⁦UK PSTI (connected products)⁩

⁦United Kingdom⁩ الأمن السيبراني

الحالة

⁦In force. Act Part 1 framework from 6 Dec 2022; security requirements and statement-of-compliance rules apply since 29 Apr 2024 (SI 2023/1007). Amended by SI 2025/211 (25 Feb 2025) and SI 2025/1267 (4 Dec 2025).⁩✓⁦SI 2023/1007 reg 1(2) (in force 29 Apr 2024); SI 2025/211 reg 1; SI 2025/1267 reg 1 ·⁩ المصادر: ⁦legislation.gov.uk⁩, ⁦cooley.com⁩

على من ينطبق

⁦Manufacturers, importers and distributors of⁩ '⁦UK consumer connectable products⁩'⁦: internet- or network-connectable products offered to UK consumers (e.g. smart TVs, cameras, speakers, toys, wearables, routers). Excluded: desktops, laptops and non-cellular tablets (unless designed only for under-14s); medical devices; smart meters; EV smart charge points; certain products for Northern Ireland under the Windsor Framework; and, in Great Britain from 25 Feb 2025, motor vehicles, two/three-wheelers and quadricycles, and agricultural/forestry vehicles.⁩✓⁦PSTI Act ss.4, 5, 7, 54; SI 2023/1007 reg 6⁩ & ⁦Sch 3 paras 1-8 (paras 6-8 inserted by SI 2025/211 reg 4) ·⁩ المصادر: ⁦legislation.gov.uk⁩, ⁦gov.uk⁩, ⁦cooley.com⁩, ⁦brodies.com⁩

حدود الحجم

⁦None by company size or revenue. Scope turns on the product: new products offered to UK consumers, plus business-only products identical to consumer ones. Products already supplied to a customer (e.g. second-hand) are generally outside scope.⁩✓⁦PSTI Act s.54 (conditions A and B; returned/reconditioned products ss.54(5)-(9)) ·⁩ المصادر: ⁦legislation.gov.uk⁩, ⁦twobirds.com⁩, ⁦mondaq.com⁩

الجهة الرقابية

⁦Office for Product Safety and Standards (OPSS), enforcing on behalf of the Secretary of State, who is the statutory enforcement authority.⁩✓⁦PSTI Act s.26 (Secretary of State is enforcement authority); s.27 (delegation) ·⁩ المصادر: ⁦legislation.gov.uk⁩, ⁦gov.uk⁩, ⁦stephensonharwood.com⁩, ⁦twobirds.com⁩

الإبلاغ عن الخروقات أو الحوادث

⁦On learning of a possible compliance failure, take all reasonable steps to investigate. If a failure is confirmed: manufacturers must stop supply and remedy it as soon as practicable and notify the enforcement authority, other manufacturers and the importers/distributors they supplied; importers and distributors must contact the manufacturer, stop supply if it is unlikely to be fixed, and notify the enforcement authority and those they supplied. Keep records of investigations and failures for 10 years.⁩✓⁦PSTI Act ss.10-12 (manufacturers), s.13 (authorised reps), ss.17-20 (importers), ss.24-25 (distributors) ·⁩ المصادر: ⁦legislation.gov.uk⁩, ⁦twobirds.com⁩, ⁦mondaq.com⁩

الممثل المحلي

⁦No duty to appoint a UK representative. A UK business importing a product from outside the UK takes on importer duties. A manufacturer may use an authorised representative, who must contact the manufacturer and then notify the enforcement authority of a compliance failure.⁩⁦PSTI Act s.13 (authorised representatives); ss.14-20 (importers) ·⁩ المصادر: ⁦legislation.gov.uk⁩, ⁦gov.uk⁩

أقصى عقوبة

⁦Up to £10 million or 4% of qualifying worldwide revenue, whichever is greater, plus up to £20,000 per day for a continuing breach. OPSS can also issue compliance, stop and recall notices and seek forfeiture.⁩✓⁦PSTI Act s.38(1) (£10m or 4% of qualifying worldwide revenue); s.36(5) (daily penalty up to £20,000); ss.28-30, 42 (notices, forfeiture) ·⁩ المصادر: ⁦legislation.gov.uk⁩, ⁦legislation.gov.uk⁩, ⁦gov.uk⁩, ⁦stephensonharwood.com⁩

المعلومات الموسومة بعبارة «قيد التحقق» لا تزال قيد التأكيد ولا تُقدَّم كإجابات.

ما يجب عليك فعله✓

• ⁦Ship no universal default or easily guessable passwords: make them unique per product or user-set.⁩
• ⁦Publish a contact point for reporting security issues, with acknowledgement and update timelines.⁩
• ⁦Publish the minimum security-update (support) period; never shorten it once published.⁩
• ⁦Supply each product with a statement of compliance (or summary) and keep a copy for 10 years or the support period, if longer.⁩
• ⁦Do not supply products you know or believe fail the requirements.⁩
• ⁦Investigate suspected failures, fix them, and notify OPSS and affected supply-chain parties.⁩
• ⁦Keep records of investigations and compliance failures for 10 years.⁩

التغييرات الأخيرة

⁦SI 2025/211 (in force 25 Feb 2025): excludes motor vehicles, two/three-wheelers and quadricycles, and agricultural/forestry vehicles in Great Britain; clarifies that an extended support period must be published. SI 2025/1267 (in force 4 Dec 2025): a product holding a current Japan JC-STAR STAR-1 label or Singapore Cybersecurity Labelling Scheme label is deemed to meet the three security requirements and the manufacturer⁩'⁦s statement-of-compliance duty (new reg 4A, Sch 2A). Deemed compliance via ETSI EN 303 645 (provisions 5.1-1/5.1-2, 5.2-1, 5.3-13) and ISO/IEC 29147 (reporting) has applied since 29 Apr 2024.⁩✓

المصادر

• المصدر الأساسي: ⁦https://www.legislation.gov.uk/uksi/2023/1007/data.html⁩
• المصدر الثاني: ⁦https://www.cooley.com/services/practice/european-tech-regulation/products/uk-product-security-and-telecommunications-infrastructure-act⁩
• الجهة الرقابية: ⁦Office for Product Safety and Standards (OPSS), enforcing on behalf of the Secretary of State, who is the statutory enforcement authority.⁩

✓ = مؤكَّد من مصدرين مستقلين، أحدهما على الأقل رسمي. كيف نتحقق

معلومات فقط، وليست استشارة قانونية. القوانين تتغير؛ تحقّق مع الجهة الرقابية أو محامٍ مؤهل قبل الاعتماد على هذه الصفحة. هل لاحظت خطأ؟ راسلنا على ⁦contact@⁩⁦glancedeskjurisdiction.com⁩.