Loading...
Product Security and Telecommunications Infrastructure Act
UK law requiring manufacturers of consumer connectable products (IoT) to meet baseline cybersecurity standards. Bans universal default passwords, mandates vulnerability disclosure policies, and requires transparency on security update support periods. Penalties up to GBP 10M or 4% of worldwide revenue.
£10M
Max Fine
4%
Revenue Penalty
3
Core Requirements
All IoT
Product Scope
6 December 2022
PSTI Act receives Royal Assent
29 April 2024
Product security provisions come into force
6 February 2025
Motor vehicles excluded from scope
Manufacturers must not use universal default passwords. Each device must have a unique password or require the user to set one on first use.
Manufacturers must provide a public point of contact for reporting security vulnerabilities and establish a documented process for handling reports.
Manufacturers must publish the minimum period during which security updates will be provided, stated clearly at the point of sale.
Manufacturers must prepare a statement of compliance. Importers and distributors must verify compliance before making products available on the UK market.
GBP 10M or 4% worldwide revenue
Whichever is greater. The Office for Product Safety and Standards (OPSS) is the enforcement authority with powers to issue compliance notices, recall notices, and financial penalties.
We provide structured preparation and compliance support for UK PSTI Act.
Schedule a consultation with our regulatory experts to assess your UK PSTI Act compliance posture and build a practical roadmap.