For products using the statement route, the statement is not a marketing summary. It is the formal compliance document that supports UK availability.
The surrounding evidence file matters just as much because the statement expresses the manufacturer's opinion that the applicable security requirements have been met.
Structured answer sets in this page tree.
Cited legal and guidance references.
For most products, section 9 says the manufacturer may not make a relevant connectable product available in the United Kingdom unless it is accompanied by a statement of compliance or a compliant summary. Since 4 December 2025, regulation 4A and Schedule 2A also provide a deemed-compliance route for that requirement in some labeled-product cases. Where the statement route is used, the regulations specify the minimum statement content and the retention periods for manufacturers and importers.
The statement should be tied to a clearly identified product family or model set and to the specific applicable security requirements. It should not be a generic brand declaration detached from the actual product version and support commitment.
Schedule 4 requires enough detail to identify the product and the responsible business: product type and batch or serial number, manufacturer name and address, any authorised representative name and address, the manufacturer's compliance declaration, the defined support period that was correct when the manufacturer first supplied the product, and the signatory and issue details.
That is what makes later evidence retrieval possible.
SSOT can take Statement of Compliance and Evidence from reusing this material inside a governed evidence system to a reusable workflow inside Sorena. Teams working on Statement of Compliance can keep owners, evidence, and next steps aligned without copying this guide into separate documents.
Start from Statement of Compliance and Evidence and keep documents, evidence, and control records in one governed system.
Review your current process, evidence gaps, and next steps for Statement of Compliance and Evidence.
The Act lets regulations require a manufacturer to take specified steps to determine whether it has complied before preparing the statement. That means the evidence pack should show how the conclusion was reached, not only the final declaration.
In practice that includes password design evidence, vulnerability disclosure publication proof, support-period publication proof, relevant testing or assurance records, and, where a Schedule 2 or 2A deemed-compliance route is being used, evidence that the route-specific conditions were met.
The regulations say the manufacturer and importer each retain a copy of the statement for the longer of 10 years from issue and the defined support period, but only where a statement is required under section 9(2) or section 15(2). This is easy to miss when support periods extend beyond typical document retention defaults.
If the product is using the Schedule 2A deemed-compliance route instead of the statement route, do not assume the statement-retention regulations apply. Retention design should therefore start with the actual legal route the product is using.