PSTI Penalties: What Happens If Your Smart Product Doesn’t Comply

Last reviewed: 5 November 2026. General information, not legal advice.

If a smart product you make, import or sell in the UK misses a PSTI security rule, the government can order you to fix it, stop you selling it, make you recall it and fine you. PSTI is the UK’s security law for consumer smart products, and it has applied since 29 April 2024. The fine can reach £10 million or 4% of your qualifying worldwide revenue, whichever is greater.

As far as we can see, nobody has been publicly fined under PSTI yet. We searched the regulator’s published enforcement lists, which run to 31 March 2026, and found no PSTI action of any kind as of 5 November 2026. The first published cases may still be ahead, so here’s each step before a fine, who it lands on, and what to do this week.

Who enforces PSTI, and how do they start?

The Office for Product Safety and Standards (OPSS) enforces PSTI for the government. It’s the UK regulator that already polices product safety. It acts for the Department for Science, Innovation and Technology, using the Secretary of State’s powers under the Act.

And most cases won’t start with a fine. OPSS says its approach will be “pragmatic and proportionate”, and will “take account of the maturity of the legislation”.

Its enforcement policy lists advice and guidance first. OPSS is “more likely” to stop there when one or more of these is significant:

• the risk is “relatively low”;
• the business has “a good record of compliance”;
• it “has acted in good faith”;
• it has shown “a commitment to appropriate corrective, restorative and/ or remedial actions”.

That’s the good news. The catch is that OPSS can climb the ladder below, using the steps alone or in combination, and its PSTI guidance says it can serve a compliance notice “as an escalating response where advice or guidance have not delivered the required improvements”.

Each enforcement step, and what it makes you do

Here’s each main power, in the order you’d most likely meet it. Each row quotes or applies Part 1 of the Product Security and Telecommunications Infrastructure Act 2022 (the PSTI Act). “A duty” means any of the duties in Chapter 2 of the Act, such as meeting the security requirements or supplying a statement of compliance, the document that says your product meets them.

You can appeal a compliance, stop or recall notice, or a fine, to the First-tier Tribunal within 28 days. While the appeal runs, the notice or fine has “no effect”. If OPSS gives you a stop or recall notice for a breach that didn’t happen, and that wasn’t down to your neglect or default, OPSS is liable to pay you compensation for the loss, in an amount it decides (section 34).

How big can a PSTI fine be?

Big enough to end a small company, at least on paper, because the ceiling doesn’t shrink with your size. The Act sets the ceiling for one breach as the greater of “£10 million” and “4% of the person’s qualifying worldwide revenue for the person’s most recent complete accounting period”. On top, a penalty notice can add a daily penalty of up to £20,000 for each day the breach continues after the payment deadline.

That ceiling isn’t a price list. The fine must be “appropriate” and “proportionate”, and OPSS must weigh the effects of the breach and anything you did to fix it. Its guidance lists what can lower or raise the amount, including “prompt and full disclosure”, “early action to remedy the non-compliance”, your compliance history and “a co-operative approach”.

The fine ceiling at three company sizes

Here’s what the formula gives at three sizes. It shows the ceiling, not a likely fine.

An illustration of sections 38(1) and 36(5) of the PSTI Act, not a prediction. The 4% only overtakes the fixed sum above £250 million of revenue.

The Act doesn’t define “qualifying worldwide revenue” further, and if you disagree with OPSS’s figure, OPSS’s figure wins (section 38(3)).

So for any business with less than £250 million of yearly revenue, the ceiling is £10 million, which for a small maker can be more than a whole year of sales. A business with no accounting period faces the same £10 million ceiling.

Who is on the hook: maker, importer or seller?

Almost everyone in the chain who supplies the product in the UK, each in their own way. The Act calls them “relevant persons”: the manufacturer, the importer and the distributor. Each one can get a compliance notice, a stop notice or a fine for a breach of its own duties.

The security requirements themselves fall on the manufacturer. Regulation 3 of the 2023 Regulations says they “apply to manufacturers”. In our reading, an importer or reseller is exposed mainly through the other duties: checking the statement of compliance, and not selling a product it “knows or believes” fails.

Duties and notices by role

If you resell a supplier’s camera or doorbell, ask for its statement of compliance before you list it. Our guide to the PSTI statement of compliance shows what it must say and how to check one.

What has the regulator done so far?

Less than the size of the fines would suggest, judging by what it has published. OPSS publishes its enforcement actions in six-month lists, and says it adds summary details of enforcement notices, fines and convictions to them. Its PSTI guidance says it publishes details of any compliance, stop or recall notice it serves, and any fine it imposes, in line with that policy.

On 5 November 2026 we read all four lists since PSTI began, covering 1 April 2024 to 31 March 2026. None names the PSTI Act or its Regulations: the actions listed are under product safety, construction products, timber and environmental rules. We also searched OPSS’s product safety alerts, reports and recalls on GOV.UK for the Act’s full name and found none.

Two limits matter:

• actions after 31 March 2026 may not be published yet, because the lists come out in batches;
• cases settled with advice and guidance alone aren’t added to the enforcement lists.

So “no published action” doesn’t mean nobody has heard from OPSS. It means we could find no business publicly named under PSTI, and under that policy, whoever gets the first notice or fine can expect to appear in those lists.

What do UK brands publish today?

The rules OPSS enforces are visible from outside. Anyone, including a regulator, a buyer or a journalist, can look for a maker’s statement of compliance and its published way to report a security flaw. Here’s what we found when we looked.

A missing page on a website doesn’t mean a maker is breaking the law. But it’s the first thing an outsider can check, and the first thing a complaint to OPSS would point to.

What to do this week

The cheapest way out of the ladder is never to step on it. If you make, import or sell connectable products for UK consumers, and they aren’t excepted:

1. Check the three security requirements. No shared or guessable default passwords; a published way to report security flaws, with the times the reporter will hear back; and a published minimum period of security updates, with an end date. Our guide to the PSTI default password rule covers the first one in detail.
2. Make sure a statement of compliance goes with every product, or a label route that replaces it. If you’re the maker or importer, keep a copy for at least 10 years.
3. Write down how you’d handle a report of a failure: who investigates, how you fix it, and how you tell OPSS and your sellers. Prompt disclosure and early action can lower a fine.
4. If a notice of intent arrives, use the window. You have 10 days to answer a proposed compliance, stop or recall notice (unless, for a stop or recall notice, OPSS sees an urgent need), and 28 days for a proposed fine. Get advice, send evidence of what you’ve fixed, and note the 28-day appeal deadline.

Selling in the EU too?

The CRA, the EU’s Cyber Resilience Act, and EN 18031, the EU’s security standards for radio devices, set their own rules and dates. Our comparison of PSTI, the CRA and EN 18031, and which applies to your device and when sets them side by side.

If you’d like an outside check of a product against all three requirements before a buyer or OPSS looks, we do that as a paid readiness review. Email support@securebydesignlabs.com.

For engineers and your legal team

The notices

• Who enforces. Section 26(1): the Secretary of State. GOV.UK’s guidance names OPSS as “the enforcement authority responsible for ensuring compliance with the legislation on behalf of the Department for Science, Innovation and Technology”, and OPSS’s PSTI guidance says its references to OPSS mean “OPSS acting as the Secretary of State”. Investigatory powers come from Schedule 5 to the Consumer Rights Act 2015 (section 26(2)).
• Compliance notice, section 28. Not more than once “in respect of the same act or omission” (s. 28(7)). Notice of intent and representations (s. 28(5)); “may not give a compliance notice … until the end of the period of 10 days” (s. 28(6)).
• Stop notice, section 29. The 10-day wait doesn’t apply “if the Secretary of State considers that there is an urgent need” (s. 29(7)).
• Recall notice, section 30. For a manufacturer’s failure it can go to “any manufacturer”, “an authorised representative” or “any importer or distributor who made any of the products available in the United Kingdom” (s. 30(2)(a)); for an importer’s or distributor’s failure, to “that importer or distributor” (s. 30(2)(b)). The government’s own recall power and cost recovery: section 47.
• Offence, section 32. Failing to comply with “an enforcement notice” (a compliance, stop or recall notice, s. 56) is an offence. Liable “on summary conviction in England and Wales, to a fine”; in Scotland and Northern Ireland “to a fine not exceeding level 5 on the standard scale”. Defence: “all reasonable steps to comply” (s. 32(2)). Directors: section 52.

The fine, appeals and information notices

• Penalty notice, sections 36 to 41. One penalty notice per breach (s. 36(3)); daily penalty “not exceeding £20,000” (s. 36(5)), disregarded for the maximum (s. 36(6)); at least 28 days to pay (s. 36(7)); no prior enforcement notice needed (s. 36(8)). Amount “appropriate” and “proportionate” (s. 37). Maximum: section 38(1); estimated revenue in a first accounting period (s. 38(2)); OPSS’s figure prevails on disagreement (s. 38(3)); periods other than 12 months scaled (s. 38(4)); “If the person does not have an accounting period, the relevant maximum is £10 million” (s. 38(5)). Section 38(6) lets regulations set a group-revenue basis and 38(7) how revenue is determined; we found no regulations under either as of 5 November 2026. Notice of intent and 28 days before a penalty notice (s. 39). In England and Wales and in Northern Ireland, recoverable as if payable under a High Court order (s. 40).
• Appeals. First-tier Tribunal within 28 days (ss. 33(2), 41(2)); the notice is “of no effect until the appeal is determined or withdrawn” (ss. 33(8), 41(8)). Compensation for stop and recall notices wrongly given: section 34, decided within 45 days.
• Information notices. Under Schedule 5 to the Consumer Rights Act 2015, OPSS can require information. OPSS’s guidance says a court penalty for failing one “may not exceed the greater of £30,000 or 1% of the total value of the turnover (if any) of the person” as a fixed amount.

Sections behind the “who” table

• Duties by role. Section 7 defines the relevant persons. Manufacturers: sections 8 to 12. Authorised representatives: sections 13 and 51. Importers: sections 14 to 20. Distributors: sections 21 to 25.
• Security requirements. Sections 14 and 21 say importers and distributors “must comply with any relevant security requirements”; regulation 3 of SI 2023/1007 applies Schedule 1 to manufacturers, which is why we read the security requirements as the manufacturer’s for now.
• Keeping the statement. Importers keep the statement for the longer of 10 years and the defined support period (regulation 9); manufacturers likewise (regulation 8).

Sources and limits

• Legal texts: Part 1 of the PSTI Act 2022 (latest revised version, read 5 November 2026: last modified 8 April 2026, no unapplied amendments listed) and SI 2023/1007 as amended by SIs 2025/211 and 2025/1267.
• OPSS: guidance on enforcement actions under the PSTI Act (dated June 2025, updated on GOV.UK 8 August 2025), the OPSS Enforcement Policy (January 2026), GOV.UK’s consumer connectable product security guidance (updated 17 March 2025) and the OPSS enforcement actions lists, all read on 5 November 2026.
• Published-action check: the four OPSS lists from 1 April 2024 to 31 March 2026, searched for the Act’s name, “PSTI”, “connectable” and related terms; a GOV.UK search of OPSS product safety alerts, reports and recalls for the Act’s full name; and one general web search. All on 5 November 2026.
• The fine table is our arithmetic on section 38, not a forecast. Our website figures are lower bounds; the method and limits are on the linked guide.
• Where we say “in our reading”, that’s our interpretation, not a statement of the law.

Last reviewed 5 November 2026. This is general information, not legal advice.