Connected Device Security (PSTI Act) Compliance Check

The Product Security and Telecommunications Infrastructure Act 2022, and the security requirements regulations made under it, came into force on 29 April 2024 and apply to anyone who manufactures, imports, or distributes “relevant connectable products” in the UK — smart speakers, connected cameras, wearables, smart TVs, routers, and any other consumer device that can connect to the internet or another device. Every in-scope product must meet three baseline security requirements: no default or weak universal passwords, a published way for security researchers and customers to report vulnerabilities, and clear, accessible information about the minimum period the product will receive security updates.

The Office for Product Safety and Standards (OPSS) enforces the regime and can issue fines of up to £10 million or 4% of global turnover, whichever is greater, plus daily fines for continued non-compliance, and has powers to require product recalls or stop products being supplied in the UK. Retailers are not exempt from responsibility: distributors must check a product carries a statement of compliance before selling it, and can be liable if they knowingly supply non-compliant products. Many small businesses that white-label, import, or resell smart devices — from doorbell cameras to fitness trackers — assume security compliance is the manufacturer’s problem alone, but the distributor duties under PSTI mean due diligence on suppliers is now a legal requirement, not just good practice.

This check assesses whether the connected products your business makes, imports, or sells meet the mandatory security baseline set by the Product Security and Telecommunications Infrastructure Act, and whether your supplier due diligence is in order.