How EN 303 645 controls and evidence help you ship connectable products in the UK.
This page is an implementation mapping, not legal advice. Validate UK PSTI obligations against the statutory instrument and schedules.
Structured answer sets in this page tree.
Cited legal and guidance references.
UK PSTI introduces legally enforceable security requirements for relevant connectable products. ETSI EN 303 645 is a baseline consumer IoT security standard. Many teams use EN 303 645 to structure product security controls and evidence in a way that translates well to UK PSTI outcomes: strong passwords, vulnerability disclosure, secure updates, clear support periods, and defensible records.
If you are building EN 303 645 controls properly (not as a checklist), you are already building the operational capabilities UK PSTI needs: a vulnerability disclosure process with timelines, a secure update mechanism, and support period transparency.
UK PSTI obligations are defined in legislation and schedules. ETSI EN 303 645 is not the law, but it is a very practical blueprint for implementing and proving the security outcomes regulators and customers expect.
The Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023 come into force on 29 April 2024 and extend across the UK.
The regulations reference security requirements (Schedule 1) and 'deemed compliance' conditions (Schedule 2). They also cover statements of compliance and retention expectations for manufacturers and importers.
ETSI EN 303 645 provisions map cleanly to the practical security outcomes UK PSTI is designed to achieve. The most important overlap is the operational loop: prevent weak defaults, handle vulnerabilities, ship updates, and communicate support commitments.
Use EN 303 645 to make these outcomes testable and evidence-backed.
The best evidence is operational evidence: it shows that your organization can handle vulnerabilities and updates reliably, at scale, across versions and SKUs.
ETSI TS 103 701 provides a helpful assessment structure (declarations/information used to derive a test plan, and conceptual vs functional checks). Even if UK PSTI doesn't require you to follow TS 103 701, the structure makes your evidence easier to defend.
Start by validating whether your product is a relevant connectable product and then build your compliance program around the outcomes: strong default posture, reliable disclosure handling, secure updates, and support period transparency.
Use EN 303 645 to standardize controls and tests, then tailor the documentation and statements to UK PSTI requirements and your supply chain (manufacturers, importers, distributors).
Research Copilot can take ETSI EN 303 645 vs UK PSTI from how this topic compares with adjacent regulations or standards to a reusable workflow inside Sorena. Teams working on ETSI EN 303 645 can keep owners, evidence, and next steps aligned without copying this guide into separate documents.
Start from ETSI EN 303 645 vs UK PSTI and answer scope, timing, and interpretation questions with cited outputs.
Review your current process, evidence gaps, and next steps for ETSI EN 303 645 vs UK PSTI.