UK PSTI Product Security Importer And Distributor Duties

Start by deciding whether the product is a relevant connectable product and which manufacturer, importer, or distributor duty is triggered. Importers are the businesses that bring the product from outside the UK into the UK and are not the manufacturer; distributors are the businesses that make the product available in the UK and are not the manufacturer or importer. The useful answer should name the exact trigger, affected product or process, required action, owner, evidence, and escalation point.

Keep the legal source, product-scope decision, manufacturer/importer/distributor role, statement of compliance, and technical evidence together so OPSS-facing records are reviewable.

Ownership should sit with the team that controls product design, supply-chain placement, importer/distributor checks, or customer security information, with legal and product-security review.

Evidence should show relevant-connectable-product scope, default-password controls, vulnerability disclosure channel, minimum support period, statement of compliance, supply-chain role checks, and OPSS notice response readiness.

Most PSTI mistakes happen at the boundary between manufacturer, Importer And Distributor Duties, excepted products, bundled products, support-period statements, and evidence that does not match the shipped product.

Use this section before UK market placement, importer onboarding, distributor acceptance, or support-period publication so the evidence matches the actual product and supply-chain role.

Use a compact PSTI workflow that captures product scope, role, password control, vulnerability disclosure route, support-period information, statement-of-compliance approval, and OPSS escalation path.

The output should be a product-scope note, statement-of-compliance pack, supplier attestation, customer-facing support-period notice, or OPSS response record.