[Home](/)/[Resources](/resources)/UK PSTI Act UKCybersecurity # UK PSTI Act: Mandatory Security Requirements for Consumer Connectable Products The UK moved faster than most expected. Since April 2024, consumer connected products sold in Great Britain must meet three baseline security requirements — and the penalties for non-compliance are serious. This guide covers exactly what's required, who it applies to, and how to document compliance before your next shipment. Copy Link[Share on WhatsApp](https://wa.me/?text=https%3A%2F%2Fkrono-labs.com%2Fguides%2Fuk-psti-act-connected-products) At a glance Law PSTI Act 2022 / CPR 2023 In force April 29 2024 Enforcer OPSS Penalty Up to £10M or 4% global revenue ## What PSTI requires of manufacturers and importers ### The three mandatory security requirements PSTI imposes three baseline obligations. First: no universal default passwords — each device must ship with a unique default password or must require the user to set a password at first use. Second: a published vulnerability disclosure policy — manufacturers must make it clear how security researchers and users can report vulnerabilities, and what the company will do with those reports. Third: minimum support period transparency — manufacturers must state, before point of sale, the minimum period for which security updates will be provided. ### Which products are in scope PSTI covers consumer connectable products: any product that is connected to the internet or to a network and that is primarily intended for consumer use. This includes smart speakers, smart TVs, smartphones, home Wi-Fi routers, connected toys, smart home appliances, wearables, and IoT appliances. The key test is whether the product's primary intended users are consumers and whether it connects to the internet or another network. ### Excluded products Several product categories are explicitly out of scope. Medical devices regulated by the MHRA are excluded. Smart metering equipment covered by separate energy regulation is excluded. Desktop and laptop computers and tablets without a SIM card are excluded. Electric vehicles and their charging infrastructure are excluded. Products intended solely for industrial, defence, or national security use are also excluded from the regime. ### Supply chain obligations PSTI obligations fall on manufacturers, importers, and distributors in the UK supply chain. UK importers who import from non-UK-established manufacturers are treated as the manufacturer and bear full compliance responsibility. Distributors must check that products they stock have a valid Statement of Compliance before making them available. Retailers are therefore in scope and cannot simply rely on the manufacturer's word — they need to see documentation. ## How to comply with the PSTI Connectable Products Regulations 01 Confirm your product is a consumer connectable product — verify that it connects to the internet or another network and that it is primarily intended for consumer or household use, not for professional, industrial, or enterprise-only deployment. 02 Implement unique default passwords in firmware — review the firmware build process to ensure no product ships with a shared or universal default password; passwords like 'admin', '1234', or any string common across multiple units are non-compliant and must be replaced with per-device unique values or a mandatory first-use setup flow. 03 Publish a vulnerability disclosure policy — the policy must include at minimum a contact point for security researchers to report vulnerabilities, the type of information that should be included in a report, the expected response timeline, and a statement of intent about what the company will do with valid reports; it must be publicly accessible. 04 Determine the minimum support period and publish it before sale — the statement must specify either a defined end date or the minimum duration in years for which security updates will be provided; this information must be accessible to consumers before purchase, such as on the product listing page, packaging, or accompanying documentation. 05 Prepare a Statement of Compliance for each compliant product and provide it to distributors — the Statement must confirm that the product meets the three security requirements; UK distributors and retailers are required by PSTI to verify Statements of Compliance before stocking products. ## Frequently asked questions ### Does the PSTI Act apply to products already on the UK market before April 2024? The PSTI Connectable Products Regulations came into force on April 29, 2024. Products that were already placed on the UK market before that date and remain in the distribution channel are not retroactively required to comply. However, any new units of the same product model placed on the UK market on or after that date must meet the requirements. Manufacturers should ensure their production and import processes are updated even for existing product lines. ### What is a 'universal default password' and how must it be changed? A universal default password is any default password that is the same across multiple devices of the same model or product range. Common examples include 'admin', 'password', '1234', or any factory-set credential shared across units. To comply, manufacturers must either generate a unique password per unit (for example, derived from a device serial number or random seed and printed on the device) or require the user to set a new password during a mandatory first-use setup process before the device can be used. ### How does PSTI interact with the EU Cyber Resilience Act? PSTI and the EU CRA are separate legal frameworks with overlapping intent but different scope and requirements. PSTI applies only in Great Britain (not Northern Ireland), covers only consumer connectable products, and imposes three specific baseline requirements. The EU CRA covers a broader range of products with digital elements, imposes more extensive requirements (SBOM, vulnerability reporting to ENISA, multi-year support), and applies across the EU. Manufacturers selling in both markets must satisfy both independently — there is no mutual recognition arrangement. ### What information must the minimum support period statement include? Under the PSTI Regulations, the minimum security update period statement must include either the specific end date until which security updates will be provided, or the minimum number of years of security updates from the date of purchase. It must also confirm whether the support period applies from the date of purchase or from a fixed date. The statement must be available to consumers before they purchase the product — this means it should appear on the product's retail listing, packaging, or in accessible accompanying documentation, not just in a terms and conditions page. **Disclaimer:** Educational resource only. Regulatory requirements change and vary by product category. Consult an accredited test laboratory or qualified compliance engineer before making certification decisions. 🇬🇧 UK roadmap for your product Every standard, document, and test that applies — free, no account required. See your free roadmap[ Want an expert to take your product through 🇬🇧 UK compliance for you? One consultant from Krono's compliance team takes your product from requirements to legal sale, with a fixed quote before any work starts. See compliance services](/services) Learn this properly In-depth course that teaches the full process, not just this one answer. [Start the course — $149](/courses/09-ukca-marking-for-electronics-products)[Prefer to read? Get the book — $24.99](/books/09-ukca-marking-for-electronics-products) Related guides * [UK UKCA Self-DeclarationUK UKCA self-declaration for low-risk products: which modules allow SDoC, technical file requirements, UK Approved Body involvement, and affixing the UKCA mark.](/guides/uk-ukca-self-declaration-guide) * [UK REACH HSEUK REACH registration with HSE: grandfathered UKREACH registrations, substance evaluation, restriction proposals, and differences from EU REACH post-Brexit.](/guides/uk-reach-hse-registration) * [UK Product Safety & Metrology BillThe UK Product Safety and Metrology Bill (PSMB) updates Great Britain's product safety framework post-GPSR: OPSS enforcement powers, online marketplace duties, and GB designated standards.](/guides/uk-product-safety-metrology-bill) * [EU Cyber Resilience ActEU Cyber Resilience Act for hardware: default-secure requirements, vulnerability disclosure, 24-hour incident notification, and the four Annex I product classes.](/guides/eu-cyber-resilience-act) * [UK Online Safety Act for Connected DevicesHow the Online Safety Act 2023 reaches hardware companies whose products ship with companion apps or cloud services: regulated service classification, illegal content duties, age assurance, and where it stops and PSTI begins.](/guides/uk-online-safety-act-connected-devices)