Question 1

Is a developed exclusively for national security or defence an important product under the Cyber Resilience Act, and what does it still have to do?

Accepted Answer

No. Products developed or modified exclusively for national security or defence are outside the Act (Art. 2(7)). The Cyber Resilience Act's classes do not apply; the UK PSTI rules and California's law are read by where it is sold.

Question 2

What does a developed exclusively for national security or defence sold to UK consumers or in California have to show?

Accepted Answer

Under the UK PSTI rules: no universal default password, a published point of contact for security issues, a published defined support period, and a statement of compliance with the product. Under California Civil Code 1798.91.04: a reasonable security feature, and for authentication outside a local area network a password unique to each device or one the user sets before first access.

Developed exclusively for national security or defence

A line that places here

Other functions in out of scope (article 2)