadline (April 29^th), SafeShark, the leading authority in connected product testing, has conducted analysis of more than 100 connected consumer devices currently on the market. The results show that a staggering three-quarters of these devices are still not compliant with the legal requirements set out in the Product Security and Telecoms Infrastructure Act.

SafeShark's testing revealed the concerning statistic that 92 of the 124 products (74%) we have checked in the past 24 hours fail to meet the necessary requirements. Plus,

Only 41% of the manufacturer websites had information about their vulnerability disclosure process - which is a mandatory provision in the legislation;
Only one quarter of product websites had the PSTI standard security support date mentioned for the product. Interestingly, 10% of products had PSTI information but did not quote the security support period as specified by the Act.

The findings underscore the urgent need for manufacturers, retailers, and distributors to prioritise compliance to ensure consumer safety and satisfaction.

Non-compliance carries potentially severe penalties, including withdrawal from UK market access and fines of £10m or 4% of global turnover, whichever is higher. That’s before any legal repercussions or damage to brand reputation. As consumers increasingly rely on connected devices in their daily lives, it is imperative for businesses to uphold the standards of quality and safety set out in the legislation as a minimum.

Commenting on the results, SafeShark Director Alex Buchan said: "The level of non-compliance we've uncovered is deeply concerning. It's clear that many manufacturers are falling short in meeting the essential requirements for connected consumer devices. The legislation provides businesses with explicit guidance on what compliance entails, and the OPSS can enforce stringent penalties against companies that fail to adhere to these regulations. We urge all stakeholders in the industry to take immediate action to address these issues."

SafeShark stands ready to assist manufacturers, retailers, and distributors in navigating the complexities of compliance and ensuring their products meet the necessary standards. By partnering with SafeShark, businesses can streamline their compliance journey and safeguard their reputation in the marketplace.

For more information on SafeShark's testing services and how we can help your business achieve compliance please contact our team directly.

UPDATED! UK and EU Cyber Security Legislation for Connected Devices

UPDATED: Our exclusive walkthrough of connected device legislation, which affects all connected products on the UK and EU markets, has been updated ahead of the April 29^th deadline.

Get your copy now which:

Adds more guidance about the products (and businesses) in scope
Includes new detailed information for retailers, distributors and installers about the requirements on them
Expands the section about the Statement of Compliance and the specific conditions that need to be met
Updates key compliance dates for both UK and EU
Provides new information about how to make sure you are covered (or certified that you don’t need to be) by the April 29^th deadline.

From the requirements on all parts of the chain, to the criteria and standards you need to meet, we break down the issues in simple, straightforward language and outline the actions and solutions you need to put in place today.

Get it here

Oxford Professor warns government over smart speaker vulnerability

Oxford University Professor of Cybersecurity Sadie Creese has warned against the potential security threat from smart speakers while giving evidence to the Science, Technology and Innovation Select Committee.

She made particular reference, according to a piece in The Times to ‘senior leaders’ and the potential for threat actors to profile them and the way they live using vulnerabilities in the technology.

She told The Times: “… any devices that give away how you live — will make you more targetable. So I would advise people in those kinds of [senior leadership] positions, where they may well be targeted, against having these things in their environment. Just like I would advise against putting a camera in their living room. It just potentially gives an attacker more information about them that can be used to craft targeted attacks.”

The piece also highlights research that found 57% of connected devices were vulnerable to medium or high severity attacks.

SafeShark testing can allay these concerns by not only guaranteeing the cyber security compliance of connected devices with the new PSTI requirements, but because we test against the whole ETSI EN 303 645 specification (the harmonised international standard for cyber security of IoT devices), meaning manufacturers, retailers and their customers can have confidence in the security of their devices.

Get in touch to start your compliance journey with us today.

Beko selects SafeShark as ‘clear choice’ for compliance partner

Beko is the latest brand to demonstrate its connected device compliance using SafeShark’s proprietary PSTI testing – the quick, simple way to prove products are in line with legislation before the April 29^th conformance deadline.

“Working with SafeShark has been a great experience for us at Beko,” said Arcelik Head of IoT Security Çağatay Büyüktopçu. “As pioneers in IoT Cyber Security, ensuring compliance with PSTI is paramount for our business. SafeShark's dedication to device security aligns perfectly with our values, and their 'as-a-service' model provides us with the peace of mind for ongoing and continuous compliance.”

“From the outset, their agility and enthusiasm for IoT security stood out, making them the clear choice for our strategic partnership. SafeShark's fast response times, flexibility, and excellent communication have made them a trusted ally in securing our IoT products in line with the new legislation. We wholeheartedly recommend SafeShark to any organisation seeking a reliable and efficient compliance partner for connected devices.”

Manufacturers, distributors and retailers now have less than two months to ensure all connected consumer devices they sell meet the new legislative requirements. From April 29^th this year they risk fines of up to £10m or 4% of global turnover (whichever is larger) and losing access to the UK market.

SafeShark’s quick, simple testing service ensures that won’t happen, issuing the government-mandated Statement of Compliance that must stay with the product throughout every stage of the distribution chain. Plus, thanks to our ongoing monitoring service, we can ensure that compliance throughout the lifetime of the product.

Beko is just one of the international brands passing their compliance burden to us to take care of, including the likes of LG, Philips, Lutron, Panasonic and many more.

Get in touch today and talk to one of our experts who can help determine if you’re in scope and what your next steps need to be.

Connected devices MUST comply from April 29th

On April 29^th 2024, the UK will make history as the first country in the world to introduce ground-breaking protections for consumers using connectable devices, from smart phones and games consoles to smart doorbells, connected appliances and home systems.  

The regulatory regime, introduced through the Product Security and Telecommunications Infrastructure Act (PSTI) 2022 and the PSTI Regulations 2023, will position the UK as the global pioneer in enforcing new minimum cyber security standards, signalling a substantial leap forward in consumer protection.

The Act and Regulations introduce a raft of new, common-sense protections like eliminating universal and easily guessable default passwords, providing a way to report issues to the manufacturers and ensuring manufacturers are transparent about how long a product will receive security updates.  Manufacturers, retailers and importers of smart devices must now ensure they comply with the law and all products must carry a ‘Statement of Compliance’ at all stages of the supply chain.

Unsure if your company or your products are in scope? Need help from the experts to guarantee your compliance and continued access to the UK market? Want to avoid a £10m penalty (or 4% of global turnover whichever is greater) if you aren’t compliant after April 29^th? Get in touch today and we can help immediately with a free call with one of our dedicated experts.

New draft RED standards through the first review phase

SafeShark has been taking part in the latest standards development work in CEN/CENELEC, preparing for the introduction of the RED cyber security requirements in Aug 2025.

Three new standards have been developed EN 18031-1, -2, -3 which cover:

Part 1 common security requirements for internet connected radio equipment;
Part 2 internet connected radio equipment that processes personal, traffic, or location data, as well as products for childcare, toys, and wearables; and
Part 3 internet connected radio equipment that enables the holder or user to transfer money, monetary value or virtual currency.

The first review involved national administrations e.g. BSI in the UK, reviewing the drafts and submitting comments. The comments are now being triaged and responded to before a second round of review.

Through our involvement in the work SafeShark is ensuring that its customers will have plenty of notice as to how they can prepare for the RED requirements.