UK Telecoms Security Act — the verified record, live

The Telecommunications (Security) Act 2021 overhauled the security obligations of UK public telecoms providers, responding to concerns about network resilience and high-risk vendors. It inserted strengthened duties into the Communications Act 2003, fleshed out by the Electronic Communications (Security Measures) Regulations 2022 and a code of practice that sets tiered implementation deadlines by provider size: measures covering network architecture, supply chain risk, privileged access, monitoring and incident response. The Act also created the designated vendor regime, under which the Secretary of State can issue directions restricting use of designated vendors' equipment — used to require the removal of Huawei from 5G networks against fixed deadlines. Ofcom monitors and enforces providers' security duties, with information-gathering powers and penalties of up to 10% of relevant turnover, while the government enforces vendor directions. With code of practice milestones falling due through the mid-2020s and resilience under parliamentary scrutiny after high-profile outages, compliance evidence and incident reporting remain active workstreams for providers.

Every document below comes from the body that published it — regulators, courts, parliaments, official registers — with its true publication date and a link to the primary source.

as of 2026-08-31 · refreshed from scheduled releases

Latest developments

Publishing bodies represented

Frequently asked

Who enforces the Telecoms Security Act?

Ofcom enforces the security duties placed on public electronic communications networks and services, monitoring compliance against the regulations and code of practice, with powers to demand information, direct remediation and fine providers. The Secretary of State sets the framework, issues designated vendor directions on national security grounds, and enforces those directions directly, with Ofcom assisting on monitoring.

Who does the Telecoms Security Act apply to?

Providers of public electronic communications networks and services in the UK. The code of practice divides providers into tiers by turnover, with the largest national operators in Tier 1 facing the earliest implementation deadlines and fullest expectations, and smaller providers given more time and proportionately lighter treatment. Vendors themselves are not directly regulated but can be the subject of designated vendor directions.

What are the penalties under the Telecoms Security Act?

Ofcom can fine providers up to 10% of relevant turnover for breaches of the security duties, with daily penalties for continuing contraventions, and separate penalties apply for failing to comply with information requests. Breach of a designated vendor direction can also attract penalties at that level, enforced by the Secretary of State.

More: The Wire — this week across the record · all 38 ecosystems · analyst briefs on this regulation ↗