WiFi plugs, thermostats and sensors: radio approvals plus the cybersecurity regulations that now apply to connected products.
A smart home product is a radio product, a consumer appliance and a networked device at the same time - and since 2024-2025, all three identities carry regulatory weight. The radio decides your FCC/RED path; being 'connectable' now triggers cybersecurity law in both the EU and the UK.
These cybersecurity requirements are new enough that many quotations still omit them entirely. For a WiFi plug sold into Europe, the RED cybersecurity articles are as mandatory as the RF tests - and market surveillance is starting to look.
| Market | Typical requirements | Notes |
|---|---|---|
| United States | FCC ID for WiFi/Zigbee/Thread radios (or Part 15B for non-radio models); retailer safety reports to UL 62368-1 framework | Battery models add UN38.3 transport documentation |
| European Union | RED 2014/53/EU: radio + EMC + safety + RoHS, and since August 2025 the cybersecurity articles 3.3(d)/(e)/(f) with EN 18031 as the harmonized reference | Applies to connected radio products placed on the EU market |
| United Kingdom | UKCA radio and safety; PSTI security requirements for consumer connectable products (in force since April 2024) | PSTI is a statement of compliance, separate from UKCA marks |
| India / Korea / Australia | BIS CRS, KC, RCM as applicable to the product category | Radio and safety approvals are separate documents |
Selling a connected product into the EU or UK? Send us the product description and radio list, and we will show you which cybersecurity requirements apply on top of the usual radio testing.
EN 18031 is the harmonized standard set supporting the Radio Equipment Directive's cybersecurity articles (3.3 d/e/f), which apply to connected radio products placed on the EU market since August 2025. It covers network protection, privacy and fraud resistance.
Yes. PSTI is a separate legal regime for consumer connectable products in the UK, requiring a statement of compliance with minimum security features such as unique per-device passwords and vulnerability disclosure policies. UKCA and PSTI coexist.
Each radio function must be covered by the approval documentation. A single certification process can include multiple radios, but all modes and bands must be declared and tested - discovering an undisclosed Zigbee module during review will pause the project.