We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

Artifact GuideUKOPSS Notices

UK PSTI Product Security OPSS Notices

Prepare for compliance, stop, and recall notices by understanding their effects, representation and appeal routes, product records, and corrective-action evidence.

Part 1 Chapter 3 of the 2022 Act controls notice powers, deadlines, appeals, and consequences. OPSS guidance explains how the authority administers those binding powers.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Oct 15, 2026
4 sections7 primary sources
Overview

Under Part 1 of the Product Security and Telecommunications Infrastructure (PSTI) Act 2022, identify the document first: a invites representations, while a served compliance, stop, recall, or monetary penalty notice creates the obligations and deadlines stated in it. Preserve the notice, record service time, stop any prohibited activity, appoint one response owner, and obtain case-specific legal advice promptly. The Office for Product Safety and Standards (OPSS) can combine enforcement actions.

Section 1

Classify the notice and calendar the deadline

Read the title, statutory basis, recipient, affected products, required or prohibited acts, evidence requests, deadlines, representation or appeal instructions, and service date. OPSS may use a compliance notice to require corrective steps, a stop notice to prohibit or restrict non-compliant activity, or a recall notice to require arrangements for products already supplied to consumers or other end users to be returned.

A monetary penalty notice is different: it requires payment and may include a daily penalty for continuing non-compliance. OPSS may also seek forfeiture or a court order connected with an information notice. The response plan must follow the instrument actually received, not a generic enforcement checklist.

  • for a compliance, stop, or recall notice: written representations are normally due within 10 days beginning on the day the notice of intent is given.
  • Urgency: OPSS guidance says it may serve a stop notice without prior intent to address an urgent consumer health or safety risk, and may also serve an urgent recall notice without prior intent.
  • Monetary penalty : the representation period is 28 days, not the 10-day period used for the three enforcement notices above.
  • Served or varied compliance, stop, recall, or monetary penalty notice: a appeal must normally be brought within 28 days beginning with the day the notice was given or varied. An appeal suspends the notice or variation until it is determined or withdrawn; for a variation, the original notice remains in effect.
Section 2

Assign one response owner and build the case file

A senior accountable owner should coordinate legal, product security, engineering, supply chain, customer support, finance, and communications. Assign separate owners for the formal response, corrective work, product containment, evidence preservation, and customer contact.

Build one indexed case file. It should show what was supplied, by whom, when, under which product and firmware identifiers, what the business knew, what it did, and how each notice requirement was completed.

  • Preserve the notice, envelope or electronic service record, attachments, and every communication with OPSS.
  • Freeze deletion for relevant product, sales, testing, vulnerability, update, statement-of-compliance, supplier, and customer records.
  • Create a requirement log with the exact notice wording, owner, due time, evidence expected, submission status, and OPSS acknowledgment.
  • Keep factual and legal review separate: correct errors with evidence and clearly identify any interpretation or privilege issue for counsel.
Section 3

Check urgency, scope, variation, compensation, and publication

Do not assume a recall notice is required for every failure. OPSS guidance says the legislation does not create a specific business duty to recall, but OPSS may require a recall when it considers the business response inadequate and lesser measures insufficient for the risk.

A notice may cover only specified products, activities, dates, or recipients. Confirm the scope without narrowing it informally. If product identity, role, or technical facts are disputed, preserve the protective action while raising the issue through the stated representation or appeal route.

  • Check whether the document is only a request, an information notice, a , or a final enforcement notice; each has different legal effects.
  • Check whether OPSS varied or revoked an earlier notice. A variation may change the work or appeal decision even though OPSS guidance says it may not make the enforcement notice more onerous.
  • Do not treat a compensation claim as automatic. For stop and recall notices, the statutory conditions include that the relevant breach did not occur and that service was not attributable to the recipient's neglect or default.
  • Expect publication: OPSS guidance says it publishes details of served compliance, stop, recall, and monetary penalty notices in line with its enforcement policy.
Section 4

Control supply, respond, and track completion

Act on immediate safety, security, and supply controls while the response is reviewed. A compliance notice can specify corrective steps and a completion period. Stop and recall notices can require evidence within a specified period, and a recall notice can require product information as well as return arrangements.

Failure to complete actions specified in a compliance, stop, or recall notice is an offence punishable on summary conviction by a fine. OPSS guidance also says it will consider prosecution, may account for recall non-compliance in a monetary penalty decision, and may conduct a recall itself and recover reasonable costs.

  • Within hours: verify authenticity and service, calculate deadlines, preserve evidence, stop prohibited acts, and notify the accountable owner and counsel.
  • Within the first response cycle: map affected stock and customers, test the alleged failure, document known risk, contact relevant manufacturers, importers, or distributors, and decide corrective measures.
  • Before the deadline: submit representations, requested evidence, or proof of compliance through the route stated in the notice; keep a complete copy and delivery evidence.
  • After submission: track OPSS decisions, variations, revocation, tribunal steps, customer actions, remediation effectiveness, and any published enforcement details.
Recommended next step

Build the OPSS notice response file

Assign service verification, deadline control, representations or appeal, product containment, corrective work, evidence submission, and customer action.

Assessment workflow
Open Assessment Autopilot for UK PSTI Product Security

Create notice-specific questions, evidence fields, deadline controls, and response tasks.

Explore next step
Research workflow
Review UK PSTI Product Security source evidence

Use Research Copilot to answer follow-up questions with cited source material.

Explore next step
Talk to Sorena
Talk through implementation

Review scope, evidence, owners, and the next compliance actions with Sorena.

Explore next step
Primary sources

References and citations

GOV.UK: Regulations for consumer connectable product security
gov.uk5 citations
Referenced sections
  • Supports OPSS Notices under UK PSTI Product Security.
  • Official UK guidance for consumer connectable product security requirements and OPSS regulatory activities.
  • Identifies OPSS as the enforcement authority and summarises the product, actor, statement, investigation, record, and corrective-action duties.
Show 2 more
  • Confirms OPSS's enforcement role and the current product and actor scope of the regime.
  • Confirms the current regime, responsible actors, OPSS role, and product-security obligations that the response must address.
The UK Product Security and Telecommunications Infrastructure (Product Security) regime
gov.uk5 citations
Referenced sections
  • Supports OPSS Notices under UK PSTI Product Security.
  • Official UK product-security regime guidance that explains PSTI duties and compliance expectations relevant to OPSS notice response.
  • Explains the manufacturer, importer, distributor, and authorised-representative duties and records that may form part of the response file.
Show 2 more
  • Explains the product-security duties and supply-chain roles that determine the scope of an OPSS enforcement response.
  • Explains actor-specific investigation, notification, record, and corrective-action duties relevant to completing a notice.
Consumer connectable product security regulations
gov.uk3 citations
Referenced sections
  • OPSS enforcement guidance for compliance, stop, recall, monetary-penalty, forfeiture, and information-notice powers under the PSTI product-security regime.
  • Explains the different effects of requests, information notices, notices of intent, final notices, variations, revocations, compensation claims, and publication.
  • Explains notice requirements, prosecution for enforcement-notice failures, recall action and cost recovery, submission periods, and appeal rights.
Regulation of consumer connectable product cyber security
legislation.gov.uk3 citations
Referenced sections
  • Supports OPSS Notices under UK PSTI Product Security.
  • Provides the official impact-assessment context for regulated actors, expected evidence, enforcement, and corrective action.
  • Supports the enforcement and business-impact context for containment, corrective action, and regulator evidence.

Related guides

UK PSTI Act statement of compliance: what must the SoC contain?

Understand when a UK PSTI statement is required, the Schedule 4 fields, supply-chain checks, retention, digital accompaniment, and the December 2025 label route.

UK PSTI Act: vulnerability disclosure policy requirements and template

Publish a free, clear, accessible English reporting route plus expected acknowledgement and status-update times, and retain evidence that the information remained available.

UK PSTI applicability test: product, market, and actor scope

Apply the UK PSTI tests in order: connectivity, current exceptions, UK consumer availability, supply facts, and the manufacturer, importer, or distributor trigger.

UK PSTI compliance checklist for product release

Use a release checklist with scope, role, security-control, statement, records, and compliance-failure evidence for UK consumer connectable products.

UK PSTI compliance: duties, evidence, and response

Build a UK PSTI compliance process covering product scope, supply-chain roles, the three security requirements, statements, records, and post-market failures.

UK PSTI default password requirements

Apply the UK PSTI password rule to each relevant password, test unique-per-product generation, and keep reset and release evidence for the shipped model.

Show all related guides (39)

UK PSTI Manufacturer, Importer and Distributor Roles

Distinguish manufacturer, importer, distributor, and authorised-representative duties per product and supply route, including rebranding, imports, statement checks, stop-supply decisions, and compliance failures.

UK PSTI password and security update policy requirements

Implement the UK PSTI password rule and publish a defined security support period with the required end date, access conditions, and change controls.

UK PSTI Product Security Deadlines and Compliance Calendar Guide

Track the UK PSTI regime's commencement and amendment dates, product-specific support periods, record retention, and OPSS response and appeal windows.

UK PSTI Product Security FAQ

Get direct, sourced answers on product scope, exceptions, roles, passwords, vulnerability reporting, update-period information, statements, records, and OPSS enforcement.

UK PSTI Product Security Importer and Distributor Duties Guide

Identify the pre-supply checks, statement or deemed-compliance evidence, stop-supply decisions, notification and remediation duties required of UK importers and distributors, plus importer-specific investigation and record duties.

UK PSTI Product Security Minimum Support Period and Update Transparency Guide

Publish the minimum security-update period and end date in English, free of charge, without prior request, and in clear language, without implying that PSTI sets one duration for every product.

UK PSTI Product Security OPSS Enforcement and Penalties Guide

Understand OPSS investigations, compliance, stop and recall notices, monetary penalties, forfeiture, court orders, representations, appeals, and evidence needed to respond.

UK PSTI Product Security Penalties and Fines Guide

Understand the maximum fixed and daily PSTI penalties, how OPSS sets an amount, representation and appeal rights, and separate court-ordered sanctions.

UK PSTI product security requirements

Read the three Schedule 1 security requirements and the surrounding manufacturer, importer, distributor, statement, record, and failure-response duties.

UK PSTI relevant connectable product scope test

Decide whether one product meets the UK PSTI connectivity definition, falls within a current exception, and reaches the separate UK-consumer duty tests.

UK PSTI relevant connectable products: categories and exceptions

Understand which connected product categories can enter UK PSTI scope, how the statutory tests work, and why examples never replace the current exception schedule.

UK PSTI Scope Classifier Workflow

Decide whether a product falls within the UK PSTI product-security regime by checking connectivity, consumer supply, exceptions, actor roles, and product-specific evidence.

UK PSTI security requirements in practice

Implement the three UK PSTI security requirements through product specifications, release tests, public information, approvals, and post-release evidence.

UK PSTI Statement of Compliance Evidence Pack

Join the prescribed statement fields to product identifiers, control evidence, publication records, supply-chain checks, accompaniment evidence, retention, and change management.

UK PSTI Statement of Compliance Template

Build a statement record with the prescribed Schedule 4 information and evidence that it accompanied the product, while checking whether a current Schedule 2A deemed-compliance route applies.

UK PSTI Statement of Compliance Workflow

Prepare, approve, provide, verify, retain, and update statement evidence before a relevant connectable product is made available in the UK.

UK PSTI Support Period Evidence Workflow

Set, publish, approve, and preserve the product-specific minimum security-update period and end date, then control changes and customer information against the shipped product.

UK PSTI to ETSI Evidence Mapping

Map ETSI EN 303 645 and TS 103 701 evidence to the three UK legal requirements without treating the wider voluntary ETSI baseline as if every provision were mandatory under PSTI.

UK PSTI vs Australia Smart Device Rules

Compare UK PSTI with Australia's Cyber Security Act smart-device rules by scope, duties, statements, security controls, retention, dates, and enforcement.

UK PSTI vs ETSI EN 303 645

See how binding UK PSTI duties relate to ETSI EN 303 645, which edition the UK Regulations name, what the standard adds, and what evidence to retain.

UK PSTI vs EU Cyber Resilience Act

Decide whether UK PSTI, the EU Cyber Resilience Act, or both apply, then compare actors, exclusions, security work, documents, reporting, and dates.

UK PSTI vs EU Cyber Resilience Act (CRA)

Compare UK PSTI and the EU Cyber Resilience Act by scope, security duties, support periods, conformity assessment, reporting, evidence, and application dates.

UK PSTI Vulnerability Disclosure Workflow

Operate intake, acknowledgement, status updates, investigation, remediation, disclosure, and evidence while keeping the legal publication duty distinct from broader good-practice response targets.

UK PSTI Default Password Rules

PSTI requires each covered password to be user-defined or unique per product. Unique credentials must not use prohibited predictable generation methods.

UK PSTI ETSI Evidence and Deemed Compliance

ETSI EN 303 645 and TS 103 701 can structure technical evidence, but the standards-based PSTI route depends on the exact mapped provisions and additional Schedule 2 conditions.

UK PSTI Excepted Products and Boundaries

An internet- or network-connectable product is outside the relevant-product definition only when a current Schedule 3 exception applies; record the exact category and facts rather than relying on a broad sector label.

UK PSTI Importer and Distributor Duties

Importers and distributors have their own statement, stop-supply, remediation, and notification duties; importers also have statutory investigation and 10-year investigation-record duties.

UK PSTI OPSS Notices: Compliance, Stop, Recall, and Penalties

OPSS can use compliance, stop, and recall notices alongside monetary and other measures; notice recipients should preserve the notice, product scope, supply records, corrective actions, representations, and appeal dates.

UK PSTI Relevant Connectable Product Scope

A product is relevant when it is internet-connectable or network-connectable and not excepted, then the UK consumer-use and supply facts determine whether the Part 1 duties engage.

UK PSTI Security Update Support Periods

PSTI does not prescribe a universal minimum number of support years. The manufacturer sets and publishes a product-specific minimum period and end date; preserve the published commitment and assess any later change against the current Regulations.

UK PSTI Security Update Transparency

Publish the minimum security-update period and end date in English, free of charge, without prior request, and in language understandable without technical knowledge.

UK PSTI Statement of Compliance: Contents, Delivery, and Records

A statement must contain the prescribed information and accompany the product unless a current deemed-compliance route applies; a digital method is possible, but each business must ensure that it meets the Act.

UK PSTI Vulnerability Disclosure Requirements

Publish a clear reporting route plus expected acknowledgement and status-update times. PSTI requires the information and timescales to be available; it does not prescribe one universal response deadline for every report.