UK Product Security and Telecommunications Infrastructure Act
The PSTI Act and its 2023 security regime make three baseline security requirements legally binding on consumer connectable products sold in the UK: no universal default passwords, a published vulnerability disclosure policy, and a published minimum security update period. It is small, it is enforced, and it is the first regime anywhere to make a machine-readable security commitment a condition of sale — which is the model the EU Cyber Resilience Act then scaled up.
Countries
Where this binds. Each links to the providers apis.io has catalogued there.
Regions
Industries
Each links to that industry as a scored cohort — so the question "how ready is this sector for the regime that governs it?" becomes one you can actually look at.
Implemented by these standards
A regulation is the law; a standard is the machine-readable contract that satisfies it. Almost every regime in this catalog restricts an interface rather than requiring one — where a standard exists, it is the part a provider can actually publish.