What is PSTI compliance?
The UK consumer connectable product security regime combines Part 1 of the Product Security and Telecommunications Infrastructure Act 2022 with its supporting regulations. It has applied since 29 April 2024. Manufacturers, importers and distributors of relevant products have duties. See OPSS guidance on the regime.
If you supply products such as smart home devices, connected cameras or consumer gateways, begin by checking the exact product and supply route. Rebranding another supplier’s hardware can also affect your role: the name on the product matters, as well as who built it.
Check exclusions before assuming scope. There are exemptions for specific product categories and particular Northern Ireland circumstances. Certain vehicle categories, systems and components were excluded in February 2025. Use the current OPSS scope guidance and vehicle guidance to check your product.
What are the three core PSTI security requirements?
The baseline concerns passwords, vulnerability reporting information and security update information. The detail is in Schedule 1 of the 2023 security requirements regulations.
1. Passwords
Where passwords are used, they must be unique per product or defined by the user. The regulations also restrict how unique passwords can be generated, to prevent easily guessed values.
Engineering check: compare several devices and examine setup, factory reset, local administration and remote management. A secure first-run experience can still leave a shared service credential elsewhere.
2. Information for reporting security issues
Publish a contact for security reports and the timescales for acknowledgement and progress updates. The required information must be accessible, clear and available without requesting personal information.
Engineering check: send a controlled test report through your published route. Confirm that the recipient can identify the affected product, reach an engineering owner and maintain the promised communication.
3. Information on security update periods
Publish the defined support period clearly, including its end date. For online offers, the information must be available alongside the specified product information. PSTI does not set a universal five-year minimum.
Engineering check: make sure product listings, support pages and release ownership agree. Work out how your team will identify affected versions and deliver an update to devices in use.
The Statement of Compliance and supply-chain duties
A Statement of Compliance must accompany an in-scope product. OPSS explains that it can be digital, provided it accompanies the product and meets the legal requirements. Supply-chain duties also include records, investigating potential compliance failures and taking appropriate action. Read the OPSS Statement of Compliance guidance.
Schedule 4 of the 2023 regulations specifies the statement’s contents, including product identification, manufacturer details, the declaration, support period and signatory information. Use that schedule when preparing the document.
For an engineering handover, tie the statement to the exact product variants and supporting records. Make it easy for the person responsible for the declaration to see which device and firmware were examined and what remains unresolved.
A practical PSTI readiness checklist
Use these steps to organise the work before a release or supplier review:
- Confirm scope and roles. Record the product category, target market, branding and supply-chain responsibilities with your compliance lead.
- Review the actual device. Check password behaviour, exposed services and production configuration on representative samples.
- Exercise the reporting process. Confirm that the public contact reaches people who can investigate and respond.
- Check the support commitment. Compare public information with the release plan and the ability to build and deliver fixes.
- Assemble the evidence. Keep product identifiers, test results, outstanding issues and the statement together for review.
These checks help expose gaps between a policy and its implementation. They also give your team a clearer starting point for broader product security work.
How Rootworks can help
Rootworks provides hardware security testing, firmware analysis and assessment of embedded systems and companion applications. We can investigate credential handling, debug access, firmware protection and update behaviour, then provide reproducible findings and practical remediation recommendations.
Tell us which devices you supply, the firmware versions, your target markets and the questions your compliance team needs answered. We can scope the technical assessment around that evidence need.
PSTI compliance questions
Does meeting the PSTI baseline mean the whole product is secure?
The baseline addresses specific requirements. A product may still have weaknesses in its APIs, firmware, update mechanism or hardware interfaces. Build risk-based testing around the complete system.
Is ETSI EN 303 645 the same as PSTI?
ETSI EN 303 645 is a broader consumer IoT security standard. Schedule 2 of the PSTI regulations provides deemed-compliance routes using specified provisions for particular requirements. Check those conditions rather than treating a general standards claim as sufficient.
Does PSTI compliance also cover the EU Cyber Resilience Act?
The regimes have different scopes and obligations. If you also supply the EU market, review the Cyber Resilience Act requirements separately and reuse relevant engineering evidence where appropriate.
Official sources
- OPSS: consumer connectable product security and current exclusions
- 2023 regulations: Schedules 1, 2 and 4 (as made)
- PSTI Act 2022
Technical guidance, not legal advice. Confirm legal scope and obligations with your compliance or legal adviser. Requirements and guidance can change; check the linked official sources for updates.