We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

By Sorena AIPublished Updated

PSTI

UK PSTI Act

Decide UK PSTI product scope, actor duties, the three security requirements, statement routes, record periods, and OPSS response steps.

Royal Assent
6 Dec 2022
In force
29 Apr 2024
Mandatory controls
3 duties
Statement retention, whichever is longer
10 years or support period

Understand UK PSTI Act

Decide whether a product supplied to UK consumers is a , identify the manufacturer, importer, and distributor duties, then implement the three security requirements and the statement-of-compliance process.

The Act creates the product-security framework; the 2023 Regulations specify the current password, vulnerability-reporting, support-period, exception, and statement requirements. The 2025 amendments changed vehicle exceptions and added limited deemed-compliance routes, so use the current rules rather than treating the 2022 Act alone as the complete duty set.

Follow the timeline and guides for role duties, statements of compliance, and security controls.

Implementation focus

Scope and categories

Start with sections 4-6 and 54-55 of the Act, Schedule 3 to the 2023 Regulations as amended, intended consumer use, UK supply history, and role allocation.

Mandatory controls

Implement the three mandatory requirements: no universal default or easily guessable passwords, vulnerability disclosure information, and published information.

Statements and enforcement

Use the ordinary and accompaniment route or document every condition of an applicable Schedule 2A route. Retain statements for the longer of 10 years from issue or the , and keep an OPSS response file ready.

Core PSTI decisions

  1. 1

    Product scope

    Test internet or network connectivity and the current exceptions. Then apply section 54: the product must meet the UK consumer route or the identical-product business-supply route, including the prior-supply, return, reconditioning, and installation rules.

  2. 2

    Role and evidence

    Classify each legal entity as manufacturer, importer, distributor, or authorised representative for the exact product and route. Own-brand and white-label supply can change the role.

  3. 3

    Security implementation

    Build release evidence for covered password behavior, a public security-reporting route with acknowledgement and status-update timing, and a published minimum update period with an end date.

Key dates for UK product security implementation

Track PSTI milestones and commencement timing so product, legal, and compliance teams can stage controls and documentation with clear ownership.

Loading timeline...

Move from product scope to documented UK evidence

New to the regime? Start with product scope and your supply-chain role. If scope is already settled, jump to the three security requirements, statement evidence, enforcement, dates, or comparisons.

Dates and continuing obligations

Separate fixed commencement and amendment dates from product-specific support commitments and enforcement-response deadlines.

Comparisons

See what PSTI shares with ETSI, the EU CRA, and Australia, and which UK duties still need separate evidence.

Focused questions

Use direct answers for recurring scope, control, statement, support-period, and OPSS questions.

Sources

Next steps

Assess product scope and UK PSTI duties

Document product scope, actor duties, control evidence, statements, and post-release response.

  • Assign the assessment to the legal entity, product model, release, and UK route to market.
  • Map each applicable duty to an owned task, evidence request, and review checkpoint.
  • Use cited research for unresolved scope, timing, and interpretation questions.
  • Keep the decision, released-product evidence, statement, and follow-up actions together.