UK PSTI Product Security Importer and Distributor Duties

Classify the business role for the exact supply transaction. Under the Act, an importer brings a product into the United Kingdom from outside the United Kingdom and is not its manufacturer. A distributor makes a product available in the United Kingdom and is neither its manufacturer nor importer. A business that markets a product under its own name or trade mark is a manufacturer, so a private-label arrangement changes the duty set.

Before supply, both roles must decide whether the item is a relevant connectable product and whether they intend it to be, or know or ought to know it will be, a UK consumer connectable product. If so, they must comply with any security requirements that apply to their role and must not make the product available unless the statement-of-compliance route is satisfied.

Procurement or market-access teams should own the pre-supply gate, with product security assessing technical failures and legal or compliance staff reviewing scope and notification decisions. The evidence must identify the shipped product, not only a product family or an earlier firmware release.

Under the current Regulations, an importer must retain the statement for the longer of 10 years from issue or the defined support period stated in it. The importer must also keep each investigation record for 10 years from the day the record is made. That record must include the outcome, identified failure, remedial steps, and whether those steps succeeded.

Role labels in a contract do not settle the statutory classification. Check who imports the product, whose name or trademark is used, who first makes it available in the United Kingdom, and whether any modification or rebranding changes the manufacturer analysis.

The consumer-use test includes what the business ought to know, not only its stated sales channel. Review products sold as business-only if consumers could reasonably obtain and use them, and check Schedule 3 before assuming that another regulatory regime or product category creates an exception.

After supply, an importer that receives information about a possible importer or manufacturer compliance failure must take all reasonable steps to investigate. Importers and distributors must act when they become aware, or ought to be aware, of their own failure; the Act also sets separate steps when the failure is the manufacturer's.

Notifications depend on the role, whose failure it is, who has already been told, and whether specified customer-notification conditions apply. OPSS guidance says notifications to the authority should describe the failure, known risks, remedial steps, and whether remediation succeeded.