We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

Artifact GuideUKOPSS Notices

UK PSTI Product Security OPSS Notices

OPSS can use compliance, stop, and recall notices alongside monetary and other measures; notice recipients should preserve the notice, product scope, supply records, corrective actions, representations, and appeal dates.

The Act sets the legal tests and notice powers; OPSS publishes the enforcement approach it applies on behalf of DSIT.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Jul 24, 2026
4 sections7 primary sources
Overview

OPSS can use compliance, stop, and recall notices alongside monetary and other measures; notice recipients should preserve the notice, product scope, supply records, corrective actions, representations, and appeal dates.

Search this module

Find a question or answer quickly

4 of 4 questions
Question 1

What can an OPSS notice require?

Treat a notice served by OPSS as a formal enforcement document. OPSS enforces the PSTI product-security regime under an arrangement with the Department for Science, Innovation and Technology, while the Act states the powers in terms of the Secretary of State. Read the notice itself for the product, legal entity, alleged failure, required action, evidence, deadline and review or appeal route.

A can require the recipient to comply with a duty, take specified steps and provide evidence. A can prohibit a specified activity, including making a product available, and may require customer risk communications. A can require steps to organise the return of products already supplied. Recall is a stronger measure: section 30 limits it to a failure to comply with a security requirement and requires the statutory conditions concerning inadequate action and insufficient alternative powers to be met.

  • Identify whether the document is a , , , , information request or another enforcement step.
  • Do not assume voluntary correction cancels a notice; obtain written confirmation of any variation or withdrawal.
  • Separate pre-notice representations from a formal appeal. Compliance, stop, and recall notices ordinarily follow notice of the proposed action and a 10-day representation period; the urgent-need exception applies to stop and recall notices, not compliance notices. An appeal against an enforcement notice must normally be brought to the First-tier Tribunal within 28 days; under section 33, the notice or appealed variation has no effect until that appeal is determined or withdrawn.
Question 2

What should the recipient do first?

Preserve the notice and its delivery details, then create a response record without changing or deleting the underlying product evidence. Confirm the named legal entity and supply-chain role, the affected models, batches and software versions, where stock is held, which customers received it, and whether supply must stop immediately.

Assign one response owner and involve legal counsel where necessary to protect deadlines and procedural rights. The factual work should run in parallel: secure relevant logs and documents, reproduce the alleged failure, trace units through the supply chain, assess remediation and customer risk, and document every communication with OPSS. Answer information requests accurately and within their stated scope.

  • Keep the notice, envelope or electronic receipt, service date, deadlines, correspondence and decision log.
  • Preserve product-scope records, statements of compliance, security tests, vulnerability reports, support commitments, sales and shipment data, customer contacts and corrective-action evidence.
  • Track each required action to an owner, completion date and proof submitted; retain the exact version sent to OPSS.
Question 3

How do penalties and challenges fit?

A is separate from a compliance, stop or . If the Secretary of State is satisfied on the balance of probabilities that a person failed to comply with a relevant duty, section 36 permits a financial penalty. The maximum fixed penalty is the greater of GBP 10 million and 4% of the person's qualifying worldwide revenue. A further daily penalty can be imposed for continuing failure, up to GBP 20,000 per day. These are statutory ceilings, not automatic penalties.

The Act provides review and appeal mechanisms for specified notices and penalties. The available route, deadline, tribunal and effect on the notice depend on the provision used and the notice served. Use the notice and current Act text rather than a generic timetable. Continue to control product risk and preserve evidence while any challenge is considered.

  • Do not describe the maximum penalty as the likely outcome or as applying automatically to every breach.
  • Do not miss a deadline while debating product scope; record the dispute and protect the procedural route stated in the notice.
  • Do not restart supply solely because a technical fix exists; confirm that every notice condition and required verification step has been satisfied.
Question 4

Questions and answers

What is the difference between a compliance, stop, and ?

A requires compliance with a specified Chapter 2 duty. A requires a specified activity to stop. A requires arrangements for products already supplied to customers to be returned and is available only when section 30's additional tests are met.

How long does a recipient have to appeal a PSTI enforcement notice?

An appeal against a compliance, stop, or , or a variation of one, must normally reach the First-tier Tribunal within 28 days from the notice or variation. Check the document and current Act because the route and deadline depend on the enforcement step.

What evidence should be preserved after an OPSS notice?

Preserve the notice and service details, affected product and software identifiers, scope and duty-holder records, statements, test and vulnerability evidence, support commitments, stock and customer tracing, corrective actions, communications, submissions, deadlines, and the decision authorising any restart of supply.

Recommended next step

Organise your response to an OPSS notice

Record the served notice, affected products, required actions, response owner, evidence, and representation or appeal deadline.

Assessment workflow
Open Assessment Autopilot for UK PSTI Product Security

Create notice-specific actions and evidence requests for the response team.

Explore next step
Research workflow
Review UK PSTI Product Security source evidence

Use Research Copilot to answer follow-up questions with cited source material.

Explore next step
Talk to Sorena
Talk through implementation

Review scope, evidence, owners, and the next compliance actions with Sorena.

Explore next step
Primary sources

References and citations

OPSS: Consumer connectable product security regulations
gov.uk3 citations
Referenced sections
  • Explains OPSS's use of compliance, stop, recall and financial-penalty powers.
  • Explains how OPSS describes and uses the Act's enforcement actions.
  • Summarises the available enforcement actions and OPSS process.
OPSS Enforcement Policy
gov.uk2 citations
Referenced sections
  • Explains OPSS's general enforcement principles and decision-making approach.
  • Explains OPSS's general enforcement approach, including proportionality, evidence and engagement.

Related guides

UK PSTI Default Password Rules

PSTI requires each covered password to be user-defined or unique per product. Unique credentials must not use prohibited predictable generation methods.

UK PSTI ETSI Evidence and Deemed Compliance

ETSI EN 303 645 and TS 103 701 can structure technical evidence, but the standards-based PSTI route depends on the exact mapped provisions and additional Schedule 2 conditions.

UK PSTI Excepted Products and Boundaries

An internet- or network-connectable product is outside the relevant-product definition only when a current Schedule 3 exception applies; record the exact category and facts rather than relying on a broad sector label.

UK PSTI Importer and Distributor Duties

Importers and distributors have their own statement, stop-supply, remediation, and notification duties; importers also have statutory investigation and 10-year investigation-record duties.

UK PSTI Relevant Connectable Product Scope

A product is relevant when it is internet-connectable or network-connectable and not excepted, then the UK consumer-use and supply facts determine whether the Part 1 duties engage.

UK PSTI Security Update Support Periods

PSTI does not prescribe a universal minimum number of support years. The manufacturer sets and publishes a product-specific minimum period and end date; preserve the published commitment and assess any later change against the current Regulations.

Show all related guides (39)

UK PSTI Security Update Transparency

Publish the minimum security-update period and end date in English, free of charge, without prior request, and in language understandable without technical knowledge.

UK PSTI Statement of Compliance: Contents, Delivery, and Records

A statement must contain the prescribed information and accompany the product unless a current deemed-compliance route applies; a digital method is possible, but each business must ensure that it meets the Act.

UK PSTI Vulnerability Disclosure Requirements

Publish a clear reporting route plus expected acknowledgement and status-update times. PSTI requires the information and timescales to be available; it does not prescribe one universal response deadline for every report.

UK PSTI Act statement of compliance: what must the SoC contain?

Understand when a UK PSTI statement is required, the Schedule 4 fields, supply-chain checks, retention, digital accompaniment, and the December 2025 label route.

UK PSTI Act: vulnerability disclosure policy requirements and template

Publish a free, clear, accessible English reporting route plus expected acknowledgement and status-update times, and retain evidence that the information remained available.

UK PSTI applicability test: product, market, and actor scope

Apply the UK PSTI tests in order: connectivity, current exceptions, UK consumer availability, supply facts, and the manufacturer, importer, or distributor trigger.

UK PSTI compliance checklist for product release

Use a release checklist with scope, role, security-control, statement, records, and compliance-failure evidence for UK consumer connectable products.

UK PSTI compliance: duties, evidence, and response

Build a UK PSTI compliance process covering product scope, supply-chain roles, the three security requirements, statements, records, and post-market failures.

UK PSTI default password requirements

Apply the UK PSTI password rule to each relevant password, test unique-per-product generation, and keep reset and release evidence for the shipped model.

UK PSTI Manufacturer, Importer and Distributor Roles

Distinguish manufacturer, importer, distributor, and authorised-representative duties per product and supply route, including rebranding, imports, statement checks, stop-supply decisions, and compliance failures.

UK PSTI password and security update policy requirements

Implement the UK PSTI password rule and publish a defined security support period with the required end date, access conditions, and change controls.

UK PSTI Product Security Deadlines and Compliance Calendar Guide

Track the UK PSTI regime's commencement and amendment dates, product-specific support periods, record retention, and OPSS response and appeal windows.

UK PSTI Product Security FAQ

Get direct, sourced answers on product scope, exceptions, roles, passwords, vulnerability reporting, update-period information, statements, records, and OPSS enforcement.

UK PSTI Product Security Importer and Distributor Duties Guide

Identify the pre-supply checks, statement or deemed-compliance evidence, stop-supply decisions, notification and remediation duties required of UK importers and distributors, plus importer-specific investigation and record duties.

UK PSTI Product Security Minimum Support Period and Update Transparency Guide

Publish the minimum security-update period and end date in English, free of charge, without prior request, and in clear language, without implying that PSTI sets one duration for every product.

UK PSTI Product Security OPSS Enforcement and Penalties Guide

Understand OPSS investigations, compliance, stop and recall notices, monetary penalties, forfeiture, court orders, representations, appeals, and evidence needed to respond.

UK PSTI Product Security OPSS Notices Guide

Prepare for compliance, stop, and recall notices by understanding their effects, representation and appeal routes, product records, and corrective-action evidence.

UK PSTI Product Security Penalties and Fines Guide

Understand the maximum fixed and daily PSTI penalties, how OPSS sets an amount, representation and appeal rights, and separate court-ordered sanctions.

UK PSTI product security requirements

Read the three Schedule 1 security requirements and the surrounding manufacturer, importer, distributor, statement, record, and failure-response duties.

UK PSTI relevant connectable product scope test

Decide whether one product meets the UK PSTI connectivity definition, falls within a current exception, and reaches the separate UK-consumer duty tests.

UK PSTI relevant connectable products: categories and exceptions

Understand which connected product categories can enter UK PSTI scope, how the statutory tests work, and why examples never replace the current exception schedule.

UK PSTI Scope Classifier Workflow

Decide whether a product falls within the UK PSTI product-security regime by checking connectivity, consumer supply, exceptions, actor roles, and product-specific evidence.

UK PSTI security requirements in practice

Implement the three UK PSTI security requirements through product specifications, release tests, public information, approvals, and post-release evidence.

UK PSTI Statement of Compliance Evidence Pack

Join the prescribed statement fields to product identifiers, control evidence, publication records, supply-chain checks, accompaniment evidence, retention, and change management.

UK PSTI Statement of Compliance Template

Build a statement record with the prescribed Schedule 4 information and evidence that it accompanied the product, while checking whether a current Schedule 2A deemed-compliance route applies.

UK PSTI Statement of Compliance Workflow

Prepare, approve, provide, verify, retain, and update statement evidence before a relevant connectable product is made available in the UK.

UK PSTI Support Period Evidence Workflow

Set, publish, approve, and preserve the product-specific minimum security-update period and end date, then control changes and customer information against the shipped product.

UK PSTI to ETSI Evidence Mapping

Map ETSI EN 303 645 and TS 103 701 evidence to the three UK legal requirements without treating the wider voluntary ETSI baseline as if every provision were mandatory under PSTI.

UK PSTI vs Australia Smart Device Rules

Compare UK PSTI with Australia's Cyber Security Act smart-device rules by scope, duties, statements, security controls, retention, dates, and enforcement.

UK PSTI vs ETSI EN 303 645

See how binding UK PSTI duties relate to ETSI EN 303 645, which edition the UK Regulations name, what the standard adds, and what evidence to retain.

UK PSTI vs EU Cyber Resilience Act

Decide whether UK PSTI, the EU Cyber Resilience Act, or both apply, then compare actors, exclusions, security work, documents, reporting, and dates.

UK PSTI vs EU Cyber Resilience Act (CRA)

Compare UK PSTI and the EU Cyber Resilience Act by scope, security duties, support periods, conformity assessment, reporting, evidence, and application dates.

UK PSTI Vulnerability Disclosure Workflow

Operate intake, acknowledgement, status updates, investigation, remediation, disclosure, and evidence while keeping the legal publication duty distinct from broader good-practice response targets.