Security baselines and the law

Key points

1. ETSI EN 303 645 is a European baseline for consumer IoT security. Its first provisions are no universal default passwords, a way to report vulnerabilities, and keeping software updated.¹
2. The UK Product Security and Telecommunications Infrastructure regime, in force since 29 April 2024, bans universal default passwords on consumer connectable products and requires a vulnerability-reporting contact and a stated minimum security-update period.²³as of 6 October 2026
3. The EU Cyber Resilience Act entered into force on 10 December 2024. Manufacturers' vulnerability- and incident-reporting obligations have applied since 11 September 2026, and its main requirements apply from 11 December 2027.⁴⁵as of 6 October 2026
4. Since 1 August 2025, EU radio equipment that connects to the internet, plus radio toys, childcare products and wearables handling personal data, must meet Radio Equipment Directive security rules. EN 18031 standards are one way to comply, with restrictions. The Cyber Resilience Act takes over on 11 December 2027.⁶⁷⁸as of 6 October 2026
5. In India, the National Centre for Communication Security (NCCS) under the Department of Telecommunications publishes Indian Telecom Security Assurance Requirements (ITSARs), used for security testing and certification. Notified ITSARs cover IoT devices such as smart cameras and smart meters.⁹as of 6 October 2026