IoT Cybersecurity Regulations Worldwide

Çağatay Büyüktopçu, General Manager of CyberWhiz, discusses global regulations regarding IoT device security and significant steps taken by various nations on Wise TV. He outlines this critical period in which security standards for IoT devices are becoming mandatory under new laws in the UK and the European Union.

Countries have begun introducing IoT cybersecurity regulations one by one. The first of these was implemented in the UK; as of April 29, 2024, every IoT device sold or exported to the UK must comply with the Product Security and Telecommunications Infrastructure (PSTI) Act. Similarly, in the European Union, all internet-connected devices falling under the Radio Equipment Directive (RED) will be required to comply with cybersecurity regulations starting August 1, 2025. Furthermore, from 2028 onwards, many companies in the EU will be required to manage this process throughout the device’s lifecycle in the field. Driven by growing awareness, cybersecurity is now being included in assessments, ratings published in consumer electronics magazines, and product rankings for IoT devices. Alongside performance metrics—such as energy efficiency and fuel consumption—and price-performance comparisons, cyber resilience has become a key measurement parameter for connected devices. Various entities, particularly magazines in the UK, rank devices based on these attributes; indeed, a connected oven equipped with robust cybersecurity infrastructure was named “Product of the Year” in the UK last year thanks to its cyber resilience.

The Importance of Cybersecurity Regulations for IoT Devices

Today, the proliferation of IoT (Internet of Things) devices has been accompanied by a rise in cybersecurity threats. This trend has prompted nations and international organizations to introduce new regulations aimed at ensuring the security of IoT devices. First implemented in the UK, these regulations seek to enhance the security of IoT devices.

The UK’s PSTI Act

The UK aims to bolster IoT device security through the PSTI Act, which came into force on April 29, 2024. This legislation mandates that every IoT device sold or supplied in the UK must comply with specific security standards, thereby making the devices more resilient against cyberattacks.

The European Union’s RED Regulation

Taking a similar step, the European Union has mandated that, starting August 1, 2025, all internet-connected devices must comply with cybersecurity regulations under the Radio Equipment Directive (RED). This represents a significant move toward enhancing IoT device security across Europe.

Corporate Compliance and Management

From 2028 onwards, many companies in the European Union will be required to ensure compliance with these regulations throughout the entire lifecycle of their IoT devices. This necessitates more effective management of cybersecurity processes by companies. Growing awareness is encouraging businesses to adopt a more proactive approach in this area. Cybersecurity Assessments

Cybersecurity assessments for IoT devices have become a key criterion in ratings and product rankings published by consumer electronics magazines. Alongside performance metrics such as energy efficiency and fuel consumption, cyber resilience is now also evaluated as a measurement parameter.

Success Stories from the UK

In the UK, a connected oven featuring robust cybersecurity infrastructure was named “Product of the Year” thanks to its cyber resilience. Such success stories highlight, once again, the importance of IoT devices complying with cybersecurity standards.

Conclusion

Cybersecurity threats are rising alongside the proliferation of IoT devices. Regions such as the UK and the European Union are introducing new regulations to enhance the security of IoT devices against these threats. These regulations ensure that devices become more resilient to cyberattacks. Companies are required to comply with these regulations and manage the security of IoT devices throughout their entire lifecycle. Growing awareness has established cybersecurity assessment as a crucial criterion for IoT devices.