Quiz Entry - updated: 2026.10.13
Which product security laws and regulations apply in the EU, the US, China, the UK and Switzerland?
EU: CRA, Cybersecurity Act, NIS2, Data Act, RED delegated act, MDR/IVDR, GDPR, AI Act. US: FDA cybersecurity guidance, California SB-327, Oregon HB 2395, HIPAA, PCI DSS and others. China: CSL, DSL, PIPL and GB standards. UK: PSTI. Switzerland: ISG (and the data protection act).
| Market | Key product security laws |
|---|---|
| EU | Cyber Resilience Act; Cybersecurity Act (EU certification schemes such as EUCC); NIS2; Data Act; Radio Equipment Directive art. 3.3 (d)(e)(f), covering network protection, privacy and fraud; MDR/IVDR for medical devices; GDPR; AI Act |
| US | FDA premarket cybersecurity guidance; California SB-327 and Oregon HB 2395 (no default passwords for connected devices); CCPA/CPRA; IoT Cybersecurity Improvement Act for federal procurement; sector rules such as HIPAA/HITECH, PCI DSS, SOX, GLBA; 15 CFR 791 (rules on connected vehicles from foreign adversaries) |
| China | Cybersecurity Law (CSL), Data Security Law (DSL), Personal Information Protection Law (PIPL), national GB standards |
| UK | Product Security and Telecommunications Infrastructure Act (PSTI) |
| Switzerland | Information Security Act (ISG); revised data protection act (DSG) |
| Global | UN R155 for vehicles; ICAO resolution A41-19 for civil aviation |
The picture is a patchwork. A product sold in the EU, the US and China has to meet all three sets, which is why the classification phase starts with identifying target markets.
Go deeper:
FDA — Cybersecurity in medical devices (premarket guidance) — what the US requires for a medical device submission- UK government — The PSTI product security regime — the UK consumer IoT law