UK UKCA and PSTI: The Dual Barriers for Connected Products Entering the UK Market After Brexit

Bottom line: After Brexit, the CE mark no longer works in England, Scotland and Wales. To get your connected product into the UK, UKCA is the access ticket and PSTI is the security gate. UKCA regulates "whether you can sell"; PSTI regulates "whether you sell without incidents". You only truly land a product in the UK after passing both. And PSTI has been mandatory since April 2024, with fines up to 4% of global annual turnover — this is not a joke.

1. UKCA: the "new CE" after Brexit

UKCA (UK Conformity Assessed) is the conformity-assessment mark formally adopted by the UK after Brexit, covering England, Scotland and Wales. In short, previously you stuck CE on to enter the UK; now you stick UKCA.

But note, this isn't just a label swap. UKCA's assessment routes, technical documentation and declaration of conformity are logically similar to CE, yet the system is independent. Many companies think "if CE passes, UKCA passes automatically" — that's the most common misjudgement.

Which products does UKCA cover? Anything previously governed by the CE mark is mostly within UKCA's scope. Especially your smart-home devices, cameras and wearables, which touch the Low Voltage Directive, EMC Directive and Radio Equipment Directive — all of these need to be re-assessed.

2. PSTI: the "security gate" for connected products

UKCA solves "product compliance"; PSTI solves "product security". PSTI stands for the Product Security and Telecommunications Infrastructure Act, and it imposes mandatory cybersecurity requirements on connected products, in force since April 2024.

Your smart-home devices, cameras and wearables are all within PSTI's scope. As long as the product can connect to the internet, there's no escaping it.

PSTI comes down to just three requirements — they sound simple, but the details are all in the implementation:

Each of these three has technical implementation and documentation requirements behind it. For instance, "no default weak passwords" isn't just setting a complex password — you need to eliminate the possibility of weak passwords at the product-design level.

3. Pitfalls that sink you the moment you hit them

In all these years of export certification, I've seen too many companies fall into the same traps. Here are the most typical:

Pitfall 1: Thinking CE still works. After Brexit, CE recognition on the UK (Great Britain island) has ended. If you still ship with CE, customs holding your goods is mild — it could be delisted and recalled. Pitfall 2: Doing only "surface compliance" for PSTI. For the vulnerability disclosure policy, many companies just leave an email. But PSTI requires an "effective response mechanism". If you leave an email nobody answers, it's still non-compliant. Pitfall 3: Writing the security update period as "forever". Some companies, to look good, declare "lifetime support" when they can't deliver it. PSTI requires "true, accurate and implementable" statements — overstating is planting a landmine for yourself. Pitfall 4: Doing UKCA and PSTI separately. Many companies do UKCA first, then PSTI, only to find the two sets of technical documentation don't align — huge rework cost. The two systems overlap; it's best to advance them in parallel. Pitfall 5: Ignoring the special situation of Northern Ireland. UKCA applies to England, Scotland and Wales; Northern Ireland has separate rules. Many companies think "the UK has one standard" and run into problems when the product enters Northern Ireland.

4. Your 5-step checklist right now

Don't panic. Follow this checklist and you'll basically smooth the path:

Step 1: Confirm product classification. Is your product a connected product? If so, both UKCA and PSTI apply. First do the product classification to determine which regulations apply. Step 2: Inventory your existing certifications. Look at the CE certificates and test reports you hold — which can still be used, which need redoing. UKCA and CE overlap on technical standards, but the assessment routes differ; don't skimp where you shouldn't. Step 3: Start a PSTI gap analysis. Against the three core requirements, check your product's current state item by item. Has the default-password mechanism changed? Is the vulnerability disclosure channel in place? Is the security update period set? Step 4: Prepare technical documentation in parallel. Organise UKCA and PSTI technical files together — don't do them in two passes. Doing it once is more efficient. Step 5: Get a professional assessment. Don't grind through it alone — UKCA and PSTI have too many details, and one slip lands you in a pit. Getting a reputable certification body to review it once is cheaper than rework later.

5. After 2026, the trend tightens further

The UK may have left the EU, but compliance trends haven't "gone independent". In 2026, the UK is still following the EU's new battery regulation and cybersecurity compliance trends. What does this mean? It means the UKCA and PSTI compliance you do now isn't a one-off — it's laying the foundation for stricter regulation in the future.

If you build the foundation well now, when new rules arrive you'll only need incremental adjustments. If you muddle through now, you'll have to tear it down and start over later.

Final thoughts

Exporting to the UK, UKCA and PSTI are two unavoidable thresholds. UKCA governs "identity", PSTI governs "security" — miss one and your product can't enter the UK market. And PSTI's penalties aren't a tickle: up to 4% of global annual turnover, which for many companies is a bone-deep number.

Don't wait until goods are detained to panic; don't wait until you're fined to regret. Compliance is always cheaper the earlier you start.

▍Have questions about the content? Leave a comment or DM me, note "UKCA"

We focus on export certification and testing, translating technical language into compliance language and keeping your compliance costs to a minimum.

CertFastLine Puhuazhike | Export Certification & Testing & Management Systems Consulting This article is a general compliance reference, not legal advice