UK PSTI Act (product security)
In force United Kingdom · In force Apr 29, 2024 · no upcoming deadlines
Deadlines
| Date | What happens | When |
|---|---|---|
| Apr 29, 20242 years ago | Product security requirements apply | 2.4 years ago |
| Dec 6, 20223 years ago | Royal Assent | 3.8 years ago |
Summaries for reference, not legal advice. Check the official text.
What it does
Sets baseline security requirements for consumer connectable products sold in the UK. Manufacturers must ban universal default passwords, publish a way to report vulnerabilities, and state the minimum security update support period. Importers and distributors share compliance duties.
- Who it applies to
- Manufacturers, importers and distributors of relevant connectable consumer products (smart TVs, cameras, phones, routers, wearables and similar) made available in the UK.
- Penalties
- Monetary penalties up to the greater of GBP 10 million or 4% of qualifying worldwide revenue, plus daily penalties; compliance, stop and recall notices.
- Enforced by
- Secretary of State, delegated to the Office for Product Safety and Standards (OPSS).
- Official name
- Product Security and Telecommunications Infrastructure Act 2022 and the Product Security Regulations 2023
- Citation
- 2022 c. 46; SI 2023/1007
- Topics
- cybersecurity
Verified 2026-09-25 legislation.gov.uk
Research notes
Part 2 of the Act covers telecoms infrastructure (code rights) and is out of scope here.
Related
Questions about UK PSTI Act (product security)
- What are the UK PSTI Act (product security) compliance deadlines?
- Dec 6, 2022: Royal Assent. Apr 29, 2024: Product security requirements apply.
- When does UK PSTI Act (product security) take effect?
- UK PSTI Act (product security) took effect on Apr 29, 2024.
- Who does UK PSTI Act (product security) apply to?
- Manufacturers, importers and distributors of relevant connectable consumer products (smart TVs, cameras, phones, routers, wearables and similar) made available in the UK.
- What are the penalties under UK PSTI Act (product security)?
- Monetary penalties up to the greater of GBP 10 million or 4% of qualifying worldwide revenue, plus daily penalties; compliance, stop and recall notices.