IoT security regulation tracker
A dated table of IoT security obligations: the EU Cyber Resilience Act and radio equipment rules, UK PSTI, the U.S. Cyber Trust Mark, ETSI EN 303 645 and California SB-327.
Connected products now face security rules in the EU, the UK and several US states, plus a voluntary US label and a European baseline standard that the rules lean on. This tracker lists the dates that matter to a product team, in order, with what each one requires and a link to the legal text or the regulator's page. For what the rules mean in practice, read which IoT security laws apply to your product and the glossary entries for the Cyber Resilience Act, the PSTI Act, the Cyber Trust Mark and ETSI EN 303 645.
Last checked 22 October 2026. Status and day counts were computed on 25 October 2026 and are updated in your browser to today's date. This is an engineering overview, not legal advice. Every fact on this page links to its primary source. If something has changed, write to us and it will be corrected and logged on the editorial policy page.
Dated obligations
11 entries, oldest first| Date | Status today | Jurisdiction | Rule | What it requires | Source |
|---|---|---|---|---|---|
| In force for 2489 days | California, US | SB-327, Civil Code 1798.91.04 (security of connected devices) | Manufacturers of connected devices sold in California must fit "reasonable security" features. For a device that authenticates from outside the local network, a preprogrammed password unique to each device, or forcing the user to create new credentials before first access, counts as reasonable. Enforced only by the Attorney General and city, county and district attorneys; no private right of action. | SB-327 chaptered text (California Legislative Information) | |
| In force for 909 days | United Kingdom | Product Security and Telecommunications Infrastructure (PSTI) regime | Consumer connectable products made available in the UK: no universal default passwords (unique or user-set, not easily guessable), published information on how to report security issues, and a published minimum period of security updates with an end date. | SI 2023/1007, regulation 1 (legislation.gov.uk) UK government guidance (GOV.UK) | |
| Published for 784 days | Europe (standard) | ETSI EN 303 645 V3.1.3, cyber security for consumer IoT | Baseline security provisions for consumer IoT products, from no universal default passwords and a vulnerability disclosure policy to secure updates, secure storage and communication, and easy deletion of user data. A standard, not a law: it applies when a regulation, a contract or a label scheme refers to it. | ETSI EN 303 645 V3.1.3 (PDF, etsi.org) | |
| In effect, voluntary for 776 days | United States | U.S. Cyber Trust Mark (FCC IoT labeling program) | Voluntary label for consumer wireless IoT products that pass testing against the FCC program's criteria, with a QR code that leads to the product's security information. The FCC adopted the rules in March 2024; the date shown is when the rules took effect. Still being set up: the FCC selected the ioXt Alliance as the new Lead Administrator on 13 April 2026, conditionally approved label administrators and opened a new filing window on 11 August 2026, and recognised two accreditation bodies (A2LA and ANAB) on 28 September 2026. | FCC program page (rules effective 9 September 2024) FCC Report and Order, March 2024 DA 26-354, 13 April 2026 DA 26-834, 11 August 2026 DA 26-1029, 28 September 2026 | |
| In force for 684 days | European Union | Cyber Resilience Act, Regulation (EU) 2024/2847: entry into force | The regulation becomes law (published in the Official Journal on 20 November 2024, in force twenty days later). Its obligations apply from the later dates below. | Regulation (EU) 2024/2847, Art. 71 (EUR-Lex) | |
| Published for 633 days | European Union | EN 18031-1, -2 and -3 cited as harmonised standards under the Radio Equipment Directive | Commission Implementing Decision (EU) 2025/138 lists EN 18031-1:2024 (internet-connected radio equipment), EN 18031-2:2024 (equipment processing personal data, including toys, childcare and wearable equipment) and EN 18031-3:2024 (equipment handling virtual money or monetary value). They give a presumption of conformity with restrictions: for example, not where the user may choose not to set any password. | Implementing Decision (EU) 2025/138 (EUR-Lex) | |
| In force for 450 days | European Union | Radio Equipment Directive Delegated Regulation (EU) 2022/30 | Radio equipment in the covered categories (internet-connected equipment, equipment processing personal data including toys, childcare and wearable equipment, and equipment handling money) must meet the essential requirements of Article 3(3)(d), (e) and (f) of Directive 2014/53/EU: no harm to the network, protection of personal data and privacy, protection from fraud. Application was moved to this date by Delegated Regulation (EU) 2023/2444. | Delegated Regulation (EU) 2022/30 (EUR-Lex) Delegated Regulation (EU) 2026/339, recital 2 (EUR-Lex) | |
| In force for 136 days | European Union | Cyber Resilience Act: notification of conformity assessment bodies (Chapter IV) | Articles 35 to 51 apply: the rules under which Member States notify the bodies that carry out third-party conformity assessment. | Regulation (EU) 2024/2847, Art. 71 (EUR-Lex) | |
| In force for 44 days | European Union | Cyber Resilience Act: reporting obligations of manufacturers (Article 14) | Manufacturers notify actively exploited vulnerabilities and severe incidents to the coordinating CSIRT and ENISA through the single reporting platform. For an exploited vulnerability: early warning within 24 hours, notification within 72 hours, final report no later than 14 days after a fix or mitigation is available. | Regulation (EU) 2024/2847, Articles 14 and 71 (EUR-Lex) | |
| Upcoming in 412 days | European Union | Cyber Resilience Act: full application | Products with digital elements placed on the EU market must meet the essential cybersecurity requirements of Annex I, go through conformity assessment and carry the CE marking. Manufacturers handle vulnerabilities for a support period of at least five years, unless the product is expected to be in use for less time. | Regulation (EU) 2024/2847, Articles 13(8) and 71 (EUR-Lex) | |
| Upcoming in 412 days | European Union | Delegated Regulation (EU) 2022/30 repealed by Delegated Regulation (EU) 2026/339 | The radio-equipment cybersecurity rules end when the Cyber Resilience Act applies in full, so that products are not covered twice. Equipment placed on the market between 1 August 2025 and 10 December 2027 stays subject to market surveillance under the old rules. | Delegated Regulation (EU) 2026/339, Article 1 (EUR-Lex) |
What is not in the table
Only dates we could confirm on an official source are listed. The IEC 62443 series for industrial components and the EU NIS2 directive, which places duties on operators rather than on products, are covered in the regulation guide. Other national and state rules will be added once checked against their official texts.
More tools: all IoT tools. Building a smart home product? See the Matter support table.