--- title: "UK PSTI Act Compliance Hub: Scope, Security Requirements, Statements, and OPSS Readiness" canonical_url: "https://www.sorena.io/artifacts/uk/product-security-and-telecommunications-infrastructure-act" source_url: "https://www.sorena.io/artifacts/uk/product-security-and-telecommunications-infrastructure-act" author: "Sorena AI" description: "Official source UK PSTI hub covering relevant connectable product scope, the three mandatory security requirements, manufacturer importer distributor duties." published_at: "2026-02-22" updated_at: "2026-02-22" keywords: - "UK PSTI Act compliance" - "relevant connectable products" - "UKSI 2023 1007" - "statement of compliance" - "minimum security update period" - "vulnerability disclosure information" - "OPSS enforcement" - "consumer IoT security" --- **[SORENA](https://www.sorena.io/)** - AI-Powered GRC Platform [Home](https://www.sorena.io/) | [Solutions](https://www.sorena.io/solutions) | [Artifacts](https://www.sorena.io/artifacts) | [About Us](https://www.sorena.io/about-us) | [Contact](https://www.sorena.io/contact) | [Portal](https://app.sorena.io) --- # UK PSTI Act Compliance Hub: Scope, Security Requirements, Statements, and OPSS Readiness Official source UK PSTI hub covering relevant connectable product scope, the three mandatory security requirements, manufacturer importer distributor duties. ![UK PSTI Act compliance hub preview](https://cdn.sorena.io/cdn-cgi/image/format=auto/cheatsheets/prod/sorena-ai-uk-psti-timeline-small.jpg?v=cheatsheets%2Fprod) *PSTI* *Compliance Hub* ## UK PSTI Act Scope, Security, and Supply Chain Duties Work through the UK PSTI regime for consumer connectable products: product scope, the three mandatory security requirements, role duties, and OPSS enforcement exposure. Practical guidance to plan with; validate your product scope, the three security requirements, and statement of compliance evidence against your own requirements. [Start with the UK PSTI Act applicability test](/artifacts/uk/product-security-and-telecommunications-infrastructure-act/applicability-test.md) ## What you can decide faster - **Product scope**: Determine whether a product is a relevant connectable product and whether any exclusion or boundary issue changes the duty set. - **Role and evidence**: Separate manufacturer, importer, and distributor duties, then decide what statement, summary, label-based deemed-compliance, retention, and investigation records are required. - **Security implementation**: Translate password, vulnerability disclosure, and minimum security update period duties into release gates and support operations. By Sorena AI | Based on PSTI legislation, OPSS, and ETSI materials | Updated March 2026 ### Implementation focus *UK PSTI* - **Scope and categories**: Start with section 4 relevant connectable product logic, section 6 excepted products, and role allocation. - **Mandatory controls**: Implement the three mandatory requirements: no universal default passwords, vulnerability disclosure information, and minimum security update period information. - **Statements and enforcement**: Prepare statement-of-compliance materials where required, validate any Schedule 2A route, maintain retention and compliance-failure records, and keep OPSS response capability ready. Use the timeline and guides to move into the role, statement, and control pages for execution. | Value | Metric | | --- | --- | | 6 Dec 2022 | Royal Assent | | 29 Apr 2024 | In force | | 3 duties | Mandatory controls | | 10 years+ | Statement retention if used | **Key highlights:** Scope first | 3 UK PSTI requirements | Statement evidence ## Primary sources - [Regulations: consumer connectable product security (UK government guidance)](https://www.gov.uk/guidance/regulations-consumer-connectable-product-security?ref=sorena.io) - 2022/46 - Consolidated from PSTI - This is guidance on regulations for consumer connectable product security. It explains the Product Security and Telecommunications Infrastructure Act 2022 and the Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023, which set baseline security requirements for manufacturers, importers, distributors, and au - Quote: "This is guidance on regulations for consumer connectable product security" ## Topic Guides - [UK PSTI Act relevant connectable products: full scope and category definitions](/artifacts/uk/product-security-and-telecommunications-infrastructure-act/relevant-connectable-products-scope.md): UK PSTI Product Security guidance for Relevant Connectable Products Scope, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Act statement of compliance: evidence requirements and audit documentation](/artifacts/uk/product-security-and-telecommunications-infrastructure-act/statement-of-compliance-and-evidence.md): UK PSTI Product Security guidance for Statement Of Compliance and Evidence, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Act statement of compliance: what must the SoC contain?](/artifacts/uk/product-security-and-telecommunications-infrastructure-act/statement-of-compliance.md): UK PSTI Product Security guidance for Statement Of Compliance, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Act: is your product a relevant connectable product? scope test](/artifacts/uk/product-security-and-telecommunications-infrastructure-act/relevant-connectable-product-scope.md): UK PSTI Product Security guidance for Relevant Connectable Product Scope, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Act: step-by-step statement of compliance preparation workflow](/artifacts/uk/product-security-and-telecommunications-infrastructure-act/statement-of-compliance-workflow.md): UK PSTI Product Security guidance for Statement Of Compliance Workflow, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Act: step-by-step vulnerability disclosure process workflow](/artifacts/uk/product-security-and-telecommunications-infrastructure-act/vulnerability-disclosure-workflow.md): UK PSTI Product Security guidance for Vulnerability Disclosure Workflow, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Act: vulnerability disclosure policy requirements and template](/artifacts/uk/product-security-and-telecommunications-infrastructure-act/vulnerability-disclosure-policy.md): UK PSTI Product Security guidance for Vulnerability Disclosure Policy, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Default Password Requirements](/artifacts/uk/product-security-and-telecommunications-infrastructure-act/default-password-requirements.md): A cited guide to the UK PSTI default password rule for consumer connectable products: unique passwords, user-defined setup, prohibited patterns, and evidence to keep. - [UK PSTI Product Security Applicability Test Guide](/artifacts/uk/product-security-and-telecommunications-infrastructure-act/applicability-test.md): Practical guidance for the UK PSTI Product Security applicability test, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Product Security Checklist](/artifacts/uk/product-security-and-telecommunications-infrastructure-act/checklist.md): Practical guidance for the UK PSTI Product Security checklist, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Product Security Compliance Guide](/artifacts/uk/product-security-and-telecommunications-infrastructure-act/compliance.md): Practical guidance for the UK PSTI Product Security compliance, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Product Security Deadlines and Compliance Calendar Guide](/artifacts/uk/product-security-and-telecommunications-infrastructure-act/deadlines-and-compliance-calendar.md): UK PSTI Product Security guidance for Deadlines and Compliance Calendar, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Product Security ETSI Evidence Mapping Guide](/artifacts/uk/product-security-and-telecommunications-infrastructure-act/etsi-evidence-mapping.md): UK PSTI Product Security guidance for ETSI Evidence Mapping, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Product Security FAQ](/artifacts/uk/product-security-and-telecommunications-infrastructure-act/faq.md): Practical guidance for the UK PSTI Product Security FAQ, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Product Security Importer and Distributor Duties Guide](/artifacts/uk/product-security-and-telecommunications-infrastructure-act/importer-and-distributor-duties.md): UK PSTI Product Security guidance for Importer and Distributor Duties, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Product Security Minimum Support Period and Update Transparency Guide](/artifacts/uk/product-security-and-telecommunications-infrastructure-act/minimum-support-period-and-update-transparency.md): UK PSTI Product Security guidance for Minimum Support Period and Update Transparency, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Product Security OPSS Enforcement and Penalties Guide](/artifacts/uk/product-security-and-telecommunications-infrastructure-act/opss-enforcement-and-penalties.md): UK PSTI Product Security guidance for OPSS enforcement and penalties, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Product Security OPSS Notices Guide](/artifacts/uk/product-security-and-telecommunications-infrastructure-act/opss-notices.md): UK PSTI Product Security guidance for OPSS Notices, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Product Security penalties and fines Guide](/artifacts/uk/product-security-and-telecommunications-infrastructure-act/penalties-and-fines.md): UK PSTI Product Security guidance for penalties and fines, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Product Security PSTI Password and Update Policy Requirements Guide](/artifacts/uk/product-security-and-telecommunications-infrastructure-act/psti-password-and-update-policy-requirements.md): UK PSTI Product Security guidance for PSTI Password and Update Policy Requirements, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Product Security PSTI Scope Classifier Workflow Guide](/artifacts/uk/product-security-and-telecommunications-infrastructure-act/psti-scope-classifier-workflow.md): UK PSTI Product Security guidance for PSTI Scope Classifier Workflow, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Product Security PSTI Statement Of Compliance Template Guide](/artifacts/uk/product-security-and-telecommunications-infrastructure-act/psti-statement-of-compliance-template.md): UK PSTI Product Security guidance for PSTI Statement Of Compliance Template, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Product Security PSTI vs CRA Guide](/artifacts/uk/product-security-and-telecommunications-infrastructure-act/psti-vs-cra.md): UK PSTI Product Security guidance for PSTI vs CRA, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Product Security PSTI vs ETSI EN 303 645 Guide](/artifacts/uk/product-security-and-telecommunications-infrastructure-act/psti-vs-etsi-en-303-645.md): UK PSTI Product Security guidance for PSTI vs ETSI EN 303 645, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Product Security PSTI vs EU Cyber Resilience Act Guide](/artifacts/uk/product-security-and-telecommunications-infrastructure-act/psti-vs-eu-cyber-resilience-act.md): UK PSTI Product Security guidance for PSTI vs EU Cyber Resilience Act, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Product Security Requirements Guide](/artifacts/uk/product-security-and-telecommunications-infrastructure-act/requirements.md): Practical guidance for the UK PSTI Product Security requirements, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Product Security Requirements In Practice Guide](/artifacts/uk/product-security-and-telecommunications-infrastructure-act/security-requirements-in-practice.md): UK PSTI Product Security guidance for Security Requirements In Practice, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Product Security Supply Chain Roles Manufacturer Importer Distributor Guide](/artifacts/uk/product-security-and-telecommunications-infrastructure-act/supply-chain-roles-manufacturer-importer-distributor.md): UK PSTI Product Security guidance for Supply Chain Roles Manufacturer Importer Distributor, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI Product Security Support Period Evidence Workflow Guide](/artifacts/uk/product-security-and-telecommunications-infrastructure-act/support-period-evidence-workflow.md): UK PSTI Product Security guidance for Support Period Evidence Workflow, with practical decisions, evidence, edge cases, and external source citations. - [UK PSTI vs Australia Cyber Security Act Guide](/artifacts/uk/product-security-and-telecommunications-infrastructure-act/psti-vs-australia-cyber-security-act.md): UK PSTI Product Security guidance for PSTI vs Australia Cyber Security Act, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Default Passwords under UK PSTI Product Security?](/artifacts/uk/product-security-and-telecommunications-infrastructure-act/faq/default-passwords.md): UK PSTI Product Security guidance for Default Passwords, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about ETSI Evidence under UK PSTI Product Security?](/artifacts/uk/product-security-and-telecommunications-infrastructure-act/faq/etsi-evidence.md): UK PSTI Product Security guidance for ETSI Evidence, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Excepted Products under UK PSTI Product Security?](/artifacts/uk/product-security-and-telecommunications-infrastructure-act/faq/excepted-products.md): UK PSTI Product Security guidance for Excepted Products, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Importer and Distributor Duties under UK PSTI Product Security?](/artifacts/uk/product-security-and-telecommunications-infrastructure-act/faq/importer-and-distributor-duties.md): UK PSTI Product Security guidance for Importer and Distributor Duties, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about OPSS Notices under UK PSTI Product Security?](/artifacts/uk/product-security-and-telecommunications-infrastructure-act/faq/opss-notices.md): UK PSTI Product Security guidance for OPSS Notices, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Relevant Connectable Products under UK PSTI Product Security?](/artifacts/uk/product-security-and-telecommunications-infrastructure-act/faq/relevant-connectable-products.md): UK PSTI Product Security guidance for Relevant Connectable Products, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Statement Of Compliance under UK PSTI Product Security?](/artifacts/uk/product-security-and-telecommunications-infrastructure-act/faq/statement-of-compliance.md): UK PSTI Product Security guidance for Statement Of Compliance, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Support Periods under UK PSTI Product Security?](/artifacts/uk/product-security-and-telecommunications-infrastructure-act/faq/support-periods.md): UK PSTI Product Security guidance for Support Periods, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Update Transparency under UK PSTI Product Security?](/artifacts/uk/product-security-and-telecommunications-infrastructure-act/faq/update-transparency.md): UK PSTI Product Security guidance for Update Transparency, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Vulnerability Disclosure under UK PSTI Product Security?](/artifacts/uk/product-security-and-telecommunications-infrastructure-act/faq/vulnerability-disclosure.md): UK PSTI Product Security guidance for Vulnerability Disclosure, with practical decisions, evidence, edge cases, and external source citations. ## Key dates for UK product security implementation *PSTI Timeline* Track PSTI milestones and commencement timing so product, legal, and compliance teams can stage controls and documentation with clear ownership. *Next step* ## Turn UK PSTI Act Scope, Security, and Supply Chain Duties into an operational assessment workflow UK PSTI Act Scope, Security, and Supply Chain Duties should be the shared entry point for your team. Route execution into Assessment Autopilot for live work and into Research Copilot when the artifact needs deeper research, evidence governance, or supporting analysis. - Start from UK PSTI Act Scope, Security, and Supply Chain Duties and route the work by entity, product, team, or control owner. - Use Assessment Autopilot to turn the guidance into owned tasks, evidence requests, and review checkpoints. - Use Research Copilot to answer scope, timing, and interpretation questions with cited outputs. - Move from artifact reading to accountable execution without rebuilding the guidance in separate files. - [Open Assessment Autopilot](/solutions/assessment.md): Turn the guidance into owned tasks, evidence requests, and review checkpoints for UK PSTI Act Scope, Security, and Supply Chain Duties. - [Open Research Copilot](/solutions/research-copilot.md): Answer scope, timing, and interpretation questions with cited outputs from the same artifact. - [Talk through UK PSTI Act Scope, Security, and Supply Chain Duties](/contact.md): Review your current process, evidence model, and next implementation steps. ## Compliance Timeline | Date | Event | Category | Reference | | --- | --- | --- | --- | | 2017-04-03 | OPSS enforcement policy first published | Guidance and Enforcement | [Source](https://www.gov.uk/government/publications/safety-and-standards-enforcement-enforcement-policy/opss-enforcement-policy?ref=sorena.io) | | 2020-06-01 | ETSI TS 103 645 V2.1.2 published (June 2020) | Standards | [Source](https://www.etsi.org/deliver/etsi_ts/103600_103699/103645/02.01.02_60/ts_103645v020102p.pdf?ref=sorena.io) | | 2020-06-19 | ETSI EN 303 645 V2.1.1 adopted (19 June 2020) | Standards | [Source](https://www.etsi.org/deliver/etsi_en/303600_303699/303645/02.01.01_60/en_303645v020101p.pdf?ref=sorena.io) | | 2021-08-01 | ETSI TS 103 701 V1.1.1 published (August 2021) | Standards | [Source](https://www.etsi.org/deliver/etsi_ts/103700_103799/103701/01.01.01_60/ts_103701v010101p.pdf?ref=sorena.io) | | 2022-12-06 | PSTI Act receives Royal Assent | Primary Legislation | [2022 c. 46](https://www.legislation.gov.uk/ukpga/2022/46/contents?ref=sorena.io) | | 2023-02-02 | Commencement No. 1 Regulations made (SI 2023/109) | Secondary Legislation | [UKSI 2023/109](https://www.legislation.gov.uk/uksi/2023/109/made?ref=sorena.io) | | 2023-02-07 | First commencement provisions take effect (7 February 2023) | Secondary Legislation | [UKSI 2023/109 reg. 2](https://www.legislation.gov.uk/uksi/2023/109/made?ref=sorena.io) | | 2023-04-17 | Commencement No. 1 second tranche takes effect | Secondary Legislation | [UKSI 2023/109 reg. 3](https://www.legislation.gov.uk/uksi/2023/109/made?ref=sorena.io) | | 2023-04-25 | Commencement No. 2 Regulations made (SI 2023/469) | Secondary Legislation | [UKSI 2023/469](https://www.legislation.gov.uk/uksi/2023/469/made?ref=sorena.io) | | 2023-04-26 | Additional commencement provisions take effect (26 April 2023) | Secondary Legislation | [UKSI 2023/469](https://www.legislation.gov.uk/uksi/2023/469/made?ref=sorena.io) | | 2023-04-29 | DSIT publishes product-security regime policy paper | Guidance and Enforcement | [Source](https://www.gov.uk/government/publications/the-uk-product-security-and-telecommunications-infrastructure-product-security-regime?ref=sorena.io) | | 2023-07-10 | UK PSTI product-security final impact assessment supports secondary legislation | Secondary Legislation | [UKIA 2023/123](https://www.legislation.gov.uk/ukia/2023/123/pdfs/ukia_20230123_en.pdf?ref=sorena.io) | | 2023-09-14 | Security requirements regulations made (SI 2023/1007) | Secondary Legislation | [UKSI 2023/1007](https://www.legislation.gov.uk/uksi/2023/1007/made?ref=sorena.io) | | 2024-01-08 | OPSS/DSIT compliance guidance published | Guidance and Enforcement | [Source](https://www.gov.uk/guidance/regulations-consumer-connectable-product-security?ref=sorena.io) | | 2024-04-22 | OPSS enforcement policy revised | Guidance and Enforcement | [Source](https://www.gov.uk/government/publications/safety-and-standards-enforcement-enforcement-policy/opss-enforcement-policy?ref=sorena.io) | | 2024-04-29 | UK PSTI security requirements regulations come into force | Secondary Legislation | [UKSI 2023/1007 reg. 1(2)](https://www.legislation.gov.uk/uksi/2023/1007/regulation/1/made?ref=sorena.io) | | 2024-04-29 | Part 1 of the PSTI Act (product security) comes into force | Secondary Legislation | [UKSI 2023/469 reg. 3](https://www.legislation.gov.uk/uksi/2023/469/made?ref=sorena.io) | | 2024-04-29 | OPSS begins enforcing the product-security regime | Guidance and Enforcement | [Source](https://www.gov.uk/government/publications/the-uk-product-security-and-telecommunications-infrastructure-product-security-regime?ref=sorena.io) | | 2024-05-02 | DSIT regime policy paper updated after commencement | Guidance and Enforcement | [Source](https://www.gov.uk/government/publications/the-uk-product-security-and-telecommunications-infrastructure-product-security-regime?ref=sorena.io) | | 2024-09-11 | ETSI EN 303 645 V3.1.3 adopted (11 September 2024) | Standards | [Source](https://www.etsi.org/deliver/etsi_en/303600_303699/303645/03.01.03_60/en_303645v030103p.pdf?ref=sorena.io) | | 2024-10-01 | ETSI TS 103 928 V1.2.1 published (October 2024) | Standards | [Source](https://www.etsi.org/deliver/etsi_ts/103900_103999/103928/01.02.01_60/ts_103928v010201p.pdf?ref=sorena.io) | | 2025-01-27 | OPSS enforcement policy updated (27 January 2025) | Guidance and Enforcement | [Source](https://www.gov.uk/government/publications/safety-and-standards-enforcement-enforcement-policy/opss-enforcement-policy?ref=sorena.io) | | 2025-02-24 | First 2025 PSTI amendment made | Secondary Legislation | [UKSI 2025/211](https://www.legislation.gov.uk/uksi/2025/211/made?ref=sorena.io) | | 2025-02-25 | First 2025 amendment comes into force (25 February 2025) | Secondary Legislation | [UKSI 2025/211](https://www.legislation.gov.uk/uksi/2025/211/made?ref=sorena.io) | | 2025-03-17 | OPSS/DSIT guidance updated for vehicle exemptions | Guidance and Enforcement | [Source](https://www.gov.uk/guidance/regulations-consumer-connectable-product-security?ref=sorena.io) | | 2025-08-08 | OPSS PSTI enforcement-actions guidance updated | Guidance and Enforcement | [Source](https://www.gov.uk/government/publications/opss-enforcement-enforcement-actions/consumer-connectable-product-security-regulations?ref=sorena.io) | | 2025-12-03 | Second 2025 PSTI amendment made | Secondary Legislation | [UKSI 2025/1267](https://www.legislation.gov.uk/uksi/2025/1267/made?ref=sorena.io) | | 2025-12-04 | Amendment No. 2 comes into force (4 December 2025) | Secondary Legislation | [UKSI 2025/1267](https://www.legislation.gov.uk/uksi/2025/1267/made?ref=sorena.io) | | 2026-01-26 | OPSS enforcement policy last updated (26 January 2026) | Guidance and Enforcement | [Source](https://www.gov.uk/government/publications/safety-and-standards-enforcement-enforcement-policy/opss-enforcement-policy?ref=sorena.io) | | 2029-04-28 | First review report due (within 5 years of coming into force) | Review and Reporting | [UKSI 2023/1007 reg. 10(2)](https://www.legislation.gov.uk/uksi/2023/1007/regulation/10/made?ref=sorena.io) | **Event details:** - **2017-04-03 - OPSS enforcement policy first published**: Office for Product Safety and Standards (OPSS) publishes its enforcement approach, which later provides context for how UK product-security enforcement is handled. - **2020-06-01 - ETSI TS 103 645 V2.1.2 published (June 2020)**: ETSI TS 103 645 V2.1.2 (Baseline Requirements for consumer IoT) is published with a cover version date of 2020-06. - **2020-06-19 - ETSI EN 303 645 V2.1.1 adopted (19 June 2020)**: ETSI EN 303 645 V2.1.1 adoption date (19 June 2020). This standard version is referenced in the PSTI security requirements regulations definition of "ETSI EN 303 645". - **2021-08-01 - ETSI TS 103 701 V1.1.1 published (August 2021)**: ETSI TS 103 701 V1.1.1 (Conformance Assessment of Baseline Requirements) is published with a cover version date of 2021-08. - **2022-12-06 - PSTI Act receives Royal Assent**: Product Security and Telecommunications Infrastructure Act 2022 is enacted, creating the framework for UK consumer connectable product security requirements and statements of compliance. - **2023-02-02 - Commencement No. 1 Regulations made (SI 2023/109)**: The Product Security and Telecommunications Infrastructure Act 2022 (Commencement No. 1) Regulations 2023 are made. - **2023-02-07 - First commencement provisions take effect (7 February 2023)**: Commencement No. 1 Regulations bring specified PSTI Act provisions into force on 7 February 2023. - **2023-04-17 - Commencement No. 1 second tranche takes effect**: Commencement No. 1 brings sections 58 and 59 into force for telecommunications-code upgrading and sharing provisions; these are not the Part 1 product-security duties. - **2023-04-25 - Commencement No. 2 Regulations made (SI 2023/469)**: The Product Security and Telecommunications Infrastructure Act 2022 (Commencement No. 2) Regulations 2023 are made. - **2023-04-26 - Additional commencement provisions take effect (26 April 2023)**: Commencement No. 2 Regulations bring specified PSTI Act provisions into force, including an effective date of 26 April 2023 for section 66 (as described in the commencement order metadata). - **2023-04-29 - DSIT publishes product-security regime policy paper**: The GOV.UK policy paper explains the product-security regime, affected economic actors, the proposed security requirements, and the planned 29 April 2024 effect date. - **2023-07-10 - UK PSTI product-security final impact assessment supports secondary legislation**: The final Impact Assessment for consumer connectable product cyber security is dated 10 July 2023 and supports the secondary-legislation package implementing the product-security regime. - **2023-09-14 - Security requirements regulations made (SI 2023/1007)**: Secondary legislation sets out baseline security requirements (passwords, vulnerability reporting information, and minimum security update period information) and required statement of compliance information. - **2024-01-08 - OPSS/DSIT compliance guidance published**: GOV.UK guidance for manufacturers, importers and distributors on the consumer connectable product security regime is published ahead of the 29 April 2024 application date. - **2024-04-22 - OPSS enforcement policy revised**: OPSS enforcement policy revision published, providing the general enforcement approach referenced for PSTI enforcement planning. - **2024-04-29 - UK PSTI security requirements regulations come into force**: Security requirements and related statement of compliance requirements take effect for relevant connectable products made available in the UK. - **2024-04-29 - Part 1 of the PSTI Act (product security) comes into force**: Commencement No. 2 Regulations bring Part 1 of the Product Security and Telecommunications Infrastructure Act 2022 into force on 29 April 2024 (so far as not already in force). - **2024-04-29 - OPSS begins enforcing the product-security regime**: OPSS becomes responsible for enforcing Part 1 of the PSTI Act and the 2023 Regulations from 29 April 2024 under the DSIT enforcement arrangements. - **2024-05-02 - DSIT regime policy paper updated after commencement**: The GOV.UK regime policy paper is updated after commencement, including pointers to statement-of-compliance material and guidance on automotive vehicles. - **2024-09-11 - ETSI EN 303 645 V3.1.3 adopted (11 September 2024)**: ETSI EN 303 645 V3.1.3 adoption date (11 September 2024); included as standards context, not the version of ETSI EN 303 645 named by the reviewed UK PSTI security requirements regulations. - **2024-10-01 - ETSI TS 103 928 V1.2.1 published (October 2024)**: ETSI TS 103 928 V1.2.1 (home gateways conformance assessment) is published with a cover version date of 2024-10; included as adjacent standards context rather than a UK PSTI legal requirement. - **2025-01-27 - OPSS enforcement policy updated (27 January 2025)**: OPSS enforcement policy updated on 27 January 2025 (references to additional legislation added). - **2025-02-24 - First 2025 PSTI amendment made**: S.I. 2025/211 is made one day before commencement; it corrects the 2023 Regulations and adds vehicle-exception amendments that take effect on 25 February 2025. - **2025-02-25 - First 2025 amendment comes into force (25 February 2025)**: S.I. 2025/211 corrects the support-period wording in Schedule 1 paragraph 3(3) and expands Schedule 3 with Great Britain exceptions for certain motor vehicles, two- or three-wheel vehicles and quadricycles, and agricultural and forestry vehicles. - **2025-03-17 - OPSS/DSIT guidance updated for vehicle exemptions**: GOV.UK consumer connectable product security guidance is updated after S.I. 2025/211, explaining vehicle categories excluded from the PSTI regime from 25 February 2025. - **2025-08-08 - OPSS PSTI enforcement-actions guidance updated**: PSTI-specific OPSS guidance on enforcement actions and associated rights is updated, covering compliance notices, stop notices, recall notices, monetary penalties, forfeiture orders, and appeal rights. - **2025-12-03 - Second 2025 PSTI amendment made**: S.I. 2025/1267 is made one day before commencement, setting up JC-STAR-1 and Singapore Cybersecurity Labelling Scheme deemed-compliance routes and the new statement-accompaniment deemed-compliance route. - **2025-12-04 - Amendment No. 2 comes into force (4 December 2025)**: S.I. 2025/1267, made on 3 December 2025 and in force on 4 December 2025, adds Japan JC-STAR-1 and Singapore Cybersecurity Labelling Scheme routes for deemed compliance with the Schedule 1 security requirements and inserts Schedule 2A for deemed compliance with the section 9 statement-accompaniment requirement. - **2026-01-26 - OPSS enforcement policy last updated (26 January 2026)**: OPSS enforcement policy last updated on 26 January 2026 (references to legislation updated). - **2029-04-28 - First review report due (within 5 years of coming into force)**: The Secretary of State must publish the first review report by 28 April 2029 because regulation 10 requires publication before the end of the period of five years beginning with 29 April 2024. Subsequent reports are required at intervals not exceeding five years. --- [Privacy Policy](https://www.sorena.io/privacy) | [Terms of Use](https://www.sorena.io/terms-of-use) | [DMCA](https://www.sorena.io/dmca) | [About Us](https://www.sorena.io/about-us) (c) 2026 Sorena AB (559573-7338). All rights reserved. Source: https://www.sorena.io/artifacts/uk/product-security-and-telecommunications-infrastructure-act