Program GuideGovernance and Operations

UK PSTI Act Compliance Program

A workable PSTI program connects legal duties to engineering, support, and channel operations.

The goal is to keep each in-scope product inside a defensible security and documentation posture from launch through the support period.

Author
Sorena AI
Published
Feb 22, 2026
Updated
Feb 22, 2026
Sections
3

Structured answer sets in this page tree.

Primary sources
3

Cited legal and guidance references.

Publication metadata
Sorena AI
Published Feb 22, 2026
Updated Feb 22, 2026
Overview

A strong PSTI program has four layers: product scope and role allocation, implementation of the three mandatory security duties, statement or deemed-compliance governance, and post-market compliance-failure response. The same governance should absorb firmware changes, support-period changes, label-status changes, and supply-chain escalation events.

Section 1

Set governance per product family, not only per brand

Each product family should have a named owner for scope, controls, and the correct UK documentation route. The program should not rely on a single central policy team to interpret every product change after the fact.

This is what keeps the support-period, statement, and any label-based deemed-compliance data current.

  • Product owner, legal owner, and evidence owner assigned
  • Quarterly review cadence across engineering, support, and compliance
  • One evidence location per product family
Section 3

Measure readiness by evidence retrieval and failure handling

OPSS readiness is not only whether the control exists. It is whether the business can retrieve the scope memo, the correct statement or Schedule 2A evidence set, any applicable retention record, and the compliance-failure file quickly and coherently.

Run mock cases before a real issue appears.

  • Test statement or Schedule 2A evidence retrieval and any applicable retention controls
  • Run a mock compliance-failure escalation exercise
  • Review whether support-period promises still match live product support
Recommended next step

Turn UK PSTI Act Compliance Program into an operational assessment

Assessment Autopilot can take UK PSTI Act Compliance Program from operationalizing the guidance into a tracked program to a reusable workflow inside Sorena. Teams working on UK PSTI Act can keep owners, evidence, and next steps aligned without copying this guide into separate documents.

Primary sources

References and citations

gov.uk
Referenced sections
  • Risk-based, proportionate, transparent, and escalating enforcement approach used by OPSS.
Related guides

Explore more topics

UK PSTI Act Applicability Test | Relevant Connectable Product Scope and Exclusions
Grounded UK PSTI applicability test covering section 4 relevant connectable product logic, internet-connectable and network-connectable products.
UK PSTI Act Checklist | Scope, Statements, Security Controls, and Records
Audit-ready UK PSTI checklist covering product scope, role allocation, the three mandatory security requirements, statement of compliance handling, retention.
UK PSTI Act Deadlines and Compliance Calendar | Royal Assent, Commencement, and Review Dates
Grounded UK PSTI calendar covering 6 December 2022 Royal Assent, 29 April 2024 commencement, and the 2025 amendments now in force.
UK PSTI Act FAQ | Scope, Statements, Support Periods, and OPSS Questions
Practical FAQ on the UK PSTI regime covering product scope, the three mandatory requirements, statement of compliance issues, role duties, retention.
UK PSTI Act Requirements | Mandatory Security Duties, Statements, and Records
Detailed UK PSTI requirements guide covering the three mandatory security requirements, statement and deemed-compliance rules, and retention periods where the statement route applies.
UK PSTI OPSS Enforcement and Penalties | Risk Based Intervention and Escalation
Grounded OPSS enforcement guide for the UK PSTI regime covering risk-based and proportionate intervention, escalating enforcement, evidence expectations.
UK PSTI Password and Update Policy Requirements | Default Passwords, Disclosure, and Support Period
Grounded guide to UK PSTI password and update obligations covering unique or user-defined credentials, public vulnerability disclosure information.
UK PSTI Penalties and Fines | Financial and Operational Exposure
Practical guide to UK PSTI penalties and enforcement exposure covering why statement defects, support-period mismatches.
UK PSTI Relevant Connectable Products Scope | Internet Connectable, Network Connectable, and Exclusions
Detailed scope guide for UK PSTI relevant connectable products covering section 4 and 5 definitions, internet-connectable products.
UK PSTI Security Requirements in Practice | Engineering and Support Implementation
Operational guide for implementing UK PSTI security requirements in practice across engineering, firmware, support, vulnerability handling.
UK PSTI Statement of Compliance and Evidence | Statements, Summaries, and Retention
Grounded guide to UK PSTI statement-of-compliance obligations covering section 9, Schedule 2A alternatives, minimum information, and retention where the statement route applies.
UK PSTI Statement of Compliance Template | Drafting Pattern and Evidence Inputs
Practical UK PSTI statement of compliance template guide covering product identification, applicable requirements, defined support period, drafting controls.
UK PSTI Supply Chain Roles | Manufacturer, Importer, and Distributor Duties
Grounded guide to UK PSTI supply-chain roles covering manufacturer, importer, and distributor duties, statement handling, compliance-failure escalation.
UK PSTI vs EU Cyber Resilience Act | Product Scope, Duties, and Evidence Differences
Practical comparison of the UK PSTI regime and the EU Cyber Resilience Act covering product scope, baseline security duties, vulnerability handling.