UK PSTI (connected products)

United Kingdom Cybersecurity

Status

In force. Act Part 1 framework from 6 Dec 2022; security requirements and statement-of-compliance rules apply since 29 Apr 2024 (SI 2023/1007). Amended by SI 2025/211 (25 Feb 2025) and SI 2025/1267 (4 Dec 2025).✓SI 2023/1007 reg 1(2) (in force 29 Apr 2024); SI 2025/211 reg 1; SI 2025/1267 reg 1 · Sources: legislation.gov.uk, cooley.com

Who it applies to

Manufacturers, importers and distributors of 'UK consumer connectable products': internet- or network-connectable products offered to UK consumers (e.g. smart TVs, cameras, speakers, toys, wearables, routers). Excluded: desktops, laptops and non-cellular tablets (unless designed only for under-14s); medical devices; smart meters; EV smart charge points; certain products for Northern Ireland under the Windsor Framework; and, in Great Britain from 25 Feb 2025, motor vehicles, two/three-wheelers and quadricycles, and agricultural/forestry vehicles.✓PSTI Act ss.4, 5, 7, 54; SI 2023/1007 reg 6 & Sch 3 paras 1-8 (paras 6-8 inserted by SI 2025/211 reg 4) · Sources: legislation.gov.uk, gov.uk, cooley.com, brodies.com

Size thresholds

None by company size or revenue. Scope turns on the product: new products offered to UK consumers, plus business-only products identical to consumer ones. Products already supplied to a customer (e.g. second-hand) are generally outside scope.✓PSTI Act s.54 (conditions A and B; returned/reconditioned products ss.54(5)-(9)) · Sources: legislation.gov.uk, twobirds.com, mondaq.com

Regulator

Office for Product Safety and Standards (OPSS), enforcing on behalf of the Secretary of State, who is the statutory enforcement authority.✓PSTI Act s.26 (Secretary of State is enforcement authority); s.27 (delegation) · Sources: legislation.gov.uk, gov.uk, stephensonharwood.com, twobirds.com

Breach or incident reporting

On learning of a possible compliance failure, take all reasonable steps to investigate. If a failure is confirmed: manufacturers must stop supply and remedy it as soon as practicable and notify the enforcement authority, other manufacturers and the importers/distributors they supplied; importers and distributors must contact the manufacturer, stop supply if it is unlikely to be fixed, and notify the enforcement authority and those they supplied. Keep records of investigations and failures for 10 years.✓PSTI Act ss.10-12 (manufacturers), s.13 (authorised reps), ss.17-20 (importers), ss.24-25 (distributors) · Sources: legislation.gov.uk, twobirds.com, mondaq.com

Local representative

No duty to appoint a UK representative. A UK business importing a product from outside the UK takes on importer duties. A manufacturer may use an authorised representative, who must contact the manufacturer and then notify the enforcement authority of a compliance failure.PSTI Act s.13 (authorised representatives); ss.14-20 (importers) · Sources: legislation.gov.uk, gov.uk

Maximum penalty

Up to £10 million or 4% of qualifying worldwide revenue, whichever is greater, plus up to £20,000 per day for a continuing breach. OPSS can also issue compliance, stop and recall notices and seek forfeiture.✓PSTI Act s.38(1) (£10m or 4% of qualifying worldwide revenue); s.36(5) (daily penalty up to £20,000); ss.28-30, 42 (notices, forfeiture) · Sources: legislation.gov.uk, legislation.gov.uk, gov.uk, stephensonharwood.com

Facts marked “Being verified” are still being confirmed and are not given as answers.

What you must do✓

• Ship no universal default or easily guessable passwords: make them unique per product or user-set.
• Publish a contact point for reporting security issues, with acknowledgement and update timelines.
• Publish the minimum security-update (support) period; never shorten it once published.
• Supply each product with a statement of compliance (or summary) and keep a copy for 10 years or the support period, if longer.
• Do not supply products you know or believe fail the requirements.
• Investigate suspected failures, fix them, and notify OPSS and affected supply-chain parties.
• Keep records of investigations and compliance failures for 10 years.

Recent changes

SI 2025/211 (in force 25 Feb 2025): excludes motor vehicles, two/three-wheelers and quadricycles, and agricultural/forestry vehicles in Great Britain; clarifies that an extended support period must be published. SI 2025/1267 (in force 4 Dec 2025): a product holding a current Japan JC-STAR STAR-1 label or Singapore Cybersecurity Labelling Scheme label is deemed to meet the three security requirements and the manufacturer's statement-of-compliance duty (new reg 4A, Sch 2A). Deemed compliance via ETSI EN 303 645 (provisions 5.1-1/5.1-2, 5.2-1, 5.3-13) and ISO/IEC 29147 (reporting) has applied since 29 Apr 2024.✓

Sources

• Primary source: https://www.legislation.gov.uk/uksi/2023/1007/data.html
• Second source: https://www.cooley.com/services/practice/european-tech-regulation/products/uk-product-security-and-telecommunications-infrastructure-act
• Regulator: Office for Product Safety and Standards (OPSS), enforcing on behalf of the Secretary of State, who is the statutory enforcement authority.

✓ = confirmed by two independent sources, at least one official. How we verify

Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email contact@glancedeskjurisdiction.com.