Build a statement record with the prescribed Schedule 4 information and evidence that it accompanied the product, while checking whether a current deemed-compliance route applies.
The guide separates binding duties from OPSS guidance, ETSI good practice, internal controls, and the limited deemed-compliance routes introduced in 2025.
Use this template only after confirming that the ordinary section 9 statement route under the Product Security and Telecommunications Infrastructure (PSTI) Act 2022 applies. Schedule 4 prescribes the information, but it does not prescribe an official form. The manufacturer prepares and signs the statement; the importer checks and retains it; the distributor checks it before making the product available. A valid, unexpired Japan JC-STAR STAR-1 or Singapore Cybersecurity Labelling Scheme label can satisfy the separate accompaniment route from 4 December 2025, so record that route instead of creating a misleading ordinary statement.
A is the manufacturer's declaration, not an OPSS approval or third-party certificate. Schedule 4 sets minimum information but no official layout, certificate number, or OPSS filing step. Complete every applicable field against the product as first supplied. If several manufacturers meet the Act's definition, list each manufacturer and resolve who signs the statement on behalf of the relevant manufacturer.
Use the type and batch fields as the product-to-statement key. A trade name alone is weak where hardware, firmware, region, or production batches differ. The compliance-basis field records the manufacturer's opinion and the applicable Schedule 1 or Schedule 2 route; it does not turn voluntary testing into regulatory approval.
Sources (1)
Binding minimum information for an ordinary statement of compliance.
Schedule 4 does not require the statement to reproduce the full technical file. Keep a controlled evidence index behind it so each declaration can be checked against the released product. Separate legal statement fields from engineering evidence and from optional ETSI assessment material. The index should show the evidence owner, version, location, review date, result, limitation, and exact product mapping.
Sources (2)
Binding statement-content cross-reference and manufacturer and importer retention periods.
Official guidance that a statement may be digital, but the business must determine and evidence how it accompanies the product.
Approve the statement before the relevant product is made available. The Act allows a statement or a summary in a form later specified by regulations; do not invent a summary route without checking that the required form has been specified. GOV.UK says the statement can be digital because the Act does not require a physical document, but the chosen method still must amount to accompaniment.
A later product or evidence change does not automatically rewrite a statement that correctly described the product when issued. Reassess whether a new product type, batch, manufacturer, compliance basis, support-period statement, or scheme-label status requires a new issue or a route change, and stop supply if a role-specific compliance-failure duty is triggered.
For a route, verify the exact labelled product against the version of the scheme named in the Regulations: Japan JC-STAR STAR-1 based on JST-CR-01-01-2024R1 (December 2024), or the Singapore Cybersecurity Labelling Scheme specified through CCC SP-151-2 CLS(IoT) Scheme Specifications (version 1.4, April 2025). Preserve the current label and expiry evidence; a supplier certificate for another product does not establish the condition.
Sources (2)
Official guidance on the undefined terms document and accompany and the possibility of digital accompaniment.
Binding source for the Schedule 2A label-based accompaniment routes effective from 4 December 2025.
Confirm the ordinary statement or Schedule 2A route, complete every required field, link the exact product and evidence, test accompaniment, and set the retention deadline.
Create evidence fields for Schedule 4 content, product mapping, signature, accompaniment, and retention.
Use Research Copilot to answer follow-up questions with cited source material.
Review scope, evidence, owners, and the next compliance actions with Sorena.
Understand when a UK PSTI statement is required, the Schedule 4 fields, supply-chain checks, retention, digital accompaniment, and the December 2025 label route.
Publish a free, clear, accessible English reporting route plus expected acknowledgement and status-update times, and retain evidence that the information remained available.
Apply the UK PSTI tests in order: connectivity, current exceptions, UK consumer availability, supply facts, and the manufacturer, importer, or distributor trigger.
Use a release checklist with scope, role, security-control, statement, records, and compliance-failure evidence for UK consumer connectable products.
Build a UK PSTI compliance process covering product scope, supply-chain roles, the three security requirements, statements, records, and post-market failures.
Apply the UK PSTI password rule to each relevant password, test unique-per-product generation, and keep reset and release evidence for the shipped model.
Distinguish manufacturer, importer, distributor, and authorised-representative duties per product and supply route, including rebranding, imports, statement checks, stop-supply decisions, and compliance failures.
Implement the UK PSTI password rule and publish a defined security support period with the required end date, access conditions, and change controls.
Track the UK PSTI regime's commencement and amendment dates, product-specific support periods, record retention, and OPSS response and appeal windows.
Get direct, sourced answers on product scope, exceptions, roles, passwords, vulnerability reporting, update-period information, statements, records, and OPSS enforcement.
Identify the pre-supply checks, statement or deemed-compliance evidence, stop-supply decisions, notification and remediation duties required of UK importers and distributors, plus importer-specific investigation and record duties.
Publish the minimum security-update period and end date in English, free of charge, without prior request, and in clear language, without implying that PSTI sets one duration for every product.
Understand OPSS investigations, compliance, stop and recall notices, monetary penalties, forfeiture, court orders, representations, appeals, and evidence needed to respond.
Prepare for compliance, stop, and recall notices by understanding their effects, representation and appeal routes, product records, and corrective-action evidence.
Understand the maximum fixed and daily PSTI penalties, how OPSS sets an amount, representation and appeal rights, and separate court-ordered sanctions.
Read the three Schedule 1 security requirements and the surrounding manufacturer, importer, distributor, statement, record, and failure-response duties.
Decide whether one product meets the UK PSTI connectivity definition, falls within a current exception, and reaches the separate UK-consumer duty tests.
Understand which connected product categories can enter UK PSTI scope, how the statutory tests work, and why examples never replace the current exception schedule.
Decide whether a product falls within the UK PSTI product-security regime by checking connectivity, consumer supply, exceptions, actor roles, and product-specific evidence.
Implement the three UK PSTI security requirements through product specifications, release tests, public information, approvals, and post-release evidence.
Join the prescribed statement fields to product identifiers, control evidence, publication records, supply-chain checks, accompaniment evidence, retention, and change management.
Prepare, approve, provide, verify, retain, and update statement evidence before a relevant connectable product is made available in the UK.
Set, publish, approve, and preserve the product-specific minimum security-update period and end date, then control changes and customer information against the shipped product.
Map ETSI EN 303 645 and TS 103 701 evidence to the three UK legal requirements without treating the wider voluntary ETSI baseline as if every provision were mandatory under PSTI.
Compare UK PSTI with Australia's Cyber Security Act smart-device rules by scope, duties, statements, security controls, retention, dates, and enforcement.
See how binding UK PSTI duties relate to ETSI EN 303 645, which edition the UK Regulations name, what the standard adds, and what evidence to retain.
Decide whether UK PSTI, the EU Cyber Resilience Act, or both apply, then compare actors, exclusions, security work, documents, reporting, and dates.
Compare UK PSTI and the EU Cyber Resilience Act by scope, security duties, support periods, conformity assessment, reporting, evidence, and application dates.
Operate intake, acknowledgement, status updates, investigation, remediation, disclosure, and evidence while keeping the legal publication duty distinct from broader good-practice response targets.
PSTI requires each covered password to be user-defined or unique per product. Unique credentials must not use prohibited predictable generation methods.
ETSI EN 303 645 and TS 103 701 can structure technical evidence, but the standards-based PSTI route depends on the exact mapped provisions and additional Schedule 2 conditions.
An internet- or network-connectable product is outside the relevant-product definition only when a current Schedule 3 exception applies; record the exact category and facts rather than relying on a broad sector label.
Importers and distributors have their own statement, stop-supply, remediation, and notification duties; importers also have statutory investigation and 10-year investigation-record duties.
OPSS can use compliance, stop, and recall notices alongside monetary and other measures; notice recipients should preserve the notice, product scope, supply records, corrective actions, representations, and appeal dates.
A product is relevant when it is internet-connectable or network-connectable and not excepted, then the UK consumer-use and supply facts determine whether the Part 1 duties engage.
PSTI does not prescribe a universal minimum number of support years. The manufacturer sets and publishes a product-specific minimum period and end date; preserve the published commitment and assess any later change against the current Regulations.
Publish the minimum security-update period and end date in English, free of charge, without prior request, and in language understandable without technical knowledge.
A statement must contain the prescribed information and accompany the product unless a current deemed-compliance route applies; a digital method is possible, but each business must ensure that it meets the Act.
Publish a clear reporting route plus expected acknowledgement and status-update times. PSTI requires the information and timescales to be available; it does not prescribe one universal response deadline for every report.