Connected Device Security (PSTI Act) Compliance Check
Check whether the smart or connected products your business makes, imports, or sells meet the mandatory security requirements under the Product Security and Telecommunications Infrastructure Act.
Why this matters
The Product Security and Telecommunications Infrastructure Act 2022, and the security requirements regulations made under it, came into force on 29 April 2024 and apply to anyone who manufactures, imports, or distributes “relevant connectable products” in the UK — smart speakers, connected cameras, wearables, smart TVs, routers, and any other consumer device that can connect to the internet or another device. Every in-scope product must meet three baseline security requirements: no default or weak universal passwords, a published way for security researchers and customers to report vulnerabilities, and clear, accessible information about the minimum period the product will receive security updates.
The Office for Product Safety and Standards (OPSS) enforces the regime and can issue fines of up to £10 million or 4% of global turnover, whichever is greater, plus daily fines for continued non-compliance, and has powers to require product recalls or stop products being supplied in the UK. Retailers are not exempt from responsibility: distributors must check a product carries a statement of compliance before selling it, and can be liable if they knowingly supply non-compliant products. Many small businesses that white-label, import, or resell smart devices — from doorbell cameras to fitness trackers — assume security compliance is the manufacturer’s problem alone, but the distributor duties under PSTI mean due diligence on suppliers is now a legal requirement, not just good practice.
What you'll need
- A list of any smart/connected products your business manufactures, imports, or resells in the UK
- Whether you have documentation from manufacturers confirming PSTI compliance
- Your current process (if any) for handling security vulnerability reports
- Knowledge of how long software/security updates are guaranteed for your products
What you'll get
A personalised compliance report covering: a score out of 100, an executive summary, a list of findings ranked by severity, and a prioritised action plan with timeframes.
This check assesses whether the connected products your business makes, imports, or sells meet the mandatory security baseline set by the Product Security and Telecommunications Infrastructure Act, and whether your supplier due diligence is in order.
General guidance only — not legal advice. Consult a qualified UK solicitor for specific issues.