We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

Artifact GuideUKMinimum Support Period and Update Transparency

UK PSTI Product Security Minimum Support Period and Update Transparency

Publish the minimum security-update period and end date in English, free of charge, without prior request, and in clear language, without implying that PSTI sets one duration for every product.

Schedule 1 paragraph 3 of the current 2023 Regulations is binding. ETSI materials can support evidence, but they do not replace the UK capability, publication, prominence, and no-shortening rules.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Jul 24, 2026
Sections
4

Structured answer sets in this page tree.

Primary sources
9

Cited legal and guidance references.

Publication metadata
Sorena AI
Published May 9, 2026
Updated Jul 24, 2026
Overview

Where the hardware or software listed in Schedule 1 paragraph 3 can receive security updates, the manufacturer must publish a : the minimum length of time for which security updates will be provided, expressed as a period with an end date. The information must be available without prior request, in English, free of charge, and in a clear, accessible, transparent form that a reader without technical knowledge can understand. PSTI does not set one minimum duration for every product.

Section 1

Set and publish the minimum commitment

First confirm that the business is a manufacturer and that the item is a relevant connectable product intended, or known or reasonably expected, to be a UK consumer connectable product. Then identify which paragraph 3 hardware and software can receive security updates; the publication duty does not apply to a component that cannot receive them. The security requirement has applied since 29 April 2024. The commitment covers security updates, not every feature, compatibility, warranty, repair, or general software update.

Choose a support period that the manufacturer can deliver for the exact product and state both its length and end date. The end date removes ambiguity about when the commitment expires; a vague phrase such as 'while supported' or 'for a reasonable period' does not provide the .

  • Identify the exact model and version covered, the start point used to calculate the period, the minimum duration, and the calendar end date.
  • Use 'at least' or other minimum-commitment wording only if the date and period remain unambiguous.
  • Separate the PSTI security-update commitment from warranty, spare-parts, feature-update, and service-availability statements.
  • On a qualifying invitation to purchase published on the manufacturer's website or a free website under its control, place the period alongside or give it equal prominence to the main product characteristics.
  • Do not present the period as a government-approved duration. The manufacturer sets the minimum commitment and remains responsible for the accuracy of its statement.
Sources for this answer
PSTI Security Requirements Regulations 2023, Schedule 1 paragraph 3
Paragraph 3 defines the covered update-capable hardware and software, publication and accessibility conditions, online prominence rule, extension rule, and effect of shortening the published period.
The UK Product Security and Telecommunications Infrastructure (Product Security) regime
Official source supporting this page's Minimum Support Period and Update Transparency analysis.
Consumer connectable product security regulations
Official guidance on how OPSS enforces non-compliance with Chapter 2 duties.
Regulations: consumer connectable product security
Official source supporting this page's Minimum Support Period and Update Transparency analysis.
Section 2

Assign owners and keep publication evidence

Product security and engineering should propose a support period that matches the update pipeline and supplier dependencies. Product management should align model and release identifiers, while legal or compliance reviews the public wording and the statement of compliance.

The also belongs in the statement of compliance. Manufacturers and importers must retain the statement for the longer of 10 years from issue or the defined support period stated in it.

  • Keep the approved duration calculation, end date, covered models and versions, publication URL, publication date, and screenshots or archived copies.
  • Link the statement of compliance to the same and product identifiers used in the public notice.
  • Keep supplier and engineering commitments that support update delivery, including component end-of-support dates and the internal release owner.
  • Record each correction or extension without making an earlier public commitment disappear from the evidence trail.
Sources for this answer
Consumer connectable product security regulations
Official guidance on how OPSS enforces non-compliance with Chapter 2 duties.
Regulations: consumer connectable product security
Official guidance on publishing the minimum security-update period.
Product Security Regulations 2023, interpretation and statement retention
Defines the support period and sets the manufacturer and importer statement-retention rules.
Section 3

Handle variants, bundles, start points, and extensions

A longer commercial promise is allowed, but the public minimum must remain truthful and internally supportable. If the manufacturer extends the minimum, the new must be published as soon as practicable. Paragraph 3(6) says the security requirement is not met if the published period is shortened.

Different variants may have different periods only when the notice lets a consumer identify the applicable product and date. Bundles need a clear mapping if their components have different manufacturers or support periods. Manufacturer-developed software used for or in connection with the intended purpose is within paragraph 3(d) when it can receive security updates, except for that paragraph's specific exclusion where the product is a smartphone or cellular-capable tablet.

  • The Regulations do not prescribe a start date. If the duration runs from manufacture, first supply, purchase, activation, or another event, identify that event clearly enough to yield the stated end date.
  • Do not publish only an end date when the regulation calls for a minimum length of time expressed as a period with an end date.
  • Check translations and regional pages so the English UK notice remains available without account creation, purchase, or a support request.
  • Reassess the commitment when a component supplier, cloud service, firmware branch, branding arrangement, or product variant changes.
Sources for this answer
The UK Product Security and Telecommunications Infrastructure (Product Security) regime
Official policy paper describing the minimum security-update period and statement-of-compliance requirements.
Consumer connectable product security regulations
Official guidance on how OPSS enforces non-compliance with Chapter 2 duties.
Regulations: consumer connectable product security
Official guidance on publishing the minimum security-update period.
Product Security Regulations 2023, Schedule 1 paragraph 3
Sets the covered software categories, publication conditions, extension rule, and no-shortening rule.
Section 4

Make the disclosure a release gate

Make support-period approval a release gate. The product record should connect the scope decision, engineering commitment, public notice, statement of compliance, and retention deadline.

Test the notice as a visitor would see it. A person should be able to find the product, understand how long security updates are promised, and identify the end date without signing in, paying, or asking support.

  • Draft the notice in plain English with the product identifier, minimum duration, start point, end date, and a short explanation of what counts as a security update.
  • Publish it on a stable public page without a login, payment, support request, or request for personal information, and meet the equal-prominence rule where paragraph 3(5) applies.
  • Confirm that the same period appears in the statement of compliance and that importer copies will be retained for the correct period.
  • Before the end date, decide whether to extend support, issue final security updates, and communicate any separate post-support risk information required by the circumstances.
Sources for this answer
The UK Product Security and Telecommunications Infrastructure (Product Security) regime
Operational implementation support for Minimum Support Period and Update Transparency.
Consumer connectable product security regulations
Official guidance on how OPSS enforces non-compliance with Chapter 2 duties.
Regulations: consumer connectable product security
Operational implementation support for Minimum Support Period and Update Transparency.
Recommended next step

Build the support-period release record

Connect the product identifier, engineering commitment, published period and end date, statement, importer copy, approval, and retention deadline.

Assessment workflow
Open Assessment Autopilot for UK PSTI Product Security

Create support-period questions, evidence fields, publication checks, and review tasks.

Explore next step
Research workflow
Review UK PSTI Product Security source evidence

Use Research Copilot to answer follow-up questions with cited source material.

Explore next step
Talk to Sorena
Talk through implementation

Review scope, evidence, owners, and the next compliance actions with Sorena.

Explore next step
Primary sources

References and citations

OPSS Enforcement Policy
gov.uk
Referenced sections
  • OPSS enforcement policy supports escalation planning for PSTI records that may be reviewed by the product-security regulator.
Related guides

Explore more topics

UK PSTI Act statement of compliance: what must the SoC contain?
Understand when a UK PSTI statement is required, the Schedule 4 fields, supply-chain checks, retention, digital accompaniment, and the December 2025 label route.
UK PSTI Act: vulnerability disclosure policy requirements and template
Publish a free, clear, accessible English reporting route plus expected acknowledgement and status-update times, and retain evidence that the information remained available.
UK PSTI applicability test: product, market, and actor scope
Apply the UK PSTI tests in order: connectivity, current exceptions, UK consumer availability, supply facts, and the manufacturer, importer, or distributor trigger.
UK PSTI compliance checklist for product release
Use a release checklist with scope, role, security-control, statement, records, and compliance-failure evidence for UK consumer connectable products.
UK PSTI compliance: duties, evidence, and response
Build a UK PSTI compliance process covering product scope, supply-chain roles, the three security requirements, statements, records, and post-market failures.
UK PSTI default password requirements
Apply the UK PSTI password rule to each relevant password, test unique-per-product generation, and keep reset and release evidence for the shipped model.
UK PSTI Default Password Rules
PSTI requires each covered password to be user-defined or unique per product. Unique credentials must not use prohibited predictable generation methods.
UK PSTI ETSI Evidence and Deemed Compliance
ETSI EN 303 645 and TS 103 701 can structure technical evidence, but the standards-based PSTI route depends on the exact mapped provisions and additional Schedule 2 conditions.
UK PSTI Excepted Products and Boundaries
An internet- or network-connectable product is outside the relevant-product definition only when a current Schedule 3 exception applies; record the exact category and facts rather than relying on a broad sector label.
UK PSTI Importer and Distributor Duties
Importers and distributors have their own statement, stop-supply, remediation, and notification duties; importers also have statutory investigation and 10-year investigation-record duties.
UK PSTI Manufacturer, Importer and Distributor Roles
Distinguish manufacturer, importer, distributor, and authorised-representative duties per product and supply route, including rebranding, imports, statement checks, stop-supply decisions, and compliance failures.
UK PSTI OPSS Notices: Compliance, Stop, Recall, and Penalties
OPSS can use compliance, stop, and recall notices alongside monetary and other measures; notice recipients should preserve the notice, product scope, supply records, corrective actions, representations, and appeal dates.
UK PSTI password and security update policy requirements
Implement the UK PSTI password rule and publish a defined security support period with the required end date, access conditions, and change controls.
UK PSTI Product Security Deadlines and Compliance Calendar Guide
Track the UK PSTI regime's commencement and amendment dates, product-specific support periods, record retention, and OPSS response and appeal windows.
UK PSTI Product Security FAQ
Get direct, sourced answers on product scope, exceptions, roles, passwords, vulnerability reporting, update-period information, statements, records, and OPSS enforcement.
UK PSTI Product Security Importer and Distributor Duties Guide
Identify the pre-supply checks, statement or deemed-compliance evidence, stop-supply decisions, notification and remediation duties required of UK importers and distributors, plus importer-specific investigation and record duties.
UK PSTI Product Security OPSS Enforcement and Penalties Guide
Understand OPSS investigations, compliance, stop and recall notices, monetary penalties, forfeiture, court orders, representations, appeals, and evidence needed to respond.
UK PSTI Product Security OPSS Notices Guide
Prepare for compliance, stop, and recall notices by understanding their effects, representation and appeal routes, product records, and corrective-action evidence.
UK PSTI Product Security Penalties and Fines Guide
Understand the maximum fixed and daily PSTI penalties, how OPSS sets an amount, representation and appeal rights, and separate court-ordered sanctions.
UK PSTI product security requirements
Read the three Schedule 1 security requirements and the surrounding manufacturer, importer, distributor, statement, record, and failure-response duties.
UK PSTI Relevant Connectable Product Scope
A product is relevant when it is internet-connectable or network-connectable and not excepted, then the UK consumer-use and supply facts determine whether the Part 1 duties engage.
UK PSTI relevant connectable product scope test
Decide whether one product meets the UK PSTI connectivity definition, falls within a current exception, and reaches the separate UK-consumer duty tests.
UK PSTI relevant connectable products: categories and exceptions
Understand which connected product categories can enter UK PSTI scope, how the statutory tests work, and why examples never replace the current exception schedule.
UK PSTI Scope Classifier Workflow
Decide whether a product falls within the UK PSTI product-security regime by checking connectivity, consumer supply, exceptions, actor roles, and product-specific evidence.
UK PSTI security requirements in practice
Implement the three UK PSTI security requirements through product specifications, release tests, public information, approvals, and post-release evidence.
UK PSTI Security Update Support Periods
PSTI does not prescribe a universal minimum number of support years. The manufacturer sets and publishes a product-specific minimum period and end date; preserve the published commitment and assess any later change against the current Regulations.
UK PSTI Security Update Transparency
Publish the minimum security-update period and end date in English, free of charge, without prior request, and in language understandable without technical knowledge.
UK PSTI Statement of Compliance Evidence Pack
Join the prescribed statement fields to product identifiers, control evidence, publication records, supply-chain checks, accompaniment evidence, retention, and change management.
UK PSTI Statement of Compliance Template
Build a statement record with the prescribed Schedule 4 information and evidence that it accompanied the product, while checking whether a current Schedule 2A deemed-compliance route applies.
UK PSTI Statement of Compliance Workflow
Prepare, approve, provide, verify, retain, and update statement evidence before a relevant connectable product is made available in the UK.
UK PSTI Statement of Compliance: Contents, Delivery, and Records
A statement must contain the prescribed information and accompany the product unless a current deemed-compliance route applies; a digital method is possible, but each business must ensure that it meets the Act.
UK PSTI Support Period Evidence Workflow
Set, publish, approve, and preserve the product-specific minimum security-update period and end date, then control changes and customer information against the shipped product.
UK PSTI to ETSI Evidence Mapping
Map ETSI EN 303 645 and TS 103 701 evidence to the three UK legal requirements without treating the wider voluntary ETSI baseline as if every provision were mandatory under PSTI.
UK PSTI vs Australia Smart Device Rules
Compare UK PSTI with Australia's Cyber Security Act smart-device rules by scope, duties, statements, security controls, retention, dates, and enforcement.
UK PSTI vs ETSI EN 303 645
See how binding UK PSTI duties relate to ETSI EN 303 645, which edition the UK Regulations name, what the standard adds, and what evidence to retain.
UK PSTI vs EU Cyber Resilience Act
Decide whether UK PSTI, the EU Cyber Resilience Act, or both apply, then compare actors, exclusions, security work, documents, reporting, and dates.
UK PSTI vs EU Cyber Resilience Act (CRA)
Compare UK PSTI and the EU Cyber Resilience Act by scope, security duties, support periods, conformity assessment, reporting, evidence, and application dates.
UK PSTI Vulnerability Disclosure Requirements
Publish a clear reporting route plus expected acknowledgement and status-update times. PSTI requires the information and timescales to be available; it does not prescribe one universal response deadline for every report.
UK PSTI Vulnerability Disclosure Workflow
Operate intake, acknowledgement, status updates, investigation, remediation, disclosure, and evidence while keeping the legal publication duty distinct from broader good-practice response targets.