UK PSTI Product Security ETSI Evidence

The 2023 Regulations name ETSI EN 303 645 V2.1.1, dated 19 June 2020. Schedule 2 maps the password requirement to provisions 5.1-1 and, where relevant, 5.1-2; vulnerability reporting to provision 5.2-1; and support-period information to provision 5.3-13, subject to the Schedule's additional conditions.

Only those mapped conditions create the original ETSI deemed compliance route. The rest of EN 303 645 can improve product security, but it is not automatically a binding PSTI requirement. A later ETSI edition does not replace V2.1.1 in the Regulations unless the law is amended.

For the ETSI support-period route, use the Regulations' definition: a minimum period with an end date. Publish extensions as soon as practicable, retain the rule against shortening an already published period, and give the information equal prominence alongside the specified purchase information on qualifying manufacturer-controlled websites. The information must be accessible, clear and transparent, available without request, in English, free of charge, without asking for personal information, and understandable without prior technical knowledge. Apply each ETSI provision to the hardware and software categories specified for that requirement in Schedule 1.

From 4 December 2025, the amended Regulations also provide specified routes based on current Japan JC-STAR STAR-1 and Singapore Cybersecurity Labelling Scheme labels. They also add Schedule 2A conditions for deemed compliance with the manufacturer's statement-accompaniment duty. These are condition-specific alternatives, not recognition of every foreign certificate or a waiver of all PSTI duties.

ETSI TS 103 701 V1.1.1 is a conformance-assessment specification for the EN 303 645 V2.1.1 baseline. It provides implementation conformance statement fields and conceptual and functional test cases. It can structure evidence for password generation, vulnerability-policy publication, and support-period publication.

A TS 103 701 report should identify the device under test, hardware, firmware, companion applications, associated services, interfaces, applicable provisions, implementation claims, test methods, samples, evidence, deviations, and verdicts. Its value depends on matching the assessed configuration to the product and services supplied in the United Kingdom.

Use a three-step mapping. First, identify the exact Schedule 1 duty and Schedule 2 condition. Second, link it to the named EN 303 645 V2.1.1 provision and any additional statutory condition. Third, link each implementation claim and TS 103 701 verdict to dated design and test evidence for the released product.

An ETSI assessment does not decide whether the product is a relevant connectable product, whether it is made available as a UK consumer connectable product, or which business is a manufacturer, importer, or distributor. It also does not replace statement accompaniment, retention, supply-chain checks, or the Act's investigation, remediation, notification, and record duties.

Where an exact Schedule 2A condition applies from 4 December 2025, it can replace the manufacturer's statement-accompaniment duty for that product and condition. It does not automatically remove importer or distributor checks, retention duties attached to a statement that is still required, compliance-failure duties, or other security requirements.

The current-label routes depend on the specified scheme, product, condition, and label status. A supplier declaration, expired label, different scheme level, or assessment of a related model should not be described as a general recognition of the supplied product.