UK regulation
PSTI: the UK security rules for connected products, explained
PSTI is the UK's product security regime for consumer connectable products, set by the Product Security and Telecommunications Infrastructure Act 2022 and Regulations in force since 29 April 2024. Manufacturers must not use universal default passwords, must publish how to report security issues and must publish a minimum security update period.
Free plan, no card required.
What is PSTI?
PSTI stands for the Product Security and Telecommunications Infrastructure Act 2022. Part 1 of the Act gives the UK government the power to set security requirements for connectable products, and the Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023 set the first three. The Regulations came into force on 29 April 2024 and extend to England and Wales, Scotland and Northern Ireland.
Part 2 of the Act deals with telecommunications infrastructure, such as the rights of network operators to install equipment. This guide covers Part 1, the product security regime, which is what product makers mean when they talk about PSTI compliance.
Which products are covered?
The regime applies to relevant connectable products made available to customers in the UK, consumers first among them. The Act covers two kinds of product: internet-connectable products, which connect using the Internet Protocol suite, and network-connectable products, which do not reach the internet themselves but connect to a product that does. A smart camera, a connected speaker and a hub-based sensor can all be in scope.
Manufacturers outside the UK are covered when their products are sold to UK customers. Schedule 3 of the Regulations excepts some categories because other rules already deal with them:
- Desktop and laptop computers, and tablets that cannot connect to a cellular network, unless designed exclusively for children under 14.
- Medical devices covered by the Medical Devices Regulations 2002.
- Smart meter products installed by licensed energy suppliers and assured under an approved scheme.
- Electric vehicle charge points covered by the Electric Vehicles (Smart Charge Points) Regulations 2021.
- Some products made available in Northern Ireland under qualifying EU legislation listed in the Windsor Framework.
The three PSTI security requirements
Schedule 1 of the 2023 Regulations sets three requirements for manufacturers. Each targets a common, well-documented weakness of consumer devices. Schedule 2 adds a route to deemed compliance through named provisions of ETSI EN 303 645 and ISO/IEC 29147.
| Requirement | What it asks for | Deemed compliance |
|---|---|---|
| No universal default passwords | Passwords must be unique per product or set by the user. Unique passwords must not follow incremental counters, be derived from public information, or from serial numbers without accepted cryptography, or be easy to guess. | ETSI EN 303 645 provision 5.1-1, and 5.1-2 where relevant |
| Information on how to report security issues | Publish at least one point of contact for reporting security issues, and say when the reporter will receive an acknowledgement and status updates until the issue is resolved. | ETSI EN 303 645 provision 5.2-1, or ISO/IEC 29147 paragraphs 6.2.2, 6.2.5 and 6.5 |
| Information on minimum security update periods | Publish the defined support period in clear language a non-technical reader understands, with equal prominence where the manufacturer sells the product on its own website. It may be extended but not shortened. | ETSI EN 303 645 provision 5.3-13 |
Who has to do what
Manufacturers must meet the security requirements, investigate potential compliance failures and keep records. A statement of compliance must accompany the product. Importers and distributors have their own duties: to check that the statement of compliance is there, not to supply products with a compliance failure, and to take action when they find one.
Schedule 4 of the Regulations sets the minimum content of the statement of compliance:
- The product type and batch.
- The name and address of each manufacturer and of any authorised representative.
- A declaration that it was prepared by or on behalf of the manufacturer, and that in the manufacturer's opinion the security requirements, or the deemed-compliance conditions, have been met.
- The defined support period at the time the product was first supplied.
- The signatory's name, function and signature, and the place and date of issue.
Enforcement and penalties
The Office for Product Safety and Standards (OPSS) enforces the regime for the Secretary of State. The Act provides for compliance notices, stop notices and recall notices, and for the forfeiture of products that do not comply.
A monetary penalty can reach the greater of £10 million or 4% of the company's qualifying worldwide revenue, and a daily penalty of up to £20,000 can be added for each day a breach continues.
PSTI and the EU Cyber Resilience Act
Products sold in the UK and the EU face both regimes. The Cyber Resilience Act is broader: it covers products with digital elements in general, sets essential requirements for design, development and vulnerability handling, asks for an SBOM and has required reporting of actively exploited vulnerabilities since 11 September 2026. PSTI is narrower and has applied to consumer connectable products in the UK since April 2024.
The three PSTI requirements match practices the CRA also expects: no default passwords, a contact for vulnerability reports and a declared support period. Work done for one regime is reusable for the other, but meeting PSTI does not show conformity with the CRA.
Available in KROMSE today
KROMSE does not assess or certify PSTI compliance or prepare statements of compliance; it supplies the vulnerability evidence that your reporting process and support period depend on.
- Known vulnerabilities in the software and Linux-based firmware of a connected product, with evidence and coverage limits.
- Misconfigurations and embedded secrets in the unpacked root file system of a firmware image; secret values are never stored.
- CycloneDX and SPDX SBOMs for every scan.
- CISA KEV, FIRST EPSS, NVD and ENISA EUVD context on findings, with known-exploited vulnerabilities flagged.
Frequently asked questions
What does PSTI stand for?
Product Security and Telecommunications Infrastructure, from the Product Security and Telecommunications Infrastructure Act 2022. Its Part 1 product security regime applies through the 2023 Regulations, in force since 29 April 2024.
When did PSTI come into force?
The security requirements have applied since 29 April 2024, under the Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023, SI 2023/1007.
Does PSTI apply to products made outside the UK?
Yes. What matters is that the product is made available to customers in the UK. Overseas manufacturers are covered, and UK importers and distributors carry their own duties, including checking for the statement of compliance.
Is ETSI EN 303 645 mandatory under PSTI?
No. The legal requirements are in Schedule 1 of the Regulations. Meeting the provisions of ETSI EN 303 645 listed in Schedule 2, or ISO/IEC 29147 for vulnerability reporting, is a route to deemed compliance, which is why many manufacturers use it.
Does KROMSE make my product PSTI compliant?
No. KROMSE does not certify compliance or prepare statements of compliance. It finds known vulnerabilities in software and Linux-based firmware, produces SBOMs and records decisions, which supports the vulnerability handling behind your reporting contact and support period.