United KingdomProduct Security Requirements for Connectable Products
Product Security and Telecommunications Infrastructure Act 2022 c. 46, Part 1; Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023, SI 2023/1007
In force since .
A product security requirements rule binding private bodies.
- Obligation class
- Security, Disclosure, Governance
What it requires
- This binds a manufacturer, importer or distributor of a physical internet- or network-connectable consumer product placed on the UK market, and does not by itself reach a company that only publishes an app or other software with no connectable product of its own.
- Ban universal default passwords and easily guessable passwords across the product's hardware and pre-installed or required software; a password must be unique per unit or set by the user, and must not be built from incremental counters or from publicly derivable identifiers.NIST CSF 2.0PR.PS-06
- Publish at least one point of contact for reporting a security issue affecting the product, in English, free of charge, without requiring the reporter's personal information, and state when the reporter will get an acknowledgment and status updates.NIST CSF 2.0ID.RA-08
- Publish the minimum period for which the product will receive security updates, in plain language, before or at the point of sale, and never shorten that stated period once published.NIST CSF 2.0PR.PS-02
- The duties to publish a reporting contact and a minimum update period do not reach software used on a smartphone or a cellular-capable tablet computer, and the whole regime excepts a desktop computer, a laptop computer, a non-cellular tablet computer, an electric-vehicle charge point, most medical devices, and an assured smart meter.
These lines are LexLint's reading of the law's text. Also read by: Office for Product Safety and Standards (OPSS), Department for Business and Trade (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- NIST CSF 2.0
- ID.RA-08Processes for receiving, analyzing, and responding to vulnerability disclosures are established
- PR.PS-02Software is maintained, replaced, and removed commensurate with risk
- PR.PS-06Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle
- CIS Controls
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
1 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Failing to comply with a compliance, stop or recall notice issued under the Act is an offence under section 32, triable summarily: an unlimited fine in England and Wales, and a fine of up to level 5 on the standard scale in Scotland and Northern Ireland. The underlying failure to meet a security requirement is not itself a criminal offence; the civil monetary penalty in sections 36 to 41 is the primary sanction for that.
Penalty structure
Section 38: the relevant maximum for a fixed monetary penalty under section 36 is the greater of 10,000,000 pounds sterling and 4% of the person's qualifying worldwide revenue for its most recent complete accounting period. Section 37 separately allows a daily penalty of up to 20,000 pounds sterling for each day a failure to comply with an enforcement notice continues beyond the notice's deadline, which this structure does not carry a field for.
- Rule
- Higher of
- As of
- Currency
- GBP
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
The Secretary of State, who under a memorandum of understanding delegates day-to-day enforcement to the Office for Product Safety and Standards (OPSS), part of the Department for Business and Trade.
Enforcement record
OPSS's own published register of enforcement actions lists every enforcement notice OPSS has issued, broken out into six-month periods since April 2018. Its most recent period report, to (entries recorded through February 2026), lists four enforcement actions, two under the Construction Products Regulations 2013 and two under the General Product Safety Regulations 2005 (each issued by virtue of the Toys (Safety) Regulations 2011), and names none under the Product Security and Telecommunications Infrastructure Act 2022 or the Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023, which have applied since . The two preceding six-month period reports, to and to , list actions under the Construction Products Regulations, the General Product Safety Regulations, environmental protection and timber rules, and neither names a PSTI action either.
- As of
- Source link
- https://www.gov.uk/government/publications/opss-enforcement-actions/opss-enforcement-actions-1-october-2025-to-31-march-2026
Settledness
- As of
- Guidance link
- https://www.gov.uk/government/publications/the-uk-product-security-and-telecommunications-infrastructure-product-security-regime
- Guidance body
- Office for Product Safety and Standards (OPSS), Department for Business and Trade
- Open questions
- Where a relevant connectable product depends on companion software developed and updated by a party other than the product's own manufacturer, importer or distributor under section 7, does the section 8 duty to comply with the reporting-contact and update-period requirements of Schedule 1 reach that third-party software developer directly, or does it reach only the relevant person who places the finished product on the market?
What this law does
A manufacturer of a UK consumer connectable product, an internet- or network-connectable product that is not excepted, must comply with the security requirements of the 2023 Regulations, and an importer or distributor who supplies the product must not do so while aware of a manufacturer compliance failure.
Schedule 1 of the Regulations bans universal or easily guessable default passwords and requires the manufacturer to publish a point of contact for reporting a security issue, with a commitment on when the reporter will get an acknowledgment and status updates. The manufacturer must publish the minimum period for which security updates will be provided. That published period cannot later be shortened once it is published.
The duties reach firmware, software pre-installed on the product, and companion software that must be installed for the product's intended purpose. The reporting-contact and update-period duties do not reach the software of a smartphone or a cellular-capable tablet computer. The excepted-products schedule separately excepts a desktop computer, a laptop computer, and a non-cellular tablet computer, unless the product is designed for a child under 14.
It also excepts an electric-vehicle charge point, most medical devices, and an assured smart-meter product from the regime entirely.
The Secretary of State, acting through the Office for Product Safety and Standards under a memorandum of understanding with the Department for Science, Innovation and Technology, enforces the regime with compliance, stop and recall notices and can impose a civil monetary penalty of up to the greater of 10,000,000 pounds sterling or 4% of a person's qualifying worldwide revenue.
OPSS guidance states a further daily penalty of up to 20,000 pounds sterling for continuing non-compliance with an enforcement notice. Failing to comply with an enforcement notice is separately a criminal offence carrying a fine.
When LexLint raises it
When your app profile says your app distributes a software product.
Back to the example · Lint your app
Page updated .