We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

Artifact GuideUKPSTI Statement Of Compliance Template

UK PSTI Statement of Compliance Template

Build a statement record with the prescribed Schedule 4 information and evidence that it accompanied the product, while checking whether a current Schedule 2A deemed-compliance route applies.

The guide separates binding duties from OPSS guidance, ETSI good practice, internal controls, and the limited deemed-compliance routes introduced in 2025.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Jul 24, 2026
Sections
3

Structured answer sets in this page tree.

Primary sources
7

Cited legal and guidance references.

Publication metadata
Sorena AI
Published May 9, 2026
Updated Jul 24, 2026
Overview

Use this template only after confirming that the ordinary section 9 statement route under the Product Security and Telecommunications Infrastructure (PSTI) Act 2022 applies. Schedule 4 prescribes the information, but it does not prescribe an official form. The manufacturer prepares and signs the statement; the importer checks and retains it; the distributor checks it before making the product available. A valid, unexpired Japan JC-STAR STAR-1 or Singapore Cybersecurity Labelling Scheme label can satisfy the separate accompaniment route from 4 December 2025, so record that route instead of creating a misleading ordinary statement.

Section 1

Required Schedule 4 fields

A is the manufacturer's declaration, not an OPSS approval or third-party certificate. Schedule 4 sets minimum information but no official layout, certificate number, or OPSS filing step. Complete every applicable field against the product as first supplied. If several manufacturers meet the Act's definition, list each manufacturer and resolve who signs the statement on behalf of the relevant manufacturer.

Use the type and batch fields as the product-to-statement key. A trade name alone is weak where hardware, firmware, region, or production batches differ. The compliance-basis field records the manufacturer's opinion and the applicable Schedule 1 or Schedule 2 route; it does not turn voluntary testing into regulatory approval.

  • Product: state the product type and batch so the statement can be matched to the supplied unit or production group; add model, hardware, and release identifiers when needed to remove ambiguity.
  • Responsible entities: give the name and address of each manufacturer and, where applicable, each authorised representative.
  • Authority: declare that the statement was prepared by or on behalf of the manufacturer.
  • Compliance basis: declare that, in the manufacturer's opinion, it complied with the applicable Schedule 1 security requirements or the Schedule 2 deemed-compliance conditions.
  • Standard details: when Schedule 2 reliance refers to a specified standard, include the identification number, version, and issue date where applicable.
  • Support: state the defined support period that was correct when the manufacturer first supplied the product. This is the minimum security-update period expressed as a duration with an end date, not a warranty or expected product lifetime.
  • Execution: include the signatory's signature, name and function, plus the place and date of issue.
Sources for this answer
PSTI Security Requirements Regulations 2023, Schedule 4
Binding minimum information for an ordinary statement of compliance.
Section 2

Evidence kept behind the statement

Schedule 4 does not require the statement to reproduce the full technical file. Keep a controlled evidence index behind it so each declaration can be checked against the released product. Separate legal statement fields from engineering evidence and from optional ETSI assessment material. The index should show the evidence owner, version, location, review date, result, limitation, and exact product mapping.

  • Scope record: connectivity diagram, intended purpose, UK consumer facts, exception check, role classification, product type, batch, and release identifiers.
  • Password evidence: provisioning design, uniqueness or user-definition method, guessability review, and tests for the shipped configuration.
  • Vulnerability-reporting evidence: public reporting route, English and free-access checks, acknowledgement timing, status-update timing, and archived publication.
  • Support-period evidence: approved duration, end date, covered software and variants, publication URL, accessibility check, and dated capture.
  • Approval evidence: signatory authority, legal and security review, issue date, version history, distribution or digital-accompaniment method, and importer receipt.
  • Retention deadline: manufacturer and importer keep the statement for the longer of 10 years from issue or the defined support period stated in it.
Sources for this answer
PSTI Security Requirements Regulations 2023, regulations 7 to 9
Binding statement-content cross-reference and manufacturer and importer retention periods.
GOV.UK consumer connectable product security guidance
Official guidance that a statement may be digital, but the business must determine and evidence how it accompanies the product.
Section 3

Release, accompaniment, and change control

Approve the statement before the relevant product is made available. The Act allows a statement or a summary in a form later specified by regulations; do not invent a summary route without checking that the required form has been specified. GOV.UK says the statement can be digital because the Act does not require a physical document, but the chosen method still must amount to accompaniment.

A later product or evidence change does not automatically rewrite a statement that correctly described the product when issued. Reassess whether a new product type, batch, manufacturer, compliance basis, support-period statement, or scheme-label status requires a new issue or a route change, and stop supply if a role-specific compliance-failure duty is triggered.

For a route, verify the exact labelled product against the version of the scheme named in the Regulations: Japan JC-STAR STAR-1 based on JST-CR-01-01-2024R1 (December 2024), or the Singapore Cybersecurity Labelling Scheme specified through CCC SP-151-2 CLS(IoT) Scheme Specifications (version 1.4, April 2025). Preserve the current label and expiry evidence; a supplier certificate for another product does not establish the condition.

  • Test the physical or digital delivery path from the customer's product to the exact statement; a general corporate compliance page is not enough unless it reliably accompanies and identifies the product.
  • Give importers the statement and product mapping early enough to complete their pre-supply check and retention setup.
  • Give distributors a check that identifies the expected statement or the exact label route before supply.
  • Archive the issued file, hash or version, delivery-path evidence, publication capture, recipients, and withdrawal or supersession decision.
Sources for this answer
GOV.UK statement-of-compliance guidance
Official guidance on the undefined terms document and accompany and the possibility of digital accompaniment.
PSTI Amendment (No. 2) Regulations 2025
Binding source for the Schedule 2A label-based accompaniment routes effective from 4 December 2025.
Recommended next step

Control the statement before supply

Confirm the ordinary statement or Schedule 2A route, complete every required field, link the exact product and evidence, test accompaniment, and set the retention deadline.

Assessment workflow
Open Assessment Autopilot for UK PSTI Product Security

Create evidence fields for Schedule 4 content, product mapping, signature, accompaniment, and retention.

Explore next step
Research workflow
Review UK PSTI Product Security source evidence

Use Research Copilot to answer follow-up questions with cited source material.

Explore next step
Talk to Sorena
Talk through implementation

Review scope, evidence, owners, and the next compliance actions with Sorena.

Explore next step
Primary sources

References and citations

Related guides

Explore more topics

UK PSTI Act statement of compliance: what must the SoC contain?
Understand when a UK PSTI statement is required, the Schedule 4 fields, supply-chain checks, retention, digital accompaniment, and the December 2025 label route.
UK PSTI Act: vulnerability disclosure policy requirements and template
Publish a free, clear, accessible English reporting route plus expected acknowledgement and status-update times, and retain evidence that the information remained available.
UK PSTI applicability test: product, market, and actor scope
Apply the UK PSTI tests in order: connectivity, current exceptions, UK consumer availability, supply facts, and the manufacturer, importer, or distributor trigger.
UK PSTI compliance checklist for product release
Use a release checklist with scope, role, security-control, statement, records, and compliance-failure evidence for UK consumer connectable products.
UK PSTI compliance: duties, evidence, and response
Build a UK PSTI compliance process covering product scope, supply-chain roles, the three security requirements, statements, records, and post-market failures.
UK PSTI default password requirements
Apply the UK PSTI password rule to each relevant password, test unique-per-product generation, and keep reset and release evidence for the shipped model.
UK PSTI Default Password Rules
PSTI requires each covered password to be user-defined or unique per product. Unique credentials must not use prohibited predictable generation methods.
UK PSTI ETSI Evidence and Deemed Compliance
ETSI EN 303 645 and TS 103 701 can structure technical evidence, but the standards-based PSTI route depends on the exact mapped provisions and additional Schedule 2 conditions.
UK PSTI Excepted Products and Boundaries
An internet- or network-connectable product is outside the relevant-product definition only when a current Schedule 3 exception applies; record the exact category and facts rather than relying on a broad sector label.
UK PSTI Importer and Distributor Duties
Importers and distributors have their own statement, stop-supply, remediation, and notification duties; importers also have statutory investigation and 10-year investigation-record duties.
UK PSTI Manufacturer, Importer and Distributor Roles
Distinguish manufacturer, importer, distributor, and authorised-representative duties per product and supply route, including rebranding, imports, statement checks, stop-supply decisions, and compliance failures.
UK PSTI OPSS Notices: Compliance, Stop, Recall, and Penalties
OPSS can use compliance, stop, and recall notices alongside monetary and other measures; notice recipients should preserve the notice, product scope, supply records, corrective actions, representations, and appeal dates.
UK PSTI password and security update policy requirements
Implement the UK PSTI password rule and publish a defined security support period with the required end date, access conditions, and change controls.
UK PSTI Product Security Deadlines and Compliance Calendar Guide
Track the UK PSTI regime's commencement and amendment dates, product-specific support periods, record retention, and OPSS response and appeal windows.
UK PSTI Product Security FAQ
Get direct, sourced answers on product scope, exceptions, roles, passwords, vulnerability reporting, update-period information, statements, records, and OPSS enforcement.
UK PSTI Product Security Importer and Distributor Duties Guide
Identify the pre-supply checks, statement or deemed-compliance evidence, stop-supply decisions, notification and remediation duties required of UK importers and distributors, plus importer-specific investigation and record duties.
UK PSTI Product Security Minimum Support Period and Update Transparency Guide
Publish the minimum security-update period and end date in English, free of charge, without prior request, and in clear language, without implying that PSTI sets one duration for every product.
UK PSTI Product Security OPSS Enforcement and Penalties Guide
Understand OPSS investigations, compliance, stop and recall notices, monetary penalties, forfeiture, court orders, representations, appeals, and evidence needed to respond.
UK PSTI Product Security OPSS Notices Guide
Prepare for compliance, stop, and recall notices by understanding their effects, representation and appeal routes, product records, and corrective-action evidence.
UK PSTI Product Security Penalties and Fines Guide
Understand the maximum fixed and daily PSTI penalties, how OPSS sets an amount, representation and appeal rights, and separate court-ordered sanctions.
UK PSTI product security requirements
Read the three Schedule 1 security requirements and the surrounding manufacturer, importer, distributor, statement, record, and failure-response duties.
UK PSTI Relevant Connectable Product Scope
A product is relevant when it is internet-connectable or network-connectable and not excepted, then the UK consumer-use and supply facts determine whether the Part 1 duties engage.
UK PSTI relevant connectable product scope test
Decide whether one product meets the UK PSTI connectivity definition, falls within a current exception, and reaches the separate UK-consumer duty tests.
UK PSTI relevant connectable products: categories and exceptions
Understand which connected product categories can enter UK PSTI scope, how the statutory tests work, and why examples never replace the current exception schedule.
UK PSTI Scope Classifier Workflow
Decide whether a product falls within the UK PSTI product-security regime by checking connectivity, consumer supply, exceptions, actor roles, and product-specific evidence.
UK PSTI security requirements in practice
Implement the three UK PSTI security requirements through product specifications, release tests, public information, approvals, and post-release evidence.
UK PSTI Security Update Support Periods
PSTI does not prescribe a universal minimum number of support years. The manufacturer sets and publishes a product-specific minimum period and end date; preserve the published commitment and assess any later change against the current Regulations.
UK PSTI Security Update Transparency
Publish the minimum security-update period and end date in English, free of charge, without prior request, and in language understandable without technical knowledge.
UK PSTI Statement of Compliance Evidence Pack
Join the prescribed statement fields to product identifiers, control evidence, publication records, supply-chain checks, accompaniment evidence, retention, and change management.
UK PSTI Statement of Compliance Workflow
Prepare, approve, provide, verify, retain, and update statement evidence before a relevant connectable product is made available in the UK.
UK PSTI Statement of Compliance: Contents, Delivery, and Records
A statement must contain the prescribed information and accompany the product unless a current deemed-compliance route applies; a digital method is possible, but each business must ensure that it meets the Act.
UK PSTI Support Period Evidence Workflow
Set, publish, approve, and preserve the product-specific minimum security-update period and end date, then control changes and customer information against the shipped product.
UK PSTI to ETSI Evidence Mapping
Map ETSI EN 303 645 and TS 103 701 evidence to the three UK legal requirements without treating the wider voluntary ETSI baseline as if every provision were mandatory under PSTI.
UK PSTI vs Australia Smart Device Rules
Compare UK PSTI with Australia's Cyber Security Act smart-device rules by scope, duties, statements, security controls, retention, dates, and enforcement.
UK PSTI vs ETSI EN 303 645
See how binding UK PSTI duties relate to ETSI EN 303 645, which edition the UK Regulations name, what the standard adds, and what evidence to retain.
UK PSTI vs EU Cyber Resilience Act
Decide whether UK PSTI, the EU Cyber Resilience Act, or both apply, then compare actors, exclusions, security work, documents, reporting, and dates.
UK PSTI vs EU Cyber Resilience Act (CRA)
Compare UK PSTI and the EU Cyber Resilience Act by scope, security duties, support periods, conformity assessment, reporting, evidence, and application dates.
UK PSTI Vulnerability Disclosure Requirements
Publish a clear reporting route plus expected acknowledgement and status-update times. PSTI requires the information and timescales to be available; it does not prescribe one universal response deadline for every report.
UK PSTI Vulnerability Disclosure Workflow
Operate intake, acknowledgement, status updates, investigation, remediation, disclosure, and evidence while keeping the legal publication duty distinct from broader good-practice response targets.