How should teams handle update-transparency duties under UK PSTI Product Security?
Teams should treat Update Transparency under UK PSTI Act as a source-linked operating decision: confirm whether the product is a relevant connectable product and which manufacturer, importer, distributor, statement-of-compliance, vulnerability-disclosure, password, support-period, or OPSS enforcement duty is triggered, assign the team that can change the process, and keep evidence showing the action and review trigger.
The safest first step is to classify the product and supply-chain role before deciding whether the duty belongs to the manufacturer, importer, distributor, or all of them.
- Write the Update Transparency decision in one sentence before drafting controls.
- Attach the external source URL and a short source quote to the evidence record.
- Route unclear cases to legal, privacy, security, or compliance review before launch.
OPSS enforcement guidance for the PSTI Act and 2023 Regulations, including how non-compliance with product-security duties can be addressed.
GOV.UK overview confirming that the UK product-security regime includes publishing information on minimum security update periods.
GOV.UK implementation guidance for the PSTI duties that include publishing minimum security update-period information.