UK PSTI Act: The Three Security Requirements, the Statement of Compliance, and How Many Device Makers Publish One

Last reviewed: 23 October 2026. General information, not legal advice.

If you make or sell connectable products for UK consumers, each one has had to meet three security requirements since 29 April 2024 and come with a statement of compliance or its summary, unless excepted (see below). On 23 October 2026 we checked the websites of 127 connected-device makers with a UK-facing site. Of the 117 whose result we could determine, 14 (12.0%) publish a PSTI statement of compliance we could find.

In our 21 October 2026 check of the same makers, 51 of the 104 whose result we could determine (49.0%) published a way to report a security flaw.

You are buying a smart plug for an office, or listing a camera on your shop. The law says the product comes with a statement of compliance. Where do you find it?

The regime is Part 1 of the Product Security and Telecommunications Infrastructure Act 2022 (the PSTI Act) and the Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023 (SI 2023/1007), which “come into force on 29th April 2024” (regulation 1(2)). This page sets out what the law asks for, quoted from legislation.gov.uk, and then what makers actually publish.

What are the three PSTI security requirements?

Schedule 1 of SI 2023/1007 sets three requirements for manufacturers of “relevant connectable products”: broadly, products that can connect to the internet or to a network (sections 4 and 5 of the Act), unless an exception applies (see below). They are no universal default passwords, published information on how to report security issues, and published minimum security update periods.

1. Passwords (Schedule 1, paragraph 1). Passwords “must be (a) unique per product; or (b) defined by the user of the product”. Passwords that are unique per product must not be “based on incremental counters”, “based on or derived from publicly available information”, derived from serial numbers or other unique identifiers (unless done “using an encryption method, or keyed hashing algorithm, that is accepted as part of good industry practice”), or “otherwise guessable in a manner unacceptable as part of good industry practice”. The rule covers the product when it is “not in the factory default state” (paragraph 1(1)).

“Passwords” here do not include cryptographic keys, pairing PINs for protocols outside the internet protocol suite, or API keys (paragraph 1(4)).
2. A way to report security issues (Schedule 1, paragraph 2). The manufacturer must publish “at least one point of contact to allow a person (“P”) to report to the manufacturer security issues”, and “when P will receive (i) an acknowledgment of the receipt of a security issues report; and (ii) status updates until the resolution of the reported security issues”. The information must be “accessible, clear and transparent”, available “without prior request”, “in English”, “free of charge” and “without requesting the provision of P’s personal information” (paragraph 2(3)).
3. A minimum security update period (Schedule 1, paragraph 3). “The defined support period must be published.” The regulations define it as “the minimum length of time, expressed as a period of time with an end date, for which security updates will be provided” (regulation 2). It must be understandable “by a reader without prior technical knowledge”.

An extension must be published “as soon as is practicable”, and the requirement is “not met if the defined support period is shortened after the publication” (paragraphs 3(3), 3(4)(e) and 3(6)). Where a manufacturer publishes an invitation to purchase on “its own website or on a non-paid for website under its control”, the period must be published “alongside or otherwise given equal prominence to” the information described in regulation 6(4)(a) of the Consumer Protection from Unfair Trading Regulations 2008 (paragraph 3(5)).

Schedule 2 offers a second way to meet each one, “deemed compliance”: for example, complying with provisions 5.1-1, 5.2-1 or 5.3-13 of ETSI EN 303 645, or, since 4 December 2025, holding an unexpired Japan JC-STAR STAR-1 label or Singapore Cybersecurity Labelling Scheme label (inserted by SI 2025/1267).

What is a PSTI statement of compliance?

A manufacturer “may not make the product available in the United Kingdom unless it is accompanied by (a) a statement of compliance, or (b) a summary of the statement of compliance” in a form set by regulations (section 9(2) of the Act). The statement is a document that “is prepared by or on behalf of the manufacturer” and “states that, in the opinion of the manufacturer, the manufacturer has complied with the applicable security requirements” (section 9(3)).

Schedule 4 of SI 2023/1007 lists what it must include, at a minimum:

• “product (type, batch)”;
• “name and address of each manufacturer of the product and, where applicable, each authorised representative”;
• “a declaration that the statement of compliance is prepared by or on behalf of the manufacturer”;
• “a declaration that, in the opinion of the manufacturer, they have complied with either (i) the applicable security requirements in Schedule 1; or (ii) the deemed compliance conditions in Schedule 2”;
• “the defined support period for the product that was correct when the manufacturer first supplied the product”;
• “signature, name and function of the signatory”; and
• “the place and date of issue of the statement of compliance”.

Where the statement relies on a standard, it must give “the identification number, version and date of issue of the standard” (Schedule 4, paragraph 1(2)). The manufacturer, and the importer, must keep a copy for “a period of 10 years beginning with the date on which the statement of compliance was issued” or the defined support period, whichever is longer (regulations 8 and 9). Since 4 December 2025, a product with an unexpired JC-STAR STAR-1 or Singapore label is treated as meeting the statement requirement (Schedule 2A).

As we read it, the law does not say that the statement has to be on the maker’s website: we found no provision requiring it. The Act lets the Secretary of State make “provision about publishing statements of compliance” (section 9(6)(c)), and SI 2023/1007, as amended, sets retention periods (regulations 8 and 9) rather than a publication rule. In our reading, a statement that accompanies the product in the box or its documentation can meet section 9(2), so a statement missing from a website tells you nothing about compliance on its own. A published one is still useful: it is where a buyer, retailer or distributor checking a product can find it without asking.

Who has PSTI duties: manufacturer, importer or distributor?

Section 7 of the Act defines three “relevant persons”:

• Manufacturer: a person who “manufactures a product, or has a product designed or manufactured, and markets that product under that person’s name or trade mark”, or who “markets a product manufactured by another person” under its own name or trade mark (section 7(3)). A UK brand selling a white-label device under its own name is the manufacturer (section 7(3)(b)).
• Importer: a person who “imports the product from a country outside the United Kingdom into the United Kingdom” and “is not a manufacturer of the product” (section 7(4)).
• Distributor: a person who “makes the product available in the United Kingdom” and “is not a manufacturer or an importer of the product” (section 7(5)).

Each has its own duties. Where they intend, or are or ought to be aware, that the product will be a UK consumer connectable product, importers and distributors must also comply with the security requirements (sections 14 and 21), may not make the product available unless it is accompanied by the statement of compliance or its summary (sections 15(2) and 22(2); where the manufacturer relies on the Schedule 2A labels instead, they must be satisfied those conditions are met, sections 15(5) and 22(3)), and may not supply it if they know or believe there is a compliance failure by the manufacturer (sections 16 and 23). Penalties can reach “the greater of (a) £10 million, and (b) 4% of the person’s qualifying worldwide revenue” (section 38(1)), and a penalty notice can add a daily penalty of up to £20,000 for each day the breach continues after the deadline for paying the fixed penalty (section 36(5)).

What is out of scope of PSTI?

Schedule 3 of SI 2023/1007 lists the excepted products. In summary, with each one’s conditions:

• products made available in Northern Ireland that fall under EU legislation listed in Annex 2 to the Windsor Framework with a free-movement article (paragraph 1);
• electric vehicle charge points covered by the Electric Vehicles (Smart Charge Points) Regulations 2021 (paragraph 2);
• products covered by the Medical Devices Regulations 2002, but “a relevant connectable product on which software to which those Regulations apply is installed or operable is not an excepted product” (paragraph 3);
• smart meter products supplied or installed by or on behalf of a licence holder (under section 7AB of the Gas Act 1986 or section 6 of the Electricity Act 1989) and assured under the National Cyber Security Centre’s commercial product assurance scheme (paragraph 4);
• desktop and laptop computers, and tablets that cannot connect to cellular networks, unless designed exclusively for children under 14 (paragraph 5);
• in Great Britain, since 25 February 2025, vehicles under the EU type-approval regulations for motor vehicles, two- or three-wheel vehicles and quadricycles, and agricultural and forestry vehicles (paragraphs 6 to 8, inserted by SI 2025/211).

Check each product against its exception: a company can sell excepted and in-scope products side by side.

What do UK connected-device makers actually publish?

We checked two groups of makers, selected differently, so we report them separately and never add them together.

• Explorer makers with a UK-facing site: the makers behind the companion apps in our connected-device readiness explorer whose website showed a UK signal on 23 October 2026 (the explorer itself still shows our 5 October 2026 run, which scored 534 apps with an earlier version of the route check, so its figures differ). That is 127 makers, of which we could determine the statement result for 117.
• UK brands from our importer research: UK brands and importers we listed from UK retailers’ smart-home categories and importer searches in October 2026, where the homepage mentions connected products. That is 69 makers, 64 of them determinable.

Source: SecureByDesignLabs check of makers’ websites, 23 October 2026; Explorer makers’ reporting routes from our 21 October 2026 check. Each figure counts makers (one website each). Rates are over makers whose result we could determine; “could not determine” is left out of both sides, never counted as “no”. Every “found” figure is a lower bound.

• A statement online is the exception. About 1 in 8 Explorer makers with a UK-facing site (12.0%), and about 1 in 6 of the UK brands (17.2%), publish a statement we could find. Counting any PSTI-specific page, it is 18.8% and 29.7%.
• A reporting route is far more common than a statement. Around half of each group publishes a route (49.0% and 43.3%), against 12.0% and 17.2% for a statement. Many makers publish a route to report a vulnerability but put no statement on their website. (Our route check finds a contact or reporting page; it does not check the acknowledgement and status-update timings Schedule 1 also asks for.)
• Recognised brands do better than the long tail. Among recognised device brands in the Explorer group (makers on a list of device brands we chose as sold in Europe; the rest, the long tail, came from category searches on the UK Google Play store), 10 of 67 publish a statement (14.9%) and 39 of 61 a route (63.9%). In the long tail, 4 of 50 (8.0%) and 12 of 43 (27.9%).
• Where there is a statement, there is usually a route. 9 of the 12 Explorer makers with a statement and a determinable route have a route (75.0%).

Where do makers publish theirs?

Some examples, as published on 23 October 2026:

• TP-Link publishes a PSTI statement of compliance on its UK site, which also says “Users can report vulnerabilities to TP-Link via” its security advisory page, so the statement and the Schedule 1 reporting route sit on one page.
• Hive: its UK PSTI statement of compliance, a PDF on a file host, names the manufacturer, Centrica Hive Limited, and its address, lists its products with model identifiers, and states that security updates will be provided “until 1st April 2028”.
• Sonos publishes a statement of compliance page with a table of each product’s launch date and security update period, and a “Statement of Compliance” entry for each product listed.
• Versuni publishes a PSTI compliance statement, issued by DAP B.V., which “hereby declares that the connectable products of Versuni Netherlands B.V. and its affiliates comply with the applicable security requirements in Schedule 1”. Its compliance page lists it separately from its Australia and New Zealand statement.

Each is headed as a PSTI statement or statement of compliance and names the maker. TP-Link’s, Sonos’s and Versuni’s are on the makers’ own domains; Hive’s is a PDF on a file host. We describe what each page contains; we have not assessed whether any of them meets Schedule 4.

How does PSTI sit beside the EU Cyber Resilience Act?

A product sold in both the UK and the EU answers to both regimes, and they differ in timing and paperwork.

• Timing. PSTI has applied since 29 April 2024. Under the EU’s Cyber Resilience Act (CRA), manufacturers must report actively exploited vulnerabilities from 11 September 2026, including for products already on the market (Articles 14 and 69(3) of Regulation (EU) 2024/2847); most other obligations apply from 11 December 2027 (Article 71(2)).
• Reporting route. Both ask for one. The CRA requires “a contact address for the reporting of the vulnerabilities discovered in the product with digital elements” (Annex I, Part II, point 6), for products placed on the market from 11 December 2027.
• Paperwork. PSTI’s statement of compliance is a UK document with the Schedule 4 contents above. Under the CRA, once compliance has been demonstrated by the conformity assessment procedure, manufacturers “draw up the EU declaration of conformity in accordance with Article 28 and affix the CE marking” (Article 13(12)). As we read them, neither regime treats the other’s document as a substitute.

For a UK company selling software or apps into the EU, our guide to the Cyber Resilience Act and UK companies covers which CRA duties apply.

What should you do next?

If you make, import or sell connectable products in the UK:

1. List your products against Schedule 3 and note which are excepted and why.
2. Check the three requirements per product: passwords, a published reporting route with acknowledgement and status-update timings, and a published support period with an end date.
3. Check the statement of compliance against Schedule 4, item by item, including the signatory’s name and function and the place and date of issue.
4. Publish the statement and the route where a buyer will look: a page on your UK site called “PSTI statement of compliance”, linked from the footer, with each product identified by model. We found no publication rule for the statement in SI 2023/1007, but a published statement lets a buyer check your product without asking.

If you are an importer or distributor, ask your suppliers for the statement before you list a product: sections 15 and 22 make its absence your problem too (unless the product relies on a Schedule 2A label, in which case check the label).

Method

• What we checked. For each maker’s website we looked for a PSTI statement of compliance in the places a visitor would: the homepage and UK homepage links, the sitemap, common PSTI page addresses, the site’s own search, and documents linked from any PSTI page.
• What counts as a statement. A document that names the UK regime (PSTI, the PSTI Act or Regulations, or SI 2023/1007), is titled as a statement or declaration of compliance or conformity, and declares compliance. Statements for other countries, such as Australia’s, which uses similar wording, do not count. A PSTI page without a declaration (often a reporting-route or support-period page) counts as “another PSTI page”.
• Reporting route. A security.txt file with a contact, or a page telling a reporter where to send a vulnerability, on the maker’s website or the domain of its published contact address. For Explorer makers it comes from our 21 October 2026 check, the same run as our connected-device data, combined into one result per website (a maker with several apps has a route if any of them does). For the UK brands it is the same check, run on 23 October 2026.
• Who is in each group. Explorer makers: the 505 websites behind the 550 connected-device companion apps with a website in the population our Explorer draws on (the 5 October 2026 snapshot; the explorer page counts makers differently, so its totals differ). A maker is “UK-facing” if its site showed at least one of: a .uk domain, an en-GB language or alternate tag, a UK locale link, a price in pounds, or a UK trader address on its Google Play listing. That gives 139; we left out 12 whose apps are all in Google Play’s Medical category, because Schedule 3 excepts most medical devices. UK brands: 173 websites from our October 2026 UK importer research; we kept the 69 whose homepage we could read and that mention connected products, and left out 20 websites that do not exist. Seven websites are in both groups.
• Dates. Statements and UK signals checked on 23 October 2026 (00:40 to 03:10 UTC). Explorer reporting routes from 21 October 2026.
• Not determined. A site that refused our requests, timed out, failed its TLS check or could not be rendered is “could not determine”, never “no”: 10 Explorer makers and 5 UK brands for the statement, 23 and 9 for the route. Our 23 October requests identified themselves as SecureByDesignLabs, except that JavaScript-only pages were opened in a headless Chromium browser with its default User-Agent; the 21 October route check used a standard desktop-browser User-Agent string.
• Checks by hand. On 23 October 2026 we checked 23 results by hand: 7 statements found (all confirmed), 3 “PSTI page, no statement” (2 confirmed; for one, our check probably missed the statement), 12 “none found” picked at random, and 1 known publisher from our importer research. For 1 of the 12 random makers, and for the known publisher, a statement exists on the maker’s site that our check missed. Treat “none found” as “we could not find one”, not “there is none”.
• The limits that matter most. Every “found” figure is a lower bound. A statement can come in the box or the app, sit on a retailer’s or parent company’s site, or on a product page we did not reach. Some UK sellers show none of our UK signals (for example, sites that redirect by country) and are not in the Explorer group. Neither group is a census of the UK market.

Nothing here says any company is in breach of anything. The figures describe what is published on makers’ websites today.

Last reviewed 23 October 2026. Quotations are from the Product Security and Telecommunications Infrastructure Act 2022, Part 1, and SI 2023/1007 as amended by SI 2025/211 and SI 2025/1267, from legislation.gov.uk (revised versions, fetched 23 October 2026), and from Regulation (EU) 2024/2847 as published in the Official Journal. This is engineering research, not legal advice, and not a conformity assessment.