Questions and answers

The rule has applied since 29 April 2024 when a manufacturer makes a relevant connectable product available to UK consumers and no product exception applies. Typical examples can include connected cameras, speakers, toys, appliances, hubs, and wearables, but classification depends on the product's internet or network connectivity, intended consumer availability, supply facts, and Schedule 3 exceptions. Excepted products include specified medical, smart-meter, electric-vehicle charging, computer, and vehicle categories only when their exact conditions are met.

Schedule 1 applies the password rule to the product's hardware and pre-installed software when the product is not in the factory default state. It also covers software that is not pre-installed at supply but must be installed on the product for every manufacturer-intended purpose that uses the product's hardware, pre-installed software, or installable software. Cryptographic keys, API keys, and pairing PINs for protocols outside the Internet Protocol suite are excluded from this password definition. The manufacturer is the duty-holder for this security requirement.

A covered password must either be defined by the user or be unique per product. A unique-per-product password must not be based on incremental counters or public information. It may be based on or derived from a unique product identifier only when an encryption method or keyed hashing algorithm accepted as good industry practice is used. It must not otherwise be guessable in a manner unacceptable as good industry practice.

Keep a credential inventory tied to the product model, firmware, software installed or required to be installed on the product, and factory-reset behavior. For user-defined passwords, preserve the setup flow and tests showing that the user defines the credential before the relevant access is enabled. For unique passwords, preserve the generation design, unpredictability rationale, provisioning controls, and tests showing that credentials do not repeat across sampled units.

If a password is derived from a serial number, MAC address, or another unique identifier, document the accepted encryption or keyed-hashing method. Encoding, truncation, reversal, or a secret-free formula does not establish the statutory exception.

Schedule 2 can provide deemed compliance for the password requirement when the exact standards or current-label conditions are met. For the original ETSI route, preserve the V2.1.1 assessment against provisions 5.1-1 and, where relevant, 5.1-2 plus the additional statutory conditions. From 4 December 2025, verify any claimed Japan JC-STAR STAR-1 or Singapore Cybersecurity Labelling Scheme route against the amended Schedule, the covered product, and the label's current status.

Do not limit the review to a shared factory password. Predictable per-unit credentials can still fail, and the product's setup, recovery, service, and factory-reset states can expose different covered passwords. A test report for ETSI EN 303 645 also does not replace the separate product-scope, statement-of-compliance, supply-chain, investigation, notification, and record duties in the Act.

When a product has more than one manufacturer for PSTI purposes, including a business selling a white-label product under its own name or trade mark, each manufacturer must meet the applicable security requirement or a deemed-compliance condition. Importers and distributors must perform their own statement and supply checks and act when the statutory knowledge or belief test for a compliance failure is met.

The 2023 Regulations name ETSI EN 303 645 V2.1.1, dated 19 June 2020. Schedule 2 maps the password requirement to provisions 5.1-1 and, where relevant, 5.1-2; vulnerability reporting to provision 5.2-1; and support-period information to provision 5.3-13, subject to the Schedule's additional conditions.

Only those mapped conditions create the original ETSI deemed compliance route. The rest of EN 303 645 can improve product security, but it is not automatically a binding PSTI requirement. A later ETSI edition does not replace V2.1.1 in the Regulations unless the law is amended.

For the ETSI support-period route, use the Regulations' definition: a minimum period with an end date. Publish extensions as soon as practicable, retain the rule against shortening an already published period, and give the information equal prominence alongside the specified purchase information on qualifying manufacturer-controlled websites. The information must be accessible, clear and transparent, available without request, in English, free of charge, without asking for personal information, and understandable without prior technical knowledge. Apply each ETSI provision to the hardware and software categories specified for that requirement in Schedule 1.

From 4 December 2025, the amended Regulations also provide specified routes based on current Japan JC-STAR STAR-1 and Singapore Cybersecurity Labelling Scheme labels. They also add Schedule 2A conditions for deemed compliance with the manufacturer's statement-accompaniment duty. These are condition-specific alternatives, not recognition of every foreign certificate or a waiver of all PSTI duties.

ETSI TS 103 701 V1.1.1 is a conformance-assessment specification for the EN 303 645 V2.1.1 baseline. It provides implementation conformance statement fields and conceptual and functional test cases. It can structure evidence for password generation, vulnerability-policy publication, and support-period publication.

A TS 103 701 report should identify the device under test, hardware, firmware, companion applications, associated services, interfaces, applicable provisions, implementation claims, test methods, samples, evidence, deviations, and verdicts. Its value depends on matching the assessed configuration to the product and services supplied in the United Kingdom.

Use a three-step mapping. First, identify the exact Schedule 1 duty and Schedule 2 condition. Second, link it to the named EN 303 645 V2.1.1 provision and any additional statutory condition. Third, link each implementation claim and TS 103 701 verdict to dated design and test evidence for the released product.

An ETSI assessment does not decide whether the product is a relevant connectable product, whether it is made available as a UK consumer connectable product, or which business is a manufacturer, importer, or distributor. It also does not replace statement accompaniment, retention, supply-chain checks, or the Act's investigation, remediation, notification, and record duties.

Where an exact Schedule 2A condition applies from 4 December 2025, it can replace the manufacturer's statement-accompaniment duty for that product and condition. It does not automatically remove importer or distributor checks, retention duties attached to a statement that is still required, compliance-failure duties, or other security requirements.

The current-label routes depend on the specified scheme, product, condition, and label status. A supplier declaration, expired label, different scheme level, or assessment of a related model should not be described as a general recognition of the supplied product.

A connectable product is outside the relevant-product definition only if it meets an exception in the current Schedule 3. The categories cover specified products supplied in Northern Ireland, qualifying electric-vehicle smart charge points, products to which the Medical Devices Regulations 2002 apply, qualifying smart-meter products, specified computers, and three Great Britain vehicle categories added on 25 February 2025. The PSTI regime itself took effect on 29 April 2024.

A category name is not enough. Each paragraph has its own conditions, territorial limits, referenced legislation, and carve-outs. Record the exact paragraph and the product facts that meet every element.

The medical-device exception applies to products to which the Medical Devices Regulations 2002 apply, but Schedule 3 says a relevant connectable product is not excepted merely because software to which those Regulations apply is installed or operable on it. Classify the hardware product and the software separately.

The computer exception covers desktop and laptop computers and non-cellular tablets, but not products in those categories that the manufacturer's intended purpose designs exclusively for children under 14. For tablets, cellular capability changes the result. The smart-meter and charge-point exceptions also depend on the specific statutory conditions, not a marketing description.

The vehicle amendment applies in Great Britain to motor vehicles and trailers, and systems, components, and separate technical units intended for them, where Regulation (EU) 2018/858 applies; two- or three-wheel vehicles and quadricycles where Regulation (EU) 168/2013 applies; and agricultural and forestry vehicles where Regulation (EU) 167/2013 applies. Test an accessory against the cited sector instrument instead of assuming that everything sold for a vehicle is excepted.

Keep the product model and configuration, connectivity analysis, market and supply route, intended purpose, category-specific evidence, cited legislation, owner, reviewer, decision date, and change triggers. If the exception depends on an assurance scheme, licence holder, sector regulation, or product label, preserve the record proving that condition.

Do not discard the scope record after deciding that a product is excepted. A firmware, connectivity, intended-purpose, product-composition, market, or legislative change can alter the result.

The regime took effect on 29 April 2024. The 2023 Regulations direct the password, vulnerability-disclosure and support-period security requirements at manufacturers. Importers and distributors nevertheless have their own duties under the Act: check statement accompaniment, stop supply in specified circumstances, remedy their own compliance failures, contact other actors, and notify OPSS or customers when the statutory conditions are met. Importers must also investigate possible importer or manufacturer compliance failures when section 17 applies and keep the investigation records required by section 20.

First identify the role by what the business actually does. An importer brings a product from outside the United Kingdom into the United Kingdom and is not its manufacturer. A distributor makes a product available in the United Kingdom but is neither its manufacturer nor importer. A business that applies its own name or trade mark can be a manufacturer instead, even if another company made the hardware.

An importer must investigate a possible importer or manufacturer compliance failure when section 17's trigger is met and take all reasonable steps to resolve the investigation. A distributor has no equivalent statutory investigation duty, but sections 24 and 25 require action once it becomes aware, or ought to be aware, of a distributor or manufacturer compliance failure. The next action depends on the actor whose duty failed, whether the product has already been supplied, whether the failure is remediable, and the applicable notification conditions.

For a manufacturer compliance failure, the importer or distributor must contact the manufacturer as soon as possible unless the statutory prior-notification exception applies. If it appears unlikely that the manufacturer will remedy the failure, the supply-chain actor must take all reasonable steps, as soon as practicable, to prevent products not yet supplied to customers from being made available to them.

Notification is not one generic mailing list. An importer can have to notify OPSS, affected distributors, and customers where specified conditions are met. A distributor can have to notify OPSS, the relevant importer or other distributors, and customers where specified conditions are met. Sections 19 and 25 remove duplicate contact or notification steps in defined cases where another relevant person has already supplied the information.

The evidence file should connect the product to the correct actor and decision at each supply stage. Keep the scope analysis, role determination, manufacturer identity, ordinary statement or current Schedule 2A label evidence, statement-retention deadline where applicable, technical assurance received, batch and shipment records, and any investigation file.

Manufacturer test evidence can inform an importer or distributor's decision, but it does not transfer the statutory duty. Conversely, importers and distributors are not required by the current Regulations to recreate the manufacturer's technical testing. They need enough reliable information to perform their own checks and respond when they know, believe or receive information suggesting a failure.

Schedule 2A accepts a current, unexpired Japan JC-STAR STAR-1 conformance label or a current, unexpired label at any level of the Singapore Cybersecurity Labelling Scheme for statement accompaniment. Check the label against the specific product and retain its validity evidence; this is a statement route, so assess the security requirements separately.