Agent WranglersConformity
Find each provision of EN 303 645, UK PSTI, EN 18031 and the Cyber Resilience Act next to the rules that meet it. Use it as your evidence index.
These tables map each law and standard to the rules that meet it. We checked them against the texts on 27 October 2026. A table is a starting point for your own evidence file, not proof of conformity. Keep the test results named in each rule's check, and keep them per model and firmware version.
ETSI EN 303 645
ETSI EN 303 645 V3.1.3 is the European baseline for consumer devices. The UK PSTI regulations and the EN 18031 standards both build on it.
| Provision | What it asks | Rules |
|---|---|---|
| 5.1-1, 5.1-2 | No universal default passwords | IOT-1 |
| 5.2-1 | A published vulnerability disclosure policy | IOT-38 |
| 5.3-4A, 5.3-6A | Automatic updates that the owner can postpone | IOT-14 |
| 5.3-4B | Recovery from a failed update | IOT-10 |
| 5.3-10 | A secure update mechanism | IOT-9 |
| 5.3-12 | Updates that respect the device's basic functions | IOT-13 |
| 5.3-13 | A published support period | IOT-35 |
| 5.3-16 | A model designation the owner can find | IOT-37 |
| 5.4-1, 5.4-2 | Sensitive security parameters stored securely | IOT-2, IOT-40 |
| 5.4-3, 5.4-4 | No hard-coded critical security parameters | IOT-3 |
| 5.5-1 | Secure communication | IOT-15 |
| 5.5-4 | Authentication before network access to functions | IOT-6 |
| 5.5-7 | Confidential transfer of security parameters | IOT-7 |
| 5.6-1, 5.6-2, 5.6-5 | A small attack surface | IOT-23, IOT-26, IOT-24 |
| 5.6-4A, 5.6-4B | Debug interfaces closed | IOT-25 |
| 5.7-1 | Secure boot | IOT-9, IOT-40 |
| 5.8-3 | Documented external sensors | IOT-31 |
| 5.9-1 to 5.9-3 | Resilience to outages | IOT-20, IOT-18 |
| 5.10-1 | Examining telemetry for security anomalies | IOT-28 |
| 5.11-1 to 5.11-4 | Easy deletion of user data | IOT-8, IOT-43 |
| 6-2, 6-3A, 6-3B, 6-7 | Consent and data minimisation | IOT-34, IOT-32 |
UK PSTI regulations
The Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023 have applied since 29 April 2024. Schedule 1 sets three duties.
| Schedule 1 | What it asks | Rules |
|---|---|---|
| Paragraph 1 | Passwords unique per product or set by the user | IOT-1 |
| Paragraph 2 | A published contact for security reports, with times for an acknowledgement and status updates | IOT-38 |
| Paragraph 3 | A published support period that is never shortened | IOT-35 |
EU radio rules and EN 18031
Delegated Regulation (EU) 2022/30 has applied since 1 August 2025. It switches on three essential requirements of the Radio Equipment Directive for internet-connected radio products. Commission Implementing Decision (EU) 2025/138 lists the EN 18031 standards that give a presumption of conformity, with restrictions. Read those restrictions before you rely on the standards alone.
| Requirement | Standard | Rules |
|---|---|---|
| Article 3(3)(d), no harm to the network | EN 18031-1 | IOT-1, IOT-9, IOT-15, IOT-18, IOT-23 |
| Article 3(3)(e), personal data and privacy | EN 18031-2 | IOT-7, IOT-8, IOT-31, IOT-34 |
| Article 3(3)(f), protection from fraud | EN 18031-3 | IOT-3, IOT-6, IOT-15 |
Cyber Resilience Act
Regulation (EU) 2024/2847 takes over from the radio rules for connected products. Its reporting duty has applied since 11 September 2026, and Annex I applies from 11 December 2027. The legal duties around it live in the compliance playbook.
| Annex I | What it asks | Rules |
|---|---|---|
| Part I, 2(b) | Secure by default, with a reset to the original state | IOT-1, IOT-8 |
| Part I, 2(c) | Security updates, automatic by default with an opt-out | IOT-14, IOT-9 |
| Part I, 2(d) | Protection from unauthorised access | IOT-6, IOT-15, IOT-16 |
| Part I, 2(e), 2(f) | Confidentiality and integrity of data | IOT-7, IOT-40 |
| Part I, 2(g) | Data minimisation | IOT-32, IOT-33 |
| Part I, 2(h) | Essential functions stay available | IOT-20, IOT-10 |
| Part I, 2(j) | A limited attack surface | IOT-23, IOT-25 |
| Part I, 2(m) | Secure removal of all data and settings | IOT-8, IOT-43 |
| Part II, 1 | A software bill of materials | IOT-39 |
| Part II, 4 | Published information on fixed vulnerabilities | IOT-37 |
| Part II, 5, 6 | A coordinated disclosure policy and a contact address | IOT-38 |
| Part II, 7, 8 | Secure and free distribution of updates | IOT-9, IOT-12 |
The support period itself and the reporting of exploited vulnerabilities are compliance rules. See handle vulnerabilities for the whole support period and report exploited vulnerabilities.
Sources
- ETSI EN 303 645 V3.1.3
- UK PSTI Regulations 2023, Schedule 1
- Commission Delegated Regulation (EU) 2022/30
- Commission Implementing Decision (EU) 2025/138
- Cyber Resilience Act, Regulation (EU) 2024/2847
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/connected-devices/conformity">Agent Wranglers connected devices playbook</a>. In code you write, add a comment next to it with the same link.