Artifact GuideUKSupply Chain Roles Manufacturer Importer Distributor

UK PSTI Product Security Supply Chain Roles Manufacturer Importer Distributor

Supply Chain Roles Manufacturer Importer Distributor decisions under UK PSTI Product Security should be written in operational language: who is in scope, what must happen, what evidence proves it, and when escalation is needed.

Use this guide to turn official requirements into scope, evidence, owner, and review decisions. This guidance is practical, source-linked, and should be validated against current legal and policy requirements before implementation.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

May 9, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated May 9, 2026

Overview

This page helps you determine which UK PSTI Product Security duties apply, who owns each action, required evidence, and the review path for escalation decisions.

Section 1

What should teams decide about Supply Chain Roles Manufacturer Importer Distributor under UK PSTI Product Security?

First identify which role you are acting in. A manufacturer is the person who makes the product, or has it designed or made and markets it under their name or trademark. An importer brings the product into the UK from outside the UK. A distributor makes the product available in the UK but is not the manufacturer or importer. Once you know the role, decide whether the product is a relevant connectable product and which statement-of-compliance, vulnerability-disclosure, password, or support-period obligation applies.

Keep the legal source, product-scope decision, manufacturer/importer/distributor role, statement of compliance, and technical evidence together so OPSS-facing records are reviewable.

Define the exact Supply Chain Roles Manufacturer Importer Distributor trigger and the business process it affects.
Record which role, product, system, customer group, or data flow is in scope.
Attach the source-linked rule, the owner, and the evidence field before approving the control.
Escalate uncertainty when the facts depend on thresholds, exemptions, cross-border activity, vulnerable users, or enforcement-sensitive wording.

Sources for this answer

The UK Product Security and Telecommunications Infrastructure (Product Security) regime

GOV.UK overview identifying manufacturer, importer and distributor duties under the UK PSTI product-security regime.

Consumer connectable product security regulations

OPSS enforcement guidance cited for regulator-facing records and response evidence under the UK PSTI regime.

Regulations: consumer connectable product security

GOV.UK guidance naming the manufacturers, importers and distributors that must comply with PSTI obligations.

Section 2

Who should own Supply Chain Roles Manufacturer Importer Distributor, and what evidence should prove the decision?

Ownership should sit with the team that controls product design, supply-chain placement, importer/distributor checks, or customer security information, with legal and product-security review.

Evidence should show relevant-connectable-product scope, default-password controls, vulnerability disclosure channel, minimum support period, statement of compliance, supply-chain role checks, and OPSS notice response readiness.

Name one accountable owner and one reviewer for the Supply Chain Roles Manufacturer Importer Distributor workflow.
Keep source screenshots or source links, decision notes, implementation tickets, and approval records together.
Use dated evidence for deadlines, notices, risk assessments, contracts, user journeys, and regulator-facing records.
Review the evidence after product changes, new markets, new vendors, enforcement updates, or material changes in the source text.

Sources for this answer

Consumer connectable product security regulations

OPSS enforcement guidance cited for regulator-facing records and response evidence under the UK PSTI regime.

Regulations: consumer connectable product security

GOV.UK guidance naming the manufacturers, importers and distributors that must comply with PSTI obligations.

THE PRODUCT SECURITY AND TELECOMMUNICATIONS INFRASTRUCTURE (SECURITY REQUIREMENTS FOR RELEVANT CONNECTABLE PRODUCTS) REGULATIONS 2023

UK statutory instrument cited for the security requirements that supply-chain role evidence must map to.

Section 3

Which edge cases should teams check before relying on a Supply Chain Roles Manufacturer Importer Distributor decision?

Most PSTI mistakes happen at the boundary between manufacturer, importer and distributor duties, excepted products, bundled products, support-period statements, and evidence that does not match the shipped product.

Use this section before UK market placement, importer onboarding, distributor acceptance, or support-period publication so the evidence matches the actual product and supply-chain role.

Check whether the product is excepted, bundled with another relevant connectable product, imported from outside the UK, relabelled under another trademark, or supplied by a distributor that must verify the statement of compliance.
Separate binding law, regulator guidance, consultation material, standards, and enforcement commentary in the evidence record.
Do not rely on a previous answer if the data categories, user interface, vendor role, or contractual flow changed.
Track unresolved assumptions in an open-questions section and route legal interpretation points for review.

Sources for this answer

The UK Product Security and Telecommunications Infrastructure (Product Security) regime

GOV.UK overview identifying manufacturer, importer and distributor duties under the UK PSTI product-security regime.

Consumer connectable product security regulations

OPSS enforcement guidance cited for regulator-facing records and response evidence under the UK PSTI regime.

Regulations: consumer connectable product security

GOV.UK guidance naming the manufacturers, importers and distributors that must comply with PSTI obligations.

THE PRODUCT SECURITY AND TELECOMMUNICATIONS INFRASTRUCTURE (SECURITY REQUIREMENTS FOR RELEVANT CONNECTABLE PRODUCTS) REGULATIONS 2023

UK statutory instrument cited for the security requirements that supply-chain role evidence must map to.

Section 4

How should teams operationalize Supply Chain Roles Manufacturer Importer Distributor with proportionate controls?

Use a compact PSTI workflow that captures product scope, role, password control, vulnerability disclosure route, support-period information, statement-of-compliance approval, and OPSS escalation path.

The output should be a product-scope note, statement-of-compliance pack, supplier attestation, customer-facing support-period notice, or OPSS response record.

Create a short intake question that identifies the Supply Chain Roles Manufacturer Importer Distributor scenario.
Map the answer to a required action, evidence field, owner, reviewer, and review date.
Link related artifact pages with descriptive anchors so users can move from scope to deadlines, controls, penalties, and templates.
Update the workflow when official source material changes or when internal evidence shows recurring exceptions.

Sources for this answer

The UK Product Security and Telecommunications Infrastructure (Product Security) regime

GOV.UK overview identifying manufacturer, importer and distributor duties under the UK PSTI product-security regime.

Consumer connectable product security regulations

OPSS enforcement guidance cited for regulator-facing records and response evidence under the UK PSTI regime.

Regulations: consumer connectable product security

GOV.UK guidance naming the manufacturers, importers and distributors that must comply with PSTI obligations.

Recommended next step

Turn UK PSTI Product Security Supply Chain Roles Manufacturer Importer Distributor into assigned work

Use this UK PSTI Product Security guide to turn Supply Chain Roles Manufacturer Importer Distributor into owners, evidence requests, review checkpoints, and reusable operating records inside Sorena.

Assessment workflow

Open Assessment Autopilot for UK PSTI Product Security

Turn Supply Chain Roles Manufacturer Importer Distributor into scoped questions, evidence fields, and review tasks.

Explore next step

Research workflow

Review UK PSTI Product Security source evidence

Use Research Copilot to answer follow-up questions with cited source material.

Explore next step

Talk to Sorena

Talk through UK PSTI Product Security implementation

Review scope, evidence, owners, and the next compliance actions with Sorena.

Explore next step