[Home](/)/[Resources](/resources)/UKCA IoT Devices IoT / Connected ProductsUK RegulationsPSTI Act # UKCA Marking for IoT Devices and Connected Products IoT products entering the Great Britain market face three overlapping compliance obligations: Radio Equipment Regulations for wireless functionality, EMC Regulations for electromagnetic compatibility, and the PSTI Act's mandatory cybersecurity requirements. Getting all three right — and understanding which apply to your specific product — determines whether you can legally sell in the UK. Copy Link[Share on WhatsApp](https://wa.me/?text=https%3A%2F%2Fkrono-labs.com%2Fguides%2Fukca-iot-devices) ## UK regulatory stack for IoT products ### Radio Equipment Regulations 2017 (as amended) **Applies to:** Any product with a wireless transmitter or receiver operating in regulated spectrum **Marking:** UKCA (or CE accepted in GB) **Assessment:** Self-assessment possible for most devices using GB-designated standards ### Electromagnetic Compatibility Regulations 2016 **Applies to:** All electrical and electronic equipment — even products with no intentional radio **Marking:** UKCA (or CE accepted in GB) **Assessment:** Self-assessment with designated standards ### Electrical Equipment (Safety) Regulations 2016 **Applies to:** Mains-powered or externally charged devices (USB-C, AC adapter) **Marking:** UKCA (or CE accepted in GB) **Assessment:** Self-assessment with designated standards ### Product Security and Telecommunications Infrastructure (PSTI) Act 2022 **Applies to:** Consumer connectable products (Wi-Fi, Bluetooth, cellular, Zigbee, Z-Wave, Thread) **Marking:** Statement of Compliance (not a mark — a document) **Assessment:** Self-assessment; manufacturer/importer issues Statement of Compliance ## Key UK designated standards for IoT EN 300 328 v2.2.22.4 GHz WLAN and Bluetooth — wideband transmission systems EN 301 893 v2.1.15 GHz high performance RLAN (Wi-Fi 5/6) EN 301 489-1 / -17EMC for radio equipment — general and specific for broadband EN 62368-1 (BS EN 62368-1)Audio/video and IT equipment safety — replaces LVD for many IoT products EN 301 489-3Short Range Devices (SRD): Zigbee, Z-Wave, proprietary RF EN 300 220 seriesSRDs in 868 MHz and other non-harmonised sub-GHz bands Always verify against the current GB-designated standards list on gov.uk before relying on any standard for conformity. ## PSTI Act: The three minimum security requirements The Product Security and Telecommunications Infrastructure (PSTI) Act 2022, which came into force on 29 April 2024, introduces mandatory minimum cybersecurity requirements for consumer connectable products. These are not optional guidance — they are legal obligations for manufacturers and importers. 01 ### No universal default passwords Each unit must have a unique default password, or the user must set a password on first use. Passwords must not be incrementable or based on public device information (e.g., MAC address). 02 ### Vulnerability disclosure policy Manufacturer must provide a published point of contact for security researchers to report vulnerabilities, and must state the minimum period vulnerabilities will be addressed. 03 ### Minimum software update support period Manufacturer must define and publish the minimum period for which the product will receive security updates. This must be prominently communicated to consumers at point of sale. ## Learn this properly, not just for one product In-depth courses and books that teach the process — not a one-off answer you'll need to look up again next time. [Start the course — $149](/courses/09-ukca-marking-for-electronics-products)See your free roadmap [Prefer to read? Get the book — $24.99](/books/09-ukca-marking-for-electronics-products) ## Frequently asked questions ### Does PSTI apply to all IoT products sold in the UK? PSTI applies to 'consumer connectable products' — broadly any product with internet or network connectivity sold to consumers in the UK (including Great Britain and Northern Ireland). B2B-only products, medical devices, smart meters, laptops, desktop computers, and certain other product types are explicitly exempted. If your IoT device is sold to consumers via any channel including e-commerce, PSTI likely applies. ### Can my EU CE marking cover the UK market for IoT? CE marking continues to be accepted in Great Britain indefinitely for most radio equipment and EMC/LVD regulations. However, PSTI compliance is a UK-specific obligation with no EU equivalent — CE marking does not satisfy PSTI. You need to separately issue a UK Statement of Compliance covering the three PSTI minimum security requirements before selling connected consumer products in the UK. ### What is the penalty for PSTI non-compliance? OPSS (Office for Product Safety and Standards) can issue compliance notices, stop notices, and monetary penalties. Financial penalties can reach £10 million or 4% of global turnover, whichever is higher, for serious breaches. Enforcement is active — OPSS has conducted market surveillance operations on connected products since the Act came into force in April 2024. ### Do I need to test against both UK and EU standards for IoT? For most common IoT radio protocols (Wi-Fi 2.4 GHz, Bluetooth LE), the GB-designated standards are technically identical to the EU harmonised standards, so a single set of test reports typically covers both markets. The differences emerge for some frequency allocations and specific product categories. Always cross-reference the current GB-designated standards list on the UK government website against your EU test reports before using them for UK compliance. 🇬🇧 UK roadmap for your product Every standard, document, and test that applies — free, no account required. See your free roadmap[ Want an expert to take your product through 🇬🇧 UK compliance for you? One consultant from Krono's compliance team takes your product from requirements to legal sale, with a fixed quote before any work starts. See compliance services](/services) Learn this properly In-depth course that teaches the full process, not just this one answer. [Start the course — $149](/courses/09-ukca-marking-for-electronics-products)[Prefer to read? Get the book — $24.99](/books/09-ukca-marking-for-electronics-products) Related guides * [UKCA Marking: Complete GuideComplete guide to UKCA marking for the Great Britain market: requirements, timeline, costs, GB vs NI differences, and how to tr…](/guides/ukca-marking) * [UK Radio Equipment RegulationsComplete guide to UK Radio Equipment Regulations for GB market: UKCA marking, designated standards, testing requirements, and t…](/guides/uk-radio-equipment) * [UK PSTI Act Cybersecurity RequirementsComplete guide to UK PSTI Act 2022 cybersecurity requirements: which connected products are in scope, the three mandatory minim…](/guides/uk-psti-cyber-requirements) * [UKCA Marking for WearablesComplete guide to UKCA marking for wearables and smart accessories in Great Britain: applicable UK regulations, SAR testing for…](/guides/ukca-wearables) * [UK Designated StandardsComplete guide to UK designated standards for UKCA marking: how designated standards differ from harmonised standards, where to…](/guides/uk-designated-standards) Educational resource only. UKCA and PSTI compliance responsibility remains with the manufacturer, importer, or UK Responsible Person. Always verify current UK regulations before placing products on the market.