UK PSTI Product Security Importer and Distributor Duties

The regime took effect on 29 April 2024. The 2023 Regulations direct the password, vulnerability-disclosure and support-period security requirements at manufacturers. Importers and distributors nevertheless have their own duties under the Act: check statement accompaniment, stop supply in specified circumstances, remedy their own compliance failures, contact other actors, and notify OPSS or customers when the statutory conditions are met. Importers must also investigate possible importer or manufacturer compliance failures when section 17 applies and keep the investigation records required by section 20.

First identify the role by what the business actually does. An importer brings a product from outside the United Kingdom into the United Kingdom and is not its manufacturer. A distributor makes a product available in the United Kingdom but is neither its manufacturer nor importer. A business that applies its own name or trade mark can be a manufacturer instead, even if another company made the hardware.

An importer must investigate a possible importer or manufacturer compliance failure when section 17's trigger is met and take all reasonable steps to resolve the investigation. A distributor has no equivalent statutory investigation duty, but sections 24 and 25 require action once it becomes aware, or ought to be aware, of a distributor or manufacturer compliance failure. The next action depends on the actor whose duty failed, whether the product has already been supplied, whether the failure is remediable, and the applicable notification conditions.

For a manufacturer compliance failure, the importer or distributor must contact the manufacturer as soon as possible unless the statutory prior-notification exception applies. If it appears unlikely that the manufacturer will remedy the failure, the supply-chain actor must take all reasonable steps, as soon as practicable, to prevent products not yet supplied to customers from being made available to them.

Notification is not one generic mailing list. An importer can have to notify OPSS, affected distributors, and customers where specified conditions are met. A distributor can have to notify OPSS, the relevant importer or other distributors, and customers where specified conditions are met. Sections 19 and 25 remove duplicate contact or notification steps in defined cases where another relevant person has already supplied the information.

The evidence file should connect the product to the correct actor and decision at each supply stage. Keep the scope analysis, role determination, manufacturer identity, ordinary statement or current Schedule 2A label evidence, statement-retention deadline where applicable, technical assurance received, batch and shipment records, and any investigation file.

Manufacturer test evidence can inform an importer or distributor's decision, but it does not transfer the statutory duty. Conversely, importers and distributors are not required by the current Regulations to recreate the manufacturer's technical testing. They need enough reliable information to perform their own checks and respond when they know, believe or receive information suggesting a failure.

Schedule 2A accepts a current, unexpired Japan JC-STAR STAR-1 conformance label or a current, unexpired label at any level of the Singapore Cybersecurity Labelling Scheme for statement accompaniment. Check the label against the specific product and retain its validity evidence; this is a statement route, so assess the security requirements separately.