We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

Artifact GuideUKPenalties and fines

UK PSTI Product Security Penalties and fines

The maximum fixed penalty is the greater of GBP 10 million and 4% of qualifying worldwide revenue. A continuing breach can also attract up to GBP 20,000 per day.

Those figures are statutory ceilings, not automatic fines. OPSS determines the amount from the facts and may combine a monetary penalty with other enforcement action.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Jul 24, 2026
Sections
4

Structured answer sets in this page tree.

Primary sources
8

Cited legal and guidance references.

Publication metadata
Sorena AI
Published May 9, 2026
Updated Jul 24, 2026
Overview

Under Part 1 of the Product Security and Telecommunications Infrastructure (PSTI) Act 2022, OPSS may impose a fixed penalty, a daily penalty for continuing non-compliance after the penalty deadline, or both. The maximum fixed penalty is the greater of GBP 10 million and 4% of the person's for the most recent accounting period, subject to the Act's calculation rules. The maximum daily penalty is GBP 20,000 per day. The actual amount depends on OPSS's decision in the case.

Section 2

How OPSS decides the amount

OPSS guidance says it normally starts with the potential or actual harm, culpability, and the person's position in the market. It then considers relevant mitigating and aggravating factors. This is enforcement guidance about OPSS's approach; the Act supplies the power and ceilings.

Relevant factors may include prompt disclosure, practical or technical reasons for continuing non-compliance, early remediation, restorative action, compliance history, duration, cooperation, evidence of responsibility, and financial gain. A business should support each point with dated records rather than a general assurance. OPSS determines if the amount is disputed, so preserve the basis for the entity, accounting period, adjustments, and figures submitted.

  • Revenue evidence: preserve the relevant accounts, group structure, accounting-period dates, and any figures supplied to OPSS.
  • Breach evidence: identify the precise Chapter 2 duty, products, versions, supply dates, duration, customers, and known effects.
  • Mitigation evidence: record discovery, disclosure, containment, remediation, customer protection, notification, and verification dates.
  • Continuing-breach evidence: show when non-compliance ended and how that was tested; this date can affect any daily element.
Sources for this answer
OPSS guidance on PSTI enforcement actions and associated rights
Lists the starting considerations and mitigating or aggravating factors OPSS may use to determine a monetary penalty.
OPSS Enforcement Policy
Provides the broader decision framework that the PSTI-specific enforcement guidance says OPSS applies.
Section 3

Notice, payment, and appeal rights

Before imposing a Monetary Penalty, OPSS serves a notice of intent stating the grounds and proposed amount. The recipient has 28 days beginning with the day the notice is given to make written representations about liability, the fixed or daily elements, and the amount.

If OPSS confirms or varies the proposal, it serves a Monetary Penalty Notice. The notice must state the reasons, amount, payment period, appeal rights, and consequences of non-payment. The Act does not permit a payment period shorter than 28 days; OPSS guidance says the period will usually be 28 days but may be longer, and a separate period may apply to the daily element. An unpaid penalty can be recovered as a civil debt.

  • A section 41 appeal may challenge the decision to impose the penalty, the amount, or the payment period.
  • The appeal must be made to the First-tier Tribunal before the end of 28 days beginning with the day the notice is given or, for a variation, the day it is varied.
  • An appeal suspends the Monetary Penalty Notice pending the outcome. If only a variation is appealed, the variation is suspended and the original notice remains effective.
  • The Tribunal may confirm the penalty, vary the amount or payment period, cancel it, or refer the matter back to OPSS.
  • Calculate each deadline from the notice and proof of service. Informal discussions do not by themselves change a statutory period.
Sources for this answer
OPSS guidance on PSTI enforcement actions and associated rights
Explains the 28-day representation period, notice-specific payment period, civil-debt recovery, appeal grounds and deadline, suspension, and Tribunal powers.
Product Security and Telecommunications Infrastructure Act 2022, section 41
Primary legislation for appeal grounds and the Tribunal's powers in a monetary-penalty appeal.
Section 4

Other financial and non-financial consequences

The main Chapter 2 Monetary Penalty is not the only possible cost. OPSS can combine it with Compliance, Stop, or Recall Notices, seek forfeiture of products, publish enforcement details, and prosecute specified offences. Failure to comply with an enforcement notice is an offence punishable on summary conviction by a fine.

Failure without reasonable excuse to comply with an Information Notice uses a separate court-ordered penalty regime. The court may impose a fixed amount up to the greater of GBP 30,000 and 1% of turnover, a daily amount up to the greater of GBP 15,000 and 5% of daily turnover, or both. Do not confuse these court maxima with the GBP 10 million or 4% Chapter 2 penalty.

  • Forfeiture can require qualifying products to be delivered up and can permit or require their destruction or disposal.
  • A Recall Notice can lead to OPSS carrying out the recall and recovering its reasonable costs if the recipient does not comply.
  • OPSS says monetary penalties are paid to the Consolidated Fund and are not retained by the regulator.
  • Estimate exposure by legal route, affected actor, and continuing-breach period; do not add unrelated maxima as if every sanction must apply.
  • Recalculate the daily-penalty period when OPSS changes the payment deadline or the business completes and verifies remediation, and retain the evidence showing the date non-compliance ended.
Sources for this answer
OPSS guidance on PSTI enforcement actions and associated rights
Distinguishes administrative monetary penalties from enforcement notices, forfeiture, prosecution, recall costs, publication, and court penalties for an Information Notice failure.
Product Security and Telecommunications Infrastructure Act 2022, enforcement
Primary legislation for forfeiture, enforcement-notice offences, publication, and court orders and penalties related to Information Notices.
Recommended next step

Build the penalty response record

Assign the liability response, revenue calculation, mitigation evidence, payment deadline, continuing-breach verification, and any tribunal appeal.

Assessment workflow
Open Assessment Autopilot for UK PSTI Product Security

Create questions and evidence fields for liability, revenue, mitigation, remediation dates, payment, and appeal.

Explore next step
Research workflow
Review UK PSTI Product Security source evidence

Use Research Copilot to answer follow-up questions with cited source material.

Explore next step
Talk to Sorena
Talk through UK PSTI Product Security implementation

Review scope, evidence, owners, and the next compliance actions with Sorena.

Explore next step
Primary sources

References and citations

OPSS Enforcement Policy
gov.uk
Referenced sections
  • Provides the broader decision framework that the PSTI-specific enforcement guidance says OPSS applies.
Related guides

Explore more topics

UK PSTI Act statement of compliance: what must the SoC contain?
Understand when a UK PSTI statement is required, the Schedule 4 fields, supply-chain checks, retention, digital accompaniment, and the December 2025 label route.
UK PSTI Act: vulnerability disclosure policy requirements and template
Publish a free, clear, accessible English reporting route plus expected acknowledgement and status-update times, and retain evidence that the information remained available.
UK PSTI applicability test: product, market, and actor scope
Apply the UK PSTI tests in order: connectivity, current exceptions, UK consumer availability, supply facts, and the manufacturer, importer, or distributor trigger.
UK PSTI compliance checklist for product release
Use a release checklist with scope, role, security-control, statement, records, and compliance-failure evidence for UK consumer connectable products.
UK PSTI compliance: duties, evidence, and response
Build a UK PSTI compliance process covering product scope, supply-chain roles, the three security requirements, statements, records, and post-market failures.
UK PSTI default password requirements
Apply the UK PSTI password rule to each relevant password, test unique-per-product generation, and keep reset and release evidence for the shipped model.
UK PSTI Default Password Rules
PSTI requires each covered password to be user-defined or unique per product. Unique credentials must not use prohibited predictable generation methods.
UK PSTI ETSI Evidence and Deemed Compliance
ETSI EN 303 645 and TS 103 701 can structure technical evidence, but the standards-based PSTI route depends on the exact mapped provisions and additional Schedule 2 conditions.
UK PSTI Excepted Products and Boundaries
An internet- or network-connectable product is outside the relevant-product definition only when a current Schedule 3 exception applies; record the exact category and facts rather than relying on a broad sector label.
UK PSTI Importer and Distributor Duties
Importers and distributors have their own statement, stop-supply, remediation, and notification duties; importers also have statutory investigation and 10-year investigation-record duties.
UK PSTI Manufacturer, Importer and Distributor Roles
Distinguish manufacturer, importer, distributor, and authorised-representative duties per product and supply route, including rebranding, imports, statement checks, stop-supply decisions, and compliance failures.
UK PSTI OPSS Notices: Compliance, Stop, Recall, and Penalties
OPSS can use compliance, stop, and recall notices alongside monetary and other measures; notice recipients should preserve the notice, product scope, supply records, corrective actions, representations, and appeal dates.
UK PSTI password and security update policy requirements
Implement the UK PSTI password rule and publish a defined security support period with the required end date, access conditions, and change controls.
UK PSTI Product Security Deadlines and Compliance Calendar Guide
Track the UK PSTI regime's commencement and amendment dates, product-specific support periods, record retention, and OPSS response and appeal windows.
UK PSTI Product Security FAQ
Get direct, sourced answers on product scope, exceptions, roles, passwords, vulnerability reporting, update-period information, statements, records, and OPSS enforcement.
UK PSTI Product Security Importer and Distributor Duties Guide
Identify the pre-supply checks, statement or deemed-compliance evidence, stop-supply decisions, notification and remediation duties required of UK importers and distributors, plus importer-specific investigation and record duties.
UK PSTI Product Security Minimum Support Period and Update Transparency Guide
Publish the minimum security-update period and end date in English, free of charge, without prior request, and in clear language, without implying that PSTI sets one duration for every product.
UK PSTI Product Security OPSS Enforcement and Penalties Guide
Understand OPSS investigations, compliance, stop and recall notices, monetary penalties, forfeiture, court orders, representations, appeals, and evidence needed to respond.
UK PSTI Product Security OPSS Notices Guide
Prepare for compliance, stop, and recall notices by understanding their effects, representation and appeal routes, product records, and corrective-action evidence.
UK PSTI product security requirements
Read the three Schedule 1 security requirements and the surrounding manufacturer, importer, distributor, statement, record, and failure-response duties.
UK PSTI Relevant Connectable Product Scope
A product is relevant when it is internet-connectable or network-connectable and not excepted, then the UK consumer-use and supply facts determine whether the Part 1 duties engage.
UK PSTI relevant connectable product scope test
Decide whether one product meets the UK PSTI connectivity definition, falls within a current exception, and reaches the separate UK-consumer duty tests.
UK PSTI relevant connectable products: categories and exceptions
Understand which connected product categories can enter UK PSTI scope, how the statutory tests work, and why examples never replace the current exception schedule.
UK PSTI Scope Classifier Workflow
Decide whether a product falls within the UK PSTI product-security regime by checking connectivity, consumer supply, exceptions, actor roles, and product-specific evidence.
UK PSTI security requirements in practice
Implement the three UK PSTI security requirements through product specifications, release tests, public information, approvals, and post-release evidence.
UK PSTI Security Update Support Periods
PSTI does not prescribe a universal minimum number of support years. The manufacturer sets and publishes a product-specific minimum period and end date; preserve the published commitment and assess any later change against the current Regulations.
UK PSTI Security Update Transparency
Publish the minimum security-update period and end date in English, free of charge, without prior request, and in language understandable without technical knowledge.
UK PSTI Statement of Compliance Evidence Pack
Join the prescribed statement fields to product identifiers, control evidence, publication records, supply-chain checks, accompaniment evidence, retention, and change management.
UK PSTI Statement of Compliance Template
Build a statement record with the prescribed Schedule 4 information and evidence that it accompanied the product, while checking whether a current Schedule 2A deemed-compliance route applies.
UK PSTI Statement of Compliance Workflow
Prepare, approve, provide, verify, retain, and update statement evidence before a relevant connectable product is made available in the UK.
UK PSTI Statement of Compliance: Contents, Delivery, and Records
A statement must contain the prescribed information and accompany the product unless a current deemed-compliance route applies; a digital method is possible, but each business must ensure that it meets the Act.
UK PSTI Support Period Evidence Workflow
Set, publish, approve, and preserve the product-specific minimum security-update period and end date, then control changes and customer information against the shipped product.
UK PSTI to ETSI Evidence Mapping
Map ETSI EN 303 645 and TS 103 701 evidence to the three UK legal requirements without treating the wider voluntary ETSI baseline as if every provision were mandatory under PSTI.
UK PSTI vs Australia Smart Device Rules
Compare UK PSTI with Australia's Cyber Security Act smart-device rules by scope, duties, statements, security controls, retention, dates, and enforcement.
UK PSTI vs ETSI EN 303 645
See how binding UK PSTI duties relate to ETSI EN 303 645, which edition the UK Regulations name, what the standard adds, and what evidence to retain.
UK PSTI vs EU Cyber Resilience Act
Decide whether UK PSTI, the EU Cyber Resilience Act, or both apply, then compare actors, exclusions, security work, documents, reporting, and dates.
UK PSTI vs EU Cyber Resilience Act (CRA)
Compare UK PSTI and the EU Cyber Resilience Act by scope, security duties, support periods, conformity assessment, reporting, evidence, and application dates.
UK PSTI Vulnerability Disclosure Requirements
Publish a clear reporting route plus expected acknowledgement and status-update times. PSTI requires the information and timescales to be available; it does not prescribe one universal response deadline for every report.
UK PSTI Vulnerability Disclosure Workflow
Operate intake, acknowledgement, status updates, investigation, remediation, disclosure, and evidence while keeping the legal publication duty distinct from broader good-practice response targets.