Direct answer: the UK PSTI (Product Security and Telecommunications Infrastructure) regime for consumer connectable products has applied since 29 April 2024; by 2026 it is in enforcement/spot-check territory. It requires "relevant connectable products" sold in the UK to meet three minimum security requirements: (1) no universal default passwords—passwords must be unique per product or user-defined, and must not be based on incremental counters, public information or easily guessable identifiers such as serial numbers; (2) a public vulnerability-reporting route—how to report, acknowledgement/status-update timescales, in English, free and accessible; (3) a published minimum security-update support period—with an end date, in English, free and understandable to consumers. Manufacturers must also produce a Statement of Compliance (SoC) that accompanies the product; importers/distributors must not make products available without one. Enforcement is by OPSS; maximum penalties are the greater of £10 million or 4% of qualifying worldwide revenue, plus up to £20,000 per day for continuing non-compliance.
This guide is for Chinese manufacturers of smart cameras, speakers, TVs, routers, toys and connected appliances sold in the UK, UK importers/distributors, cross-border sellers and compliance teams. It explains PSTI scope, the three security requirements, the SoC, role obligations, penalties, the difference from EU CRA/CE and a 90-day readiness checklist. Sources are the GOV.UK PSTI regime guidance (updated 2 May 2024), the OPSS enforcement page and the 2023 security-requirements regulations (all accessed 8 November 2026). Legal facts, editorial interpretation and items to confirm are kept separate. This is not legal advice.
(1) PSTI is not "guidance": it has applied since 29 April 2024 and OPSS can enforce it; maximum penalties are the greater of £10 million or 4% of worldwide revenue. (2) Three things are mandatory: unique/user-set passwords, a public vulnerability-reporting route with timescales, and a public security-update support period with an end date. (3) The SoC must accompany the product; importers/distributors must check it. A digital document is possible, but a generic statement on a website is usually not enough.
Timeline and scope
Part 1 of the PSTI Act 2022 and the 2023 Security Requirements Regulations both came into force on 29 April 2024. Scope is a "relevant connectable product": an internet-connectable or network-connectable consumer product that is not an excepted product in Schedule 3. Common examples include smart cameras, speakers, TVs, routers, connected toys and appliances, but the final test is the product's connectivity, consumer use and the exceptions list. This is a UK market regime, not a CE/UKCA marking regime; CE/UKCA does not automatically satisfy PSTI.
| Date/item | Content | What it means |
|---|---|---|
| Dec 2022 | PSTI Act 2022 receives Royal Assent | Part 1 creates the product-security regime |
| 14 Sep 2023 | 2023 Security Requirements Regulations signed | Three requirements/SoC detailed |
| 29 Apr 2024 | Regime in force | Products sold in the UK must comply |
| 2026 | OPSS enforcement/spot checks | Not "future law" |
| Scope | Relevant connectable products | Internet/network-connectable, consumer, non-excepted |
Sources: GOV.UK PSTI regime guidance (updated 2 May 2024), PSTI Act 2022 Part 1, 2023 Security Requirements Regulations (accessed 8 November 2026). Editorial summary; the final "relevant connectable product" test follows the legal definition/Schedule 3 exceptions.
The three minimum security requirements
Schedule 1 is specific: passwords must be unique per product or user-defined; if unique, they must not be based on incremental counters, public information, product identifiers such as serial numbers (unless encrypted/keyed-hashed) or otherwise easily guessable. Vulnerability reporting: manufacturers must publish how to report security issues and the timescales for acknowledgement and status updates; the information must be in English, free, available without prior request, accessible, clear and transparent. Support period: the minimum security-update period and end date must be published in English, free, and understandable to a reader without technical knowledge. These are not "write a policy" items; they must be checkable on the product page/manual/website.
| Requirement | Minimum practice | Common failure |
|---|---|---|
| Passwords | Unique per product or user-set; no incremental/public/identifier-derived/easily guessed values | admin/admin, 123456, same default, serial number as password |
| Vulnerability reporting | Public route, acknowledgement/update timescales; English, free, accessible | Internal mailbox only, no timescales, Chinese-only, login required |
| Support period | Minimum update period + end date; English, free, understandable | "Regular updates" only, no end date, buried in contract |
Sources: Schedule 1 of the 2023 PSTI (Security Requirements for Relevant Connectable Products) Regulations; GOV.UK PSTI guidance (updated 2 May 2024). Editorial summary; exact wording/technical details follow the regulations.
Role obligations: manufacturer, importer, distributor
PSTI "relevant persons" include manufacturers, importers and distributors; an overseas manufacturer may appoint a UK authorised representative to perform some duties, but this does not remove the manufacturer's liability. Manufacturers must meet the three security requirements, produce an SoC and ensure it accompanies the product, and retain a copy; importers/distributors must not make a product available without an SoC, retain copies and cooperate with enforcement. The SoC can be a digital document, but it must "accompany" the product; a generic statement only on a website is usually not enough to show every batch complies.
| Role | Core duty | Evidence/caveat |
|---|---|---|
| Manufacturer | Meet three requirements; produce SoC; accompany product; retain copy | Technical file, testing, SoC version |
| Importer | Do not sell without SoC; retain copy; cooperate | Batch SoC, supplier declaration |
| Distributor | Do not sell without SoC; do not affect compliance | Incoming checks, records |
| UK authorised representative | Perform authorised duties | Mandate, duty list |
Sources: PSTI Act 2022 sections 7, 13, 15, 22 and 51; 2023 Regulations 7-9; GOV.UK PSTI guidance. Editorial summary; specific duties/mandates follow the law and contract.
Statement of Compliance (SoC): it travels with the product
The SoC is PSTI's core evidence: manufacturers must prepare the Schedule 4 information and ensure it accompanies the product; importers/distributors must confirm the product has one. The law does not require paper—a digital document is possible—but it must meet the "document" and "accompany" requirements. In practice, an SoC should at least identify the manufacturer/importer, product/model, state compliance with the three requirements, give the support-period end date and a date/version, and be traceable to batch/configuration evidence. Exact fields follow Schedule 4.
| SoC element | Purpose | Check |
|---|---|---|
| Manufacturer/importer info | Responsible party/contact | Name, address, contact |
| Product identification | Model/batch mapping | Model, SKU, batch |
| Compliance statement | Declares the three requirements | Consistent with testing/config |
| Support period | Minimum updates/end date | Matches public information |
| Issue/version | Traceability | Date, version, signature |
Sources: PSTI Act 2022 SoC definition, 2023 Regulations regulation 7 and Schedule 4; GOV.UK PSTI guidance. Editorial summary; exact fields follow Schedule 4/the regulations.
Enforcement and penalties: how much OPSS can fine
OPSS has enforced the regime since 29 April 2024 in a risk-based, proportionate way. The PSTI Act sets the maximum fixed penalty at the greater of £10 million or 4% of qualifying worldwide revenue; continuing non-compliance can add up to £20,000 per day. Enforcement notices/remediation requirements are also possible. For Chinese manufacturers, risk flows through UK importers/distributors/platforms: no SoC, weak passwords or no published support period can lead to delisting, returns, claims or contract termination.
| Item | Maximum/description |
|---|---|
| Fixed penalty | Greater of £10 million or 4% of qualifying worldwide revenue |
| Continuing non-compliance | Up to £20,000 per day |
| Enforcer | OPSS (under an MoU with DSIT) |
| Other consequences | Remediation notices, delisting/returns/claims/contract risk |
Sources: OPSS consumer connectable product security enforcement page (accessed 8 November 2026), PSTI Act 2022 section 38. Editorial summary; penalty calculation/procedure follows OPSS enforcement policy and the law.
Difference from EU CRA / CE
PSTI is a UK product-security regime focused on minimum security requirements + SoC + enforcement; the EU CRA is a broader EU cybersecurity regulation covering the product lifecycle/vulnerability management/CE marking; CE/UKCA is a product compliance marking and does not equal PSTI compliance. Companies selling smart products in the UK may face PSTI, UKCA/CE (product safety/radio/EMC) and customer/platform requirements at the same time; do not treat "CE" as "PSTI done".
| Regime | Focus | Does not replace |
|---|---|---|
| UK PSTI | Three security requirements, SoC, OPSS enforcement | EU CRA/CE |
| EU CRA | Product cybersecurity lifecycle/CE | UK PSTI |
| CE/UKCA | Product safety/radio/EMC compliance marking | PSTI security requirements/SoC |
| Customer/platform rules | Procurement/listing reviews | Legal duties |
Editorial comparison, not legal advice; PSTI/CRA/CE scope follows the official texts.
90-day readiness checklist
Use the first 90 days to answer "which SKUs are sold in the UK, are they relevant connectable products, do the three requirements hold, does the SoC travel with the product". The order is scope/SKU, passwords/vulnerability/support period, SoC/batch, importer/distributor, testing/evidence, monitoring. Do not just change website copy; factory configuration, manuals, packaging/digital documents and the SoC must all match.
| Phase | Action | Output |
|---|---|---|
| Weeks 1-2 | Inventory UK SKUs; determine relevant connectable product/exceptions | SKU/scope list |
| Weeks 2-4 | Check password strategy (unique/user-set/not guessable) | Password design, test records |
| Weeks 3-5 | Publish vulnerability route/timescales; support period/end date | Public pages, SLA |
| Weeks 5-7 | Prepare Schedule 4 SoC; map to batch/model | SoC template, batch records |
| Weeks 7-9 | Confirm importer/distributor accompanies/retains SoC | Contract clauses, incoming checks |
| Weeks 9-12 | Mock OPSS inquiry; fix/train/monitor | Drill report, remediation list |
Editorial readiness advice, not an official template; scope/requirements/evidence follow the PSTI Act, 2023 Regulations and OPSS guidance.
FAQ
When did PSTI come into force?
29 April 2024. Part 1 of the PSTI Act 2022 and the 2023 Security Requirements Regulations took effect on the same day; by 2026 OPSS is enforcing/spot-checking.
Which products are covered?
"Relevant connectable products": internet-connectable or network-connectable consumer products that are not excepted products in Schedule 3. Common examples include smart cameras, speakers, TVs, routers, connected toys and appliances; the final test follows the legal definition/exceptions.
What exactly are the three requirements?
(1) Passwords unique per product or user-set, not incremental/public/identifier-derived/easily guessed; (2) a public vulnerability-reporting route with acknowledgement/update timescales; (3) a published minimum security-update support period and end date. All in English, free and accessible.
Must the SoC be paper?
No—digital documents are possible—but it must meet the "document" and "accompany" requirements. A generic statement only on a website is usually insufficient; prepare it by model/batch and provide it with the product/packaging/digital delivery.
What must importers/distributors do?
They must not make a product available without an SoC; retain copies and cooperate with OPSS; distributors must also ensure handling does not affect compliance.
Is CE/UKCA enough?
No. CE/UKCA covers product safety/radio/EMC marking; PSTI is a separate smart-product security regime requiring the three requirements and an SoC.
What are the penalties?
Maximum fixed penalty is the greater of £10 million or 4% of qualifying worldwide revenue; continuing non-compliance can add up to £20,000 per day. Calculation/procedure follows OPSS enforcement policy.
How should the support period be published?
Publish the minimum security-update period and end date in English, free, and understandable without technical background; it must match actual update capability, the SoC and public pages.
Research method and limitations
This article separates "legal facts" from "editorial interpretation." PSTI's in-force date, scope, three security requirements, SoC, role duties, OPSS enforcement and penalties come from the GOV.UK PSTI regime guidance (updated 2 May 2024), PSTI Act 2022 Part 1, the 2023 Security Requirements Regulations and the OPSS enforcement page (accessed 8 November 2026); the 90-day checklist and "evidence/action" columns are editorial. Specific scope/enforcement follows the law, Schedule 3 exceptions and OPSS policy.
Eight limitations: (1) this is not legal advice; (2) Schedule 3 excepted products are not checked item by item; (3) not all product types/connectivity models are covered; (4) SoC fields/format follow Schedule 4 and are not reproduced verbatim; (5) specific test labs/standards are not assessed; (6) UK/EU/Northern Ireland interactions are not covered; (7) no real product testing/OPSS inquiry is included; (8) law/guidance may update, so recheck official pages before shipping.
Sources and basis
- GOV.UK, The UK Product Security and Telecommunications Infrastructure (Product Security) regime (updated 2 May 2024): gov.uk/.../psti-product-security-regime. In-force date, scope, three requirements, SoC, roles, enforcement. Accessed 8 November 2026.
- OPSS, Consumer connectable product security regulations (enforcement page): gov.uk/.../consumer-connectable-product-security-regulations. Penalty maxima/enforcement. Accessed 8 November 2026.
- PSTI Act 2022, Part 1: legislation.gov.uk/ukpga/2022/46/part/1. Definitions, duties, SoC, penalties. Accessed 8 November 2026.
- The Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023: legislation.gov.uk/uksi/2023/1007. Schedule 1 security requirements, Schedule 3 exceptions, Schedule 4 SoC. Accessed 8 November 2026.
Data cut-off 8 November 2026; PSTI duties/penalties follow the law, OPSS guidance and official texts; this is not legal advice.