[Home](/)/[Resources](/resources)/UK PSTI Cybersecurity PSTI ActCybersecurityIoT # UK PSTI Act: Cybersecurity Requirements for Connected Products and IoT Devices The UK Product Security and Telecommunications Infrastructure (PSTI) Act 2022 makes three minimum cybersecurity requirements mandatory for consumer connectable products in Great Britain from 29 April 2024. Unlike most UK product regulations, PSTI has no CE marking equivalent — it is a UK-specific obligation requiring a separate Statement of Compliance, and OPSS is actively enforcing it. Copy Link[Share on WhatsApp](https://wa.me/?text=https%3A%2F%2Fkrono-labs.com%2Fguides%2Fuk-psti-cyber-requirements) ## In-scope products Wi-Fi enabled products Smart home devices, routers, smart TVs, smart appliances, Wi-Fi cameras, home automation hubs In scope if sold to consumers Bluetooth connected products Smartwatches, fitness trackers, wireless earbuds, smart toys, Bluetooth speakers with companion apps In scope if sold to consumers Cellular connected products Consumer smartphones, tablets, cellular IoT devices, GPS trackers sold consumer-facing In scope; smartphones have specific PSTI considerations Zigbee, Z-Wave, Thread products Smart lighting systems, smart locks, energy monitors, home sensors In scope — any low-power wireless mesh protocol Internet-connected products (wired) Smart TVs with ethernet, network-attached storage (consumer), connected appliances with LAN ports In scope if directly internet-connected and sold to consumers ### Notable exemptions (out of scope): —Medical devices regulated by MHRA —Smart meters meeting smart metering equipment technical specifications —Laptops, desktop computers, and tablets (with specific exclusions) —Products used exclusively in business-to-business contexts —Products that are not consumer-facing (genuine B2B-only products) ## The three mandatory security requirements 01 ### No universal default passwords Every unit must ship with a unique password, or require the user to set a password before the device can be used. The password must not be based on publicly available product information such as MAC address, serial number, or model number. Incrementable passwords (e.g., password01, password02) are not acceptable. How to implement Unique per-unit passwords generated at manufacture; or first-use setup wizard enforcing password creation; or alternative authentication mechanisms (PIN, biometric, certificate-based) 02 ### Vulnerability disclosure policy The manufacturer must provide a way for security researchers to report security vulnerabilities. The disclosure point of contact must be publicly accessible. The manufacturer must define the minimum period for which vulnerabilities will be accepted and acted upon. How to implement Publish a security.txt or vulnerability disclosure policy page accessible from the product's public website. State the minimum disclosure period. Respond to disclosures within a defined timeframe. 03 ### Minimum security update period The manufacturer must state the minimum period for which security updates will be provided and ensure this information is communicated to consumers at point of sale. The period cannot be 'indefinite' without substantiation — a specific timeframe must be given. How to implement State the minimum security update support period in product documentation, on product packaging, and at point of online sale. Align with the product's reasonably expected lifespan. ## Statement of Compliance requirements 01Must be issued before placing the product on the GB market 02Must be accessible to consumers — typically published on the manufacturer's website and/or included with product documentation 03Must state: the product name and model, the minimum support period for security updates, the manufacturer or importer contact for security enquiries 04Does not need to be submitted to any government registry — but must be available for OPSS inspection 05Must be kept up to date if security update commitments change ## Learn this properly, not just for one product In-depth courses and books that teach the process — not a one-off answer you'll need to look up again next time. [Start the course — $149](/courses/18-uk-psti-act-iot-product-security-compliance)See your free roadmap [Prefer to read? Get the book — $24.99](/books/18-uk-psti-act-iot-product-security-compliance) ## Frequently asked questions ### When did PSTI Act requirements come into force? The PSTI Act 2022 came into force on 29 April 2024. All consumer connectable products placed on the GB market on or after that date must comply with the three minimum security requirements and have a valid Statement of Compliance. Products placed on the market before that date are not required to be retrospectively recalled, but any continued supply after that date requires compliance. ### What are the penalties for PSTI non-compliance? OPSS can issue a compliance notice requiring corrective action, a stop notice preventing further supply, and financial penalties. For PSTI non-compliance, financial penalties can reach £10 million or 4% of qualifying worldwide revenue — whichever is higher. OPSS has stated it will prioritise enforcement action against products that are widely sold and present systemic risk. Enforcement actions are published publicly. ### Does PSTI require formal certification or testing by a third party? No. PSTI is a self-declaration regime — manufacturers and importers self-assess against the three minimum requirements and issue their own Statement of Compliance. There is no requirement to use a third-party certification body or to submit documentation to a government database. However, OPSS can require you to demonstrate compliance at any time, and if your Statement of Compliance cannot be substantiated by technical evidence, enforcement action can follow. 🇬🇧 UK roadmap for your product Every standard, document, and test that applies — free, no account required. See your free roadmap[ Want an expert to take your product through 🇬🇧 UK compliance for you? One consultant from Krono's compliance team takes your product from requirements to legal sale, with a fixed quote before any work starts. See compliance services](/services) Learn this properly In-depth course that teaches the full process, not just this one answer. [Start the course — $149](/courses/18-uk-psti-act-iot-product-security-compliance)[Prefer to read? Get the book — $24.99](/books/18-uk-psti-act-iot-product-security-compliance) Related guides * [UKCA Marking for IoT DevicesComplete guide to UKCA marking for IoT and connected devices in Great Britain: Radio Equipment Regulations, EMC requirements, P…](/guides/ukca-iot-devices) * [UKCA Marking for WearablesComplete guide to UKCA marking for wearables and smart accessories in Great Britain: applicable UK regulations, SAR testing for…](/guides/ukca-wearables) * [UK AI and Product RegulationComplete guide to UK AI regulation for product manufacturers: current UK AI governance framework, AI Safety Institute, interact…](/guides/uk-ai-product-regulation) * [UK E-Commerce ComplianceComplete guide to UK e-commerce compliance for product sellers: Amazon UK and eBay marketplace requirements, online retailer en…](/guides/uk-ecommerce-compliance) * [UK OPSS Market SurveillanceComplete guide to OPSS (Office for Product Safety and Standards) market surveillance in Great Britain: enforcement powers, comp…](/guides/uk-opss-market-surveillance) Educational resource only. PSTI Act requirements and enforcement guidance are updated by OPSS. Always verify current requirements on gov.uk before placing connected products on the GB market.