UK PSTI Act — the verified record, live

The Product Security and Telecommunications Infrastructure Act 2022 created the UK's consumer connectable product security regime, in force since 29 April 2024. Manufacturers, importers and distributors of internet-connectable and network-connectable consumer products sold in the UK — from smart speakers and cameras to connected appliances and wearables — must comply with security requirements set in regulations: no universal default passwords, a published vulnerability disclosure policy, and transparency about the minimum period for which security updates will be provided, evidenced by a statement of compliance. The regime is enforced by the Office for Product Safety and Standards on behalf of the Secretary of State, with powers to issue compliance, stop and recall notices and substantial monetary penalties. The Act's separate telecommunications infrastructure provisions amend the Electronic Communications Code on operators' rights to deploy and share networks. As the first legally binding consumer IoT security baseline of its kind, PSTI is a reference point for global product compliance programmes.

Every document below comes from the body that published it — regulators, courts, parliaments, official registers — with its true publication date and a link to the primary source.

as of 2026-08-31 · refreshed from scheduled releases

Latest developments

Publishing bodies represented

Frequently asked

Who does the PSTI product security regime apply to?

Manufacturers of consumer connectable products made available in the UK bear the primary duties, but importers and distributors also have obligations, including not making non-compliant products available and acting on compliance failures. The regime covers internet-connectable products and products that connect to them, with exemptions for categories such as smart metering devices, medical devices and most computers.

What security requirements does PSTI impose?

Three baseline requirements set out in the 2023 regulations: passwords must be unique per product or user-settable, not universal defaults; manufacturers must publish a point of contact and policy for reporting security vulnerabilities; and they must state transparently the minimum period during which the product will receive security updates. Products must be accompanied by a statement of compliance.

What are the penalties under PSTI?

The Office for Product Safety and Standards can issue compliance notices, stop notices and recall notices, and impose monetary penalties of up to £10 million or 4% of qualifying worldwide revenue, whichever is greater, with additional daily penalties for continuing breaches. Failure to comply with enforcement notices can also constitute a criminal offence.

More: The Wire — this week across the record · all 38 ecosystems · analyst briefs on this regulation ↗