We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

Artifact GuideUKApplicability Test

UK PSTI Product Security Applicability Test

Apply the UK PSTI tests in order: connectivity, current exceptions, UK consumer availability, supply facts, and the manufacturer, importer, or distributor trigger.

Binding duties come from Part 1 of the 2022 Act and the current 2023 Regulations. Office for Product Safety and Standards (OPSS) guidance explains administration and enforcement; European Telecommunications Standards Institute (ETSI) materials are standards evidence, not a substitute for applying the UK rules.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Oct 15, 2026
4 sections6 primary sources
Overview

Run the test on one product model and one route to the UK market. A product can be a without every business in its supply chain having the same duty. Record the facts at each step, because the Act separates product classification from UK-consumer status and from what a manufacturer, importer, or distributor intends, knows, or ought to know.

Section 1

Step 1: is the product a relevant connectable product?

An internet-connectable product can send and receive data over the internet using a protocol in the Internet Protocol suite. A network-connectable product is not internet-connectable, can send and receive data by electrical or electromagnetic transmission, and meets one of the Act's direct-connectability conditions. A product meeting either definition is relevant unless regulations except it.

For the first network-connectability condition, the product must be able to connect directly to an internet-connectable product using an Internet Protocol suite protocol. For the second, it must be able to connect directly to two or more products at the same time using a non-Internet Protocol suite protocol, and also be able to connect directly to an internet-connectable product using such a protocol. That latter connection need not occur at the same time. A wire or cable used merely as a connection does not count as another product, but using a cable does not by itself prevent a connection being direct.

Section 5(7) also covers certain computer input products used with a linking product. Where the products are designed to be used together to help use a computer, the linking product can connect directly to an internet-connectable product using a non-Internet Protocol suite protocol, and the input products connect wirelessly to the linking product or each linking product using such a protocol, the input products are treated as meeting the second condition.

Apply Schedule 3 as currently amended. Its categories include specified Northern Ireland products, smart charge points, qualifying medical devices, smart meter products, desktop and laptop computers, tablet computers without cellular capability, and specified vehicles. Each exception has its own wording; a familiar category label is not enough. The computer exception does not cover products designed exclusively for children under 14; installing regulated medical-device software on a connectable product does not by itself exempt the host product.

  • Identify the physical product and associated software used for the manufacturer's intended purposes.
  • Record the protocols and direct connections the released model supports, including disabled or optional radios.
  • Match any claimed exception to the exact Schedule 3 conditions and keep the supporting classification.
  • Reassess after hardware, firmware, intended-purpose, connectivity, or vehicle-category changes.
Section 2

Step 2: is it a UK consumer connectable product?

Section 54 condition A covers a made available to UK consumers when a relevant person had not previously supplied that product to any customer. Condition B covers a product first made available to a UK non-consumer when identical products meet condition A. Returned products, products reconditioned by or for a manufacturer, and products supplied through specified installation arrangements have additional rules, so 'new' or 'unused' is not a complete legal test.

Do not equate a business sale with business-only scope. Record whether identical products are offered to consumers, the product's supply history, and how it is promoted. Section 55 also treats gifts and non-monetary business supplies as supply, deals specifically with hiring and lending, and includes some installation or building-incorporation arrangements.

  • Capture the first UK availability date, prior supply history, customer type, returns or reconditioning, sales channels, and identical consumer variants.
  • Treat an enterprise-only conclusion as fact-dependent and preserve evidence that the product line is not made available to consumers.
  • Check bundles and products incorporated into buildings against the Act's supply rules.
  • Do not apply section 54 to a product already excluded by Schedule 3.
Section 3

Step 3: which actor and duty trigger apply?

Classify the business under section 7 for the exact product. A manufacturer includes a person that manufactures or has a product designed or manufactured and markets it under its own name or trademark, and a person that rebrands another manufacturer's product. An importer brings a product from outside the United Kingdom and is not its manufacturer; a distributor makes it available in the United Kingdom and is neither manufacturer nor importer.

Sections 8, 14, and 21 apply role-specific tests based on whether the actor intends the product to be a UK consumer connectable product or is aware, or ought to be aware, that it will be one. A group company or retailer may hold different roles for different products.

  • Name every legal entity in the supply route and assign one role per entity and product.
  • Record own-branding, design control, import origin, and who first makes the product available in the United Kingdom.
  • Apply the correct Act section to each actor instead of copying the manufacturer's duty to the whole chain.
  • Escalate white-label, marketplace, fulfilment, and group-company arrangements where the statutory role is unclear.
Section 4

Step 4: record the outcome and next actions

For an in-scope route, record the applicable security requirements, statement route, retention duties, release gate, and compliance-failure owner. The regime took effect on 29 April 2024; there is no general grandfathering rule based only on when a model was designed.

If the answer is outside scope, state which test failed and preserve the evidence. Reopen the decision when the product, intended purpose, UK channels, branding, supply chain, or legislation changes.

  • Approve a dated scope memorandum for the exact model, firmware family, UK route, and legal entities.
  • Link the decision to password, vulnerability-reporting, support-period, and statement evidence where duties apply.
  • Block supply when an importer or distributor knows or believes there is a manufacturer's compliance failure and the relevant statutory conditions are met.
  • Keep an issue path for new vulnerability reports, regulator enquiries, and post-launch compliance failures.
Recommended next step

Apply this guide to a product assessment

Use the page for one product model, UK route, and legal entity, with named owners, evidence requests, and review points.

Assessment workflow
Open Assessment Autopilot for UK PSTI Product Security

Create scoped questions, evidence fields, and review tasks from this guide.

Explore next step
Research workflow
Review UK PSTI Product Security source evidence

Use Research Copilot to answer follow-up questions with cited source material.

Explore next step
Talk to Sorena
Talk through UK PSTI Product Security implementation

Review scope, evidence, owners, and the next compliance actions with Sorena.

Explore next step
Primary sources

References and citations

Related guides

UK PSTI Act statement of compliance: what must the SoC contain?

Understand when a UK PSTI statement is required, the Schedule 4 fields, supply-chain checks, retention, digital accompaniment, and the December 2025 label route.

UK PSTI Act: vulnerability disclosure policy requirements and template

Publish a free, clear, accessible English reporting route plus expected acknowledgement and status-update times, and retain evidence that the information remained available.

UK PSTI compliance checklist for product release

Use a release checklist with scope, role, security-control, statement, records, and compliance-failure evidence for UK consumer connectable products.

UK PSTI compliance: duties, evidence, and response

Build a UK PSTI compliance process covering product scope, supply-chain roles, the three security requirements, statements, records, and post-market failures.

UK PSTI default password requirements

Apply the UK PSTI password rule to each relevant password, test unique-per-product generation, and keep reset and release evidence for the shipped model.

UK PSTI Manufacturer, Importer and Distributor Roles

Distinguish manufacturer, importer, distributor, and authorised-representative duties per product and supply route, including rebranding, imports, statement checks, stop-supply decisions, and compliance failures.

Show all related guides (39)

UK PSTI password and security update policy requirements

Implement the UK PSTI password rule and publish a defined security support period with the required end date, access conditions, and change controls.

UK PSTI Product Security Deadlines and Compliance Calendar Guide

Track the UK PSTI regime's commencement and amendment dates, product-specific support periods, record retention, and OPSS response and appeal windows.

UK PSTI Product Security FAQ

Get direct, sourced answers on product scope, exceptions, roles, passwords, vulnerability reporting, update-period information, statements, records, and OPSS enforcement.

UK PSTI Product Security Importer and Distributor Duties Guide

Identify the pre-supply checks, statement or deemed-compliance evidence, stop-supply decisions, notification and remediation duties required of UK importers and distributors, plus importer-specific investigation and record duties.

UK PSTI Product Security Minimum Support Period and Update Transparency Guide

Publish the minimum security-update period and end date in English, free of charge, without prior request, and in clear language, without implying that PSTI sets one duration for every product.

UK PSTI Product Security OPSS Enforcement and Penalties Guide

Understand OPSS investigations, compliance, stop and recall notices, monetary penalties, forfeiture, court orders, representations, appeals, and evidence needed to respond.

UK PSTI Product Security OPSS Notices Guide

Prepare for compliance, stop, and recall notices by understanding their effects, representation and appeal routes, product records, and corrective-action evidence.

UK PSTI Product Security Penalties and Fines Guide

Understand the maximum fixed and daily PSTI penalties, how OPSS sets an amount, representation and appeal rights, and separate court-ordered sanctions.

UK PSTI product security requirements

Read the three Schedule 1 security requirements and the surrounding manufacturer, importer, distributor, statement, record, and failure-response duties.

UK PSTI relevant connectable product scope test

Decide whether one product meets the UK PSTI connectivity definition, falls within a current exception, and reaches the separate UK-consumer duty tests.

UK PSTI relevant connectable products: categories and exceptions

Understand which connected product categories can enter UK PSTI scope, how the statutory tests work, and why examples never replace the current exception schedule.

UK PSTI Scope Classifier Workflow

Decide whether a product falls within the UK PSTI product-security regime by checking connectivity, consumer supply, exceptions, actor roles, and product-specific evidence.

UK PSTI security requirements in practice

Implement the three UK PSTI security requirements through product specifications, release tests, public information, approvals, and post-release evidence.

UK PSTI Statement of Compliance Evidence Pack

Join the prescribed statement fields to product identifiers, control evidence, publication records, supply-chain checks, accompaniment evidence, retention, and change management.

UK PSTI Statement of Compliance Template

Build a statement record with the prescribed Schedule 4 information and evidence that it accompanied the product, while checking whether a current Schedule 2A deemed-compliance route applies.

UK PSTI Statement of Compliance Workflow

Prepare, approve, provide, verify, retain, and update statement evidence before a relevant connectable product is made available in the UK.

UK PSTI Support Period Evidence Workflow

Set, publish, approve, and preserve the product-specific minimum security-update period and end date, then control changes and customer information against the shipped product.

UK PSTI to ETSI Evidence Mapping

Map ETSI EN 303 645 and TS 103 701 evidence to the three UK legal requirements without treating the wider voluntary ETSI baseline as if every provision were mandatory under PSTI.

UK PSTI vs Australia Smart Device Rules

Compare UK PSTI with Australia's Cyber Security Act smart-device rules by scope, duties, statements, security controls, retention, dates, and enforcement.

UK PSTI vs ETSI EN 303 645

See how binding UK PSTI duties relate to ETSI EN 303 645, which edition the UK Regulations name, what the standard adds, and what evidence to retain.

UK PSTI vs EU Cyber Resilience Act

Decide whether UK PSTI, the EU Cyber Resilience Act, or both apply, then compare actors, exclusions, security work, documents, reporting, and dates.

UK PSTI vs EU Cyber Resilience Act (CRA)

Compare UK PSTI and the EU Cyber Resilience Act by scope, security duties, support periods, conformity assessment, reporting, evidence, and application dates.

UK PSTI Vulnerability Disclosure Workflow

Operate intake, acknowledgement, status updates, investigation, remediation, disclosure, and evidence while keeping the legal publication duty distinct from broader good-practice response targets.

UK PSTI Default Password Rules

PSTI requires each covered password to be user-defined or unique per product. Unique credentials must not use prohibited predictable generation methods.

UK PSTI ETSI Evidence and Deemed Compliance

ETSI EN 303 645 and TS 103 701 can structure technical evidence, but the standards-based PSTI route depends on the exact mapped provisions and additional Schedule 2 conditions.

UK PSTI Excepted Products and Boundaries

An internet- or network-connectable product is outside the relevant-product definition only when a current Schedule 3 exception applies; record the exact category and facts rather than relying on a broad sector label.

UK PSTI Importer and Distributor Duties

Importers and distributors have their own statement, stop-supply, remediation, and notification duties; importers also have statutory investigation and 10-year investigation-record duties.

UK PSTI OPSS Notices: Compliance, Stop, Recall, and Penalties

OPSS can use compliance, stop, and recall notices alongside monetary and other measures; notice recipients should preserve the notice, product scope, supply records, corrective actions, representations, and appeal dates.

UK PSTI Relevant Connectable Product Scope

A product is relevant when it is internet-connectable or network-connectable and not excepted, then the UK consumer-use and supply facts determine whether the Part 1 duties engage.

UK PSTI Security Update Support Periods

PSTI does not prescribe a universal minimum number of support years. The manufacturer sets and publishes a product-specific minimum period and end date; preserve the published commitment and assess any later change against the current Regulations.

UK PSTI Security Update Transparency

Publish the minimum security-update period and end date in English, free of charge, without prior request, and in language understandable without technical knowledge.

UK PSTI Statement of Compliance: Contents, Delivery, and Records

A statement must contain the prescribed information and accompany the product unless a current deemed-compliance route applies; a digital method is possible, but each business must ensure that it meets the Act.

UK PSTI Vulnerability Disclosure Requirements

Publish a clear reporting route plus expected acknowledgement and status-update times. PSTI requires the information and timescales to be available; it does not prescribe one universal response deadline for every report.