UK PSTI Act Guide: Security Requirements for Connectable Products

Since 29 April 2024 it has been illegal to make most consumer connectable products available in the UK with universal default passwords, without a published way to report vulnerabilities, or without a stated minimum security update period. Those three requirements come from Part 1 of the Product Security and Telecommunications Infrastructure Act 2022 and the Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023. They bind manufacturers, importers and distributors, including online sellers, and are enforced by the Office for Product Safety and Standards (OPSS) with penalties of up to £10 million or 4% of worldwide revenue. This guide covers scope and exceptions, each requirement in detail, the 2025 amendments, enforcement, how the rules touch device identity and AI-enabled products, and a step-by-step compliance plan. It is for product security teams, firmware and cloud engineers, compliance leads and executives selling connected products into Great Britain or Northern Ireland. Status was checked on legislation.gov.uk and gov.uk in October 2026.

Key takeaways

• Three requirements, all in force. No universal default passwords, a published vulnerability reporting route with response timescales, and a published minimum security update period, all from 29 April 2024.
• The whole supply chain is liable. Manufacturers, importers and distributors each have duties, and no product may be made available without a statement of compliance.
• ETSI EN 303 645 is the shortcut. Meeting named ETSI EN 303 645 provisions (5.1-1, 5.1-2, 5.2-1, 5.3-13), or ISO/IEC 29147 clauses for disclosure, gives deemed compliance.
• The rules have moved since 2024. Vehicles were excepted from 25 February 2025, and from 4 December 2025 Japan JC-STAR STAR-1 and Singapore Cybersecurity Labelling Scheme labels count towards deemed compliance.
• Penalties are serious. OPSS can issue compliance, stop and recall notices, and monetary penalties up to the greater of £10 million or 4% of qualifying worldwide revenue, plus up to £20,000 per day.

Scope: who and what is covered

The regime applies to relevant connectable products: internet-connectable or network-connectable products that are not excepted. In practice that means consumer smart TVs, smart speakers, cameras, doorbells, routers, wearables, smart home hubs, connected toys, smartphones and similar devices, wherever they are made, once they are made available to UK customers.

Who has duties

Excepted products (Schedule 3 to the 2023 Regulations)

Note what is in scope: a cellular tablet, a laptop designed for young children, a smart plug, a baby monitor and a home router are all covered. Industrial and enterprise products sold to consumers can also fall in scope, so classify by how the product is made available, not by marketing category.

Key obligations

1. Passwords (Schedule 1, paragraph 1)

• Rule: where a product uses passwords when not in its factory default state, each password must be unique per product or defined by the user.
• Unique passwords must not be based on incremental counters, public information or unique product identifiers such as serial numbers (unless derived with an encryption method or keyed hashing algorithm accepted as good industry practice), or otherwise be guessable in a manner below good industry practice.
• Not treated as passwords: cryptographic keys, certain pairing PINs for non-IP protocols, and API keys.
• Factory default state: the state after factory reset or after final production or assembly, so a device that forces the user to set a password at first use complies.

2. Information on reporting security issues (paragraph 2)

• Contact point: publish at least one point of contact for reporting security issues with the product's hardware and software.
• Timescales: publish when the reporter will receive an acknowledgement and status updates until the issue is resolved. The law sets no fixed number of days; the manufacturer sets and must keep to its own.
• Accessibility: accessible, clear and transparent, available without prior request, in English, free of charge, and without requiring personal information from the reader.

3. Minimum security update period (paragraph 3)

• Publish the defined support period, the minimum length of time security updates will be provided, in a form understandable without technical knowledge.
• Extensions must be published as soon as practicable; shortening a published period breaches the requirement.
• Point of sale: where the manufacturer's own website carries an invitation to purchase with price information, the support period information must appear alongside it or with equal prominence.

Schedule 1 also sets out how the reporting and update period requirements apply to smartphones and cellular tablets; check that text if you sell them.

Statement of compliance

The manufacturer must produce a statement of compliance containing the information in Schedule 4 to the Regulations, and the product must be accompanied by it. Importers and distributors must not make a product available without one, and manufacturers and importers must retain a copy (Regulations 8 and 9). Government guidance confirms a digital statement is permitted, though the Act does not define "accompany".

Deemed compliance

The ETSI EN 303 645 Consumer IoT Guide covers the full standard; PSTI only mandates three of its thirteen provision groups. For disclosure process design see the Bug Bounty and Vulnerability Disclosure Guide.

Timeline and current status

The Regulations include a review provision (regulation 10), and the Secretary of State can add requirements by further regulations, so expect the regime to grow. Part 2 of the Act deals with telecoms infrastructure (the Electronic Communications Code) and is outside this guide.

Enforcement and penalties

• Regulator: OPSS, part of the Department for Business and Trade, enforces under a memorandum of understanding with DSIT, using a risk-based and proportionate approach.
• Notices: compliance notices (s.28), stop notices (s.29) and recall notices (s.30); failing to comply with an enforcement notice is an offence (s.32).
• Monetary penalties: sections 36 to 41. The maximum is the greater of £10 million or 4% of qualifying worldwide revenue for the most recent complete accounting period (s.38), plus a daily penalty of up to £20,000 (s.36(5)).
• Forfeiture: non-compliant products can be forfeited (s.42).
• Marketplaces and resellers: a distributor that keeps selling after learning of a manufacturer's compliance failure breaches its own duty.

What it means for AI agents and non-human identities

Every connected product is an identity: it authenticates to a cloud service, receives updates and often exposes local administration. PSTI is not a device identity law, but its password rule pushes manufacturers away from shared secrets, and its exclusions show where the gaps are. Cryptographic keys and API keys are explicitly not "passwords", so a fleet sharing one embedded API key or one TLS private key is not caught by paragraph 1, yet it carries the same risk as a universal default password.

• Per-device credentials: issue unique device certificates or keys at manufacture, ideally in secure hardware, and never derive them from serial numbers. See the Device and IoT Identity Guide.
• Embedded cloud and AI service keys: do not ship vendor API keys in firmware or apps; broker calls through a backend that authenticates the device. The Rabbit R1 hard-coded API keys case, where keys for text-to-speech, speech and mapping services sat in the AI device maker's leaked backend code, shows how one exposed set of service keys affects every device that relies on it.
• AI-enabled products: voice assistants, AI cameras and companion devices are relevant connectable products like any other. The support period you publish must cover the model and agent software that receives security updates, not just the firmware.
• Agents that manage devices: where an AI agent or automation platform administers home or fleet devices, give it its own scoped identity rather than reusing device or admin passwords. See the Identity for IoT Fleets Guide.

The HPE Aruba Instant On hard-coded credentials case (CVE-2025-37103) illustrates the failure PSTI's password rule targets: a built-in administrator login, identical across devices and not changeable by owners, gave admin access to anyone who learned it. Those access points are aimed at small businesses, so the case is illustrative rather than a PSTI enforcement matter, but the design flaw is the same, and ATT&CK tracks its abuse as T1078.001 Default Accounts and T1110.001 Password Guessing.

Compliance steps

1. Classify the portfolio. List every product made available in the UK, decide whether it is connectable and whether any Schedule 3 exception applies, and record the reasoning.
2. Fix credentials in engineering. Remove universal defaults; choose user-defined passwords at first setup or unique per-device passwords generated randomly or with a keyed derivation. Test that factory reset returns to a compliant state.
3. Publish the disclosure policy. Stand up a security contact (web form or email, optionally security.txt), state acknowledgement and update timescales you can meet, and staff the triage process.
4. Set and publish the support period. Agree an end date per product with product, legal and finance, show it on product pages next to prices, and plan update capacity to honour it.
5. Produce statements of compliance. Use the Schedule 4 content, decide the format (paper or digital), and give importers and distributors what they need. Record any reliance on ETSI EN 303 645, ISO/IEC 29147 or foreign labels.
6. Brief the channel. Importers and retailers must check statements; agree how they will receive them and how you will notify them of compliance failures.
7. Build the failure process. Define how a reported issue becomes a compliance investigation, when OPSS and the channel are notified, and how records are kept.
8. Audit annually. Sample products off the shelf, verify passwords, links and support periods still match, and test the disclosure contact end to end.

Small versus large organisations: a small brand importing white-label devices still carries manufacturer duties if it puts its name on the product, so it must obtain evidence from the original maker. Large manufacturers should embed the three requirements in secure development gates and use ETSI EN 303 645 assessment to cover the wider baseline that the EU Cyber Resilience Act will also expect.

Measuring progress

• Percentage of in-scope products with a current statement of compliance on file.
• Number of products shipping any shared or derivable default password (target zero).
• Percentage of disclosure reports acknowledged within the published timescale.
• Percentage of product pages showing the support period alongside the price.
• Number of products within six months of support end date without an extension decision.

Framework mapping

Common failure patterns

• Serial-derived passwords. A "unique" password computed from the MAC address or serial number without a keyed algorithm is non-compliant and trivially reproduced.
• A support period that cannot be found. Buried in a PDF or missing from the product page next to the price.
• A disclosure address nobody reads. Published timescales are missed, which breaches the manufacturer's own stated commitments.
• Retailers without statements. Distributors sell stock with no statement of compliance and inherit liability.
• Assuming excepted status. Treating a cellular tablet or a children's laptop as an excepted computer.
• Shared keys in place of passwords. Removing default passwords but shipping one embedded API key or certificate across the fleet, which PSTI does not catch and attackers still exploit.

Practitioner checklist

• Inventory UK-available products and document scope and exception decisions.
• Remove universal default passwords; test factory reset behaviour.
• Publish a security contact with acknowledgement and update timescales you can meet.
• Publish a defined support period per product next to the price.
• Issue Schedule 4 statements of compliance and share them with importers and distributors.
• Record deemed compliance evidence (ETSI EN 303 645, ISO/IEC 29147, JC-STAR or Singapore CLS).
• Issue unique per-device credentials and keep third-party API keys out of firmware.
• Define a compliance failure process with OPSS and channel notification.
• Audit products, links and disclosure handling at least annually.

Standards and references

• legislation.gov.uk: Product Security and Telecommunications Infrastructure Act 2022, Part 1
• legislation.gov.uk: PSTI (Security Requirements for Relevant Connectable Products) Regulations 2023
• legislation.gov.uk: Regulations 2023, Schedule 1 security requirements
• legislation.gov.uk: Regulations 2023, Schedule 2 deemed compliance
• legislation.gov.uk: Regulations 2023, Schedule 3 excepted products
• GOV.UK: The UK PSTI product security regime
• legislation.gov.uk: PSTI Act 2022, section 38 relevant maximum

This guide summarises Part 1 of the Product Security and Telecommunications Infrastructure Act 2022 and its 2023 Regulations and is not legal advice. Related NHI Mgmt Group resources: IoT Security Guide · Device and IoT Identity Guide · Bug Bounty and Vulnerability Disclosure Guide · EU Cyber Resilience Act Guide · Embedded Device Security Guide