Identify the pre-supply checks, statement or deemed-compliance evidence, stop-supply decisions, notification and remediation duties required of UK importers and distributors, plus -specific investigation and record duties.
Sections 14 to 25 of the 2022 Act control the role-specific duties; the current 2023 Regulations set statement retention and deemed-compliance conditions, while OPSS guidance explains enforcement administration.
An or distributor must stop an in-scope product from reaching the UK market if the required statement evidence is missing or the business knows or believes the manufacturer has failed a relevant security requirement. An importer also investigates reported failures and keeps investigation records; a distributor has separate contact, notification, remediation, and stop-supply duties. These rules have applied since 29 April 2024 to relevant connectable products intended, or known or reasonably expected, to be UK consumer connectable products.
Classify the business role for the exact supply transaction. Under the Act, an brings a product into the United Kingdom from outside the United Kingdom and is not its manufacturer. A distributor makes a product available in the United Kingdom and is neither its manufacturer nor importer. A business that markets a product under its own name or trade mark is a manufacturer, so a private-label arrangement changes the duty set.
Before supply, both roles must decide whether the item is a relevant connectable product and whether they intend it to be, or know or ought to know it will be, a UK consumer connectable product. If so, they must comply with any security requirements that apply to their role and must not make the product available unless the statement-of-compliance route is satisfied.
Sources (4)
Sections 14 to 20 set importer duties, including investigation and record duties; sections 21 to 25 set distributor statement, stop-supply, remediation, contact and notification duties.
OPSS enforcement guidance explains the compliance-failure duties that apply to manufacturers, importers, authorised representatives, and distributors.
Government regime guidance identifies manufacturers, importers, and distributors as relevant persons and explains statement-of-compliance duties.
Official source supporting this page's Importer and Distributor Duties analysis.
Procurement or market-access teams should own the pre-supply gate, with product security assessing technical failures and legal or compliance staff reviewing scope and notification decisions. The evidence must identify the shipped product, not only a product family or an earlier firmware release.
Under the current Regulations, an must retain the statement for the longer of 10 years from issue or the defined support period stated in it. The importer must also keep each investigation record for 10 years from the day the record is made. That record must include the outcome, identified failure, remedial steps, and whether those steps succeeded.
Sources (3)
Official policy paper describing supply-chain duties, statements of compliance, and enforcement arrangements.
Official guidance on product scope, economic actors, and compliance.
Sets the importer's investigation-record contents, reasonable-steps exception for missing manufacturer information, and 10-year retention period.
Role labels in a contract do not settle the statutory classification. Check who imports the product, whose name or trademark is used, who first makes it available in the United Kingdom, and whether any modification or rebranding changes the manufacturer analysis.
The consumer-use test includes what the business ought to know, not only its stated sales channel. Review products sold as business-only if consumers could reasonably obtain and use them, and check Schedule 3 before assuming that another regulatory regime or product category creates an exception.
Sources (4)
Official guidance on how OPSS addresses compliance failures and actor-specific response duties.
Official policy paper describing supply-chain roles and statement-of-compliance duties.
Official guidance on product scope, exclusions, economic actors, and compliance.
Sets the current label conditions for deemed compliance with the statement-accompaniment requirement.
After supply, an that receives information about a possible importer or manufacturer compliance failure must take all reasonable steps to investigate. Importers and distributors must act when they become aware, or ought to be aware, of their own failure; the Act also sets separate steps when the failure is the manufacturer's.
Notifications depend on the role, whose failure it is, who has already been told, and whether specified customer-notification conditions apply. OPSS guidance says notifications to the authority should describe the failure, known risks, remedial steps, and whether remediation succeeded.
Sources (3)
Operational implementation support for Importer and Distributor Duties.
Operational implementation support for Importer and Distributor Duties.
Operational implementation support for Importer and Distributor Duties.
Assign the role decision, pre-supply gate, statement or label evidence, stop-supply authority, investigation, notification, and record duties.
Create role-specific questions, evidence fields, and review tasks for importers and distributors.
Use Research Copilot to answer follow-up questions with cited source material.
Review scope, evidence, owners, and the next compliance actions with Sorena.
Understand when a UK PSTI statement is required, the Schedule 4 fields, supply-chain checks, retention, digital accompaniment, and the December 2025 label route.
Publish a free, clear, accessible English reporting route plus expected acknowledgement and status-update times, and retain evidence that the information remained available.
Apply the UK PSTI tests in order: connectivity, current exceptions, UK consumer availability, supply facts, and the manufacturer, importer, or distributor trigger.
Use a release checklist with scope, role, security-control, statement, records, and compliance-failure evidence for UK consumer connectable products.
Build a UK PSTI compliance process covering product scope, supply-chain roles, the three security requirements, statements, records, and post-market failures.
Apply the UK PSTI password rule to each relevant password, test unique-per-product generation, and keep reset and release evidence for the shipped model.
Distinguish manufacturer, importer, distributor, and authorised-representative duties per product and supply route, including rebranding, imports, statement checks, stop-supply decisions, and compliance failures.
Implement the UK PSTI password rule and publish a defined security support period with the required end date, access conditions, and change controls.
Track the UK PSTI regime's commencement and amendment dates, product-specific support periods, record retention, and OPSS response and appeal windows.
Get direct, sourced answers on product scope, exceptions, roles, passwords, vulnerability reporting, update-period information, statements, records, and OPSS enforcement.
Publish the minimum security-update period and end date in English, free of charge, without prior request, and in clear language, without implying that PSTI sets one duration for every product.
Understand OPSS investigations, compliance, stop and recall notices, monetary penalties, forfeiture, court orders, representations, appeals, and evidence needed to respond.
Prepare for compliance, stop, and recall notices by understanding their effects, representation and appeal routes, product records, and corrective-action evidence.
Understand the maximum fixed and daily PSTI penalties, how OPSS sets an amount, representation and appeal rights, and separate court-ordered sanctions.
Read the three Schedule 1 security requirements and the surrounding manufacturer, importer, distributor, statement, record, and failure-response duties.
Decide whether one product meets the UK PSTI connectivity definition, falls within a current exception, and reaches the separate UK-consumer duty tests.
Understand which connected product categories can enter UK PSTI scope, how the statutory tests work, and why examples never replace the current exception schedule.
Decide whether a product falls within the UK PSTI product-security regime by checking connectivity, consumer supply, exceptions, actor roles, and product-specific evidence.
Implement the three UK PSTI security requirements through product specifications, release tests, public information, approvals, and post-release evidence.
Join the prescribed statement fields to product identifiers, control evidence, publication records, supply-chain checks, accompaniment evidence, retention, and change management.
Build a statement record with the prescribed Schedule 4 information and evidence that it accompanied the product, while checking whether a current Schedule 2A deemed-compliance route applies.
Prepare, approve, provide, verify, retain, and update statement evidence before a relevant connectable product is made available in the UK.
Set, publish, approve, and preserve the product-specific minimum security-update period and end date, then control changes and customer information against the shipped product.
Map ETSI EN 303 645 and TS 103 701 evidence to the three UK legal requirements without treating the wider voluntary ETSI baseline as if every provision were mandatory under PSTI.
Compare UK PSTI with Australia's Cyber Security Act smart-device rules by scope, duties, statements, security controls, retention, dates, and enforcement.
See how binding UK PSTI duties relate to ETSI EN 303 645, which edition the UK Regulations name, what the standard adds, and what evidence to retain.
Decide whether UK PSTI, the EU Cyber Resilience Act, or both apply, then compare actors, exclusions, security work, documents, reporting, and dates.
Compare UK PSTI and the EU Cyber Resilience Act by scope, security duties, support periods, conformity assessment, reporting, evidence, and application dates.
Operate intake, acknowledgement, status updates, investigation, remediation, disclosure, and evidence while keeping the legal publication duty distinct from broader good-practice response targets.
PSTI requires each covered password to be user-defined or unique per product. Unique credentials must not use prohibited predictable generation methods.
ETSI EN 303 645 and TS 103 701 can structure technical evidence, but the standards-based PSTI route depends on the exact mapped provisions and additional Schedule 2 conditions.
An internet- or network-connectable product is outside the relevant-product definition only when a current Schedule 3 exception applies; record the exact category and facts rather than relying on a broad sector label.
Importers and distributors have their own statement, stop-supply, remediation, and notification duties; importers also have statutory investigation and 10-year investigation-record duties.
OPSS can use compliance, stop, and recall notices alongside monetary and other measures; notice recipients should preserve the notice, product scope, supply records, corrective actions, representations, and appeal dates.
A product is relevant when it is internet-connectable or network-connectable and not excepted, then the UK consumer-use and supply facts determine whether the Part 1 duties engage.
PSTI does not prescribe a universal minimum number of support years. The manufacturer sets and publishes a product-specific minimum period and end date; preserve the published commitment and assess any later change against the current Regulations.
Publish the minimum security-update period and end date in English, free of charge, without prior request, and in language understandable without technical knowledge.
A statement must contain the prescribed information and accompany the product unless a current deemed-compliance route applies; a digital method is possible, but each business must ensure that it meets the Act.
Publish a clear reporting route plus expected acknowledgement and status-update times. PSTI requires the information and timescales to be available; it does not prescribe one universal response deadline for every report.