UK PSTI Act Compliance

Cybersecurity & Data Protection Laws

Product Security and Telecommunications Infrastructure Act 2022

Every Consumer Smart Product Sold in the UK Must Now Meet 3 Mandatory Security Requirements. Can You Prove Compliance Across Your Entire Product Line?

PSTI compliance requires every manufacturer, importer, and distributor of consumer connectable products to ban default passwords, publish vulnerability disclosure policies, and declare security update support periods. Enforcement is live. Fines reach £10 million or 4% of global turnover.

Certivo automates PSTI evidence collection from supplier security attestations to audit-ready Statements of Compliance.

3

Mandatory security requirements for every connectable product

£10M

Maximum penalty or 4% of global turnover (whichever is greater)

10 years

Minimum record retention period for compliance documentation

Regulation Overview

• Jurisdiction: United Kingdom
• Regulatory Body: Office for Product Safety and Standards (OPSS), under Department for Business and Trade
• Regulation Number: Product Security and Telecommunications Infrastructure Act 2022 + 2023 Regulations (SI 2023/1007)
• Effective Date: April 29, 2024 (full enforcement live)
• Official Source: UK Product Security and Telecommunications Infrastructure Official Source
• Key Threshold: All consumer connectable products sold in the UK market

What is the UK PSTI Act?

The UK PSTI Act is the world's first national legislation mandating minimum cybersecurity requirements for consumer connectable products. For supply chain and product compliance teams, the Act requires documented evidence that every internet-connectable and network-connectable product meets three baseline security requirements before it can be sold in the UK.

The three mandatory requirements align with the first three provisions of the ETSI EN 303 645 standard: ban on universal default passwords, a published vulnerability disclosure policy, and transparency on security update support periods. Manufacturers must issue a Statement of Compliance (SoC) for every product. Importers and distributors must verify the SoC accompanies each product before making it available.

PSTI compliance requires security evidence from every component supplier whose software or firmware is embedded in a connectable product. When products span multiple tiers of supply, tracing compliance back to each contributor becomes a supply chain data challenge.

Key Components / Sub-Frameworks

• Obligation: Three mandatory requirements: passwords, vulnerability disclosure, update transparency
• Schedule 1: Security requirements for manufacturers
• Obligation: Compliance with ETSI EN 303 645 provisions 5.1-1, 5.1-2, 5.2-1, 5.3-13 satisfies requirements
• Schedule 2: Deemed compliance conditions
• Obligation: Must accompany every product; retained for 10 years by manufacturers and importers
• Statement of Compliance (SoC): Self-declaration document
• Obligation: Compliance Notices, Stop Notices, Recall Notices, Monetary Penalties
• OPSS Enforcement: Market surveillance and penalties
• Obligation: Medical devices, smart meters, EV charge points, automotive vehicles, computers without cellular
• Excepted Products: Products exempt from PSTI scope
• Obligation: Motor vehicles and associated systems formally exempted; deemed compliance conditions refined
• 2025 Regulations Amendment: Updated deemed compliance and exemptions

OPSS Is Actively Enforcing PSTI—With Powers to Issue £10M Fines, Stop Notices, and Public Disclosure of Non-Compliance.

The PSTI Act has been fully enforceable since April 29, 2024. OPSS can issue Compliance Notices, Stop Notices, Recall Notices, and Monetary Penalties up to £10 million or 4% of global turnover—plus daily penalties of £20,000 for ongoing violations. Products already in distribution channels must also comply. Non-compliance is a criminal offence.

Key Compliance Requirements

Who Must Comply

• Manufacturers of consumer connectable products sold in the UK
• Importers placing connectable products on the UK market
• Distributors making connectable products available in the UK
• Non-UK manufacturers selling through UK importers or authorized representatives
• Companies embedding third-party software or firmware in connectable products
• Retailers selling internet-connectable or network-connectable consumer products

Key Thresholds

All consumer connectable products

Internet-connectable or network-connectable products not specifically exempted

£10M or 4% global turnover

Maximum monetary penalty for non-compliance (whichever is greater)

£20,000/day

Daily penalty for ongoing violations following enforcement notice

10 years

Minimum retention period for Statement of Compliance and compliance records

Core Obligations

1. Password Security
   Ban universal default passwords; each device requires unique password or user-defined password
   DEADLINE: From April 29, 2024 (live)

2. Vulnerability Disclosure Policy
   Publish accessible mechanism for external vulnerability reporting
   DEADLINE: From April 29, 2024 (live)

3. Security Update Transparency
   Declare minimum support period for security updates in clear, consumer-accessible language
   DEADLINE: From April 29, 2024 (live)

4. Statement of Compliance
   Prepare SoC and ensure it accompanies every product sold
   DEADLINE: From April 29, 2024 (live)

5. Record Retention
   Manufacturers and importers must retain SoC and investigation records
   DEADLINE: Minimum 10 years from date product is made available

PSTI-Specific Pain Points

The Default Password Discovery Problem

Your product portfolio spans 150 SKUs from 30 suppliers. OPSS requires proof that no product ships with a universal default password. Three suppliers use shared firmware with factory-set credentials. Two cannot confirm whether passwords are unique per device. Without component-level security attestations, you cannot verify compliance across your full range.

The Statement of Compliance Gap

Every connectable product needs a Statement of Compliance before it reaches consumers. The SoC must reference specific security requirements, include manufacturer details, and accompany the product. You have 80 product families, each with multiple firmware versions. Generating and managing SoCs at scale—while keeping them current with each update—overwhelms manual tracking.

The Supply Chain Blind Spot

PSTI holds you responsible for security requirements even when third-party firmware is embedded in your product. Your Tier 2 supplier provides a Wi-Fi module with its own software stack. Does it support vulnerability reporting? What is its security update commitment? Without structured supplier cybersecurity evidence, you inherit risk you cannot quantify.

The Multi-Market Compliance Collision

Your products ship to the UK and the EU. PSTI requires three security requirements now. The EU Cyber Resilience Act requires 21 essential requirements by December 2027. Both reference ETSI EN 303 645, but with different scopes and obligations. Managing parallel evidence streams across jurisdictions without a centralized compliance platform creates duplication, confusion, and gaps.

Certivo in Action

Certivo in Action—PSTI Workflow

GET EVIDENCE IN

Collect Security Attestations and Firmware Evidence from Every Supplier—Without the Chasing

CORA launches targeted campaigns to collect supplier cybersecurity declarations, password security confirmations, vulnerability disclosure evidence, and update commitments automatically.

• Launch PSTI compliance campaigns to hundreds of suppliers with one click
• CORA-powered outreach in suppliers' native languages
• Accept any format: PDFs, security questionnaires, ETSI self-assessments, freeform responses
• Track response rates and escalate non-responders automatically

MAKE SENSE OF IT

Know Instantly Which Products Meet All Three PSTI Security Requirements—and Which Don't

CORA parses supplier attestations, validates security evidence against PSTI's three mandatory requirements, and flags non-conformities automatically.

• CORA extracts password policies, vulnerability disclosure mechanisms, and update periods from declarations
• Automatic validation against PSTI Schedule 1 requirements and ETSI EN 303 645 deemed compliance conditions
• Real-time alerts when supplier evidence gaps or non-conformities are detected
• Product-level compliance status dashboard with per-requirement breakdown

⚠️

PROVE COMPLIANCE OUT

Generate Statements of Compliance and Audit Packages in Hours, Not Weeks

Produce PSTI-ready Statements of Compliance, customer-facing security documentation, and OPSS-ready evidence packages instantly from validated supplier data.

• One-click Statement of Compliance generation per product or product family
• Pre-formatted evidence packages for OPSS enforcement inquiries
• Customer-specific PSTI compliance documentation with full traceability
• Complete audit trail for every validation, supplier response, and compliance decision

One Supplier Submission. Validation Against All 3 PSTI Requirements. Statements of Compliance in Hours.

Certivo collects supplier cybersecurity evidence, extracts security attributes from any document format, validates against PSTI's mandatory requirements and ETSI EN 303 645 deemed compliance conditions, and generates audit-ready Statements of Compliance automatically. When OPSS updates enforcement guidance or new requirements are introduced, Certivo reassesses your portfolio—before enforcement notices arrive.

Features Tabs

Declaration Collection

Certivo's automated campaigns achieve 95% response rates vs. 20-30% with manual outreach.

• Targeted campaigns by product line, supplier tier, or component type
• Multi-language outreach in suppliers' native languages
• Intelligent follow-up sequences adapting to supplier behavior
• Format-agnostic: PDFs, ETSI self-assessments, security questionnaires, freeform responses

Security Evidence Extraction

Every supplier attestation parsed to requirement level automatically—no manual data entry.

• Deep extraction of password policies, vulnerability disclosure mechanisms, and update commitments
• Parses ETSI EN 303 645 test reports, ISO/IEC 29147 documentation, and proprietary formats
• Multi-language document processing across global supplier base
• Anomaly detection for incomplete, contradictory, or outdated security declarations

Requirement Monitoring

Always validated against current PSTI requirements—not your last compliance audit.

• Automatic sync with OPSS guidance updates and regulatory amendments
• Validation against both PSTI Schedule 1 and Schedule 2 deemed compliance conditions
• Proactive alerts when regulatory changes affect your product portfolio
• Historical tracking of compliance status changes per product and supplier

Statement of Compliance

Generate Statements of Compliance in hours instead of weeks of manual compilation.

• One-click SoC generation with full product and manufacturer details per Schedule 4
• Supplier evidence chain with complete traceability per component
• Batch generation across product families and firmware versions
• Response tracking and 10-year retention management for OPSS compliance

Multi-Market Compliance

One supplier submission validates against PSTI and EU CRA simultaneously—no duplicate campaigns.

• Parallel validation against UK PSTI, EU CRA, and ETSI EN 303 645
• Jurisdiction-specific documentation packages from shared evidence base
• Gap analysis identifying where PSTI compliance covers CRA requirements and where gaps remain
• Roadmap support as UK government expands PSTI to cover additional ETSI provisions

Related Regulations

• EU Cyber Resilience Act (CRA): CRA mandates 21 essential requirements for products with digital elements; PSTI covers 3 baseline requirements
  Combined Value: Single supplier evidence collection satisfies both UK and EU cybersecurity frameworks

• ETSI EN 303 645: Global IoT security standard; PSTI's three requirements derived from its first three provisions
  Combined Value: Deemed compliance pathway mapped automatically; full standard validation available

• EU Radio Equipment Directive (RED): RED delegated acts impose cybersecurity requirements on wireless products; PSTI covers same device categories in UK
  Combined Value: Unified evidence base for UK and EU connected product market access

• CE / UKCA Marking: PSTI Statement of Compliance parallels CE/UKCA conformity declarations
  Combined Value: Integrated compliance documentation across product safety and cybersecurity

• CMMC 2.0 (US): US defense contractor cybersecurity maturity; overlapping supply chain security evidence
  Combined Value: Multi-framework validation from one supplier submission

• NIS2 Directive (EU): NIS2 covers organizational cybersecurity; CRA/PSTI cover product-level security
  Combined Value: Supplier evidence supports both product and entity-level cybersecurity compliance

Managing PSTI alongside related cybersecurity regulations eliminates duplicate supplier requests. Certivo validates one submission against multiple frameworks.

Industries Most Impacted

Electronics Manufacturing
Your Pain Point
Broad IoT product portfolios; embedded firmware from multiple suppliers; rapid product cycles


Consumer Goods
Your Pain Point
Smart home devices, wearables, connected toys; high SKU counts; consumer-facing update obligations


Industrial & Heavy Equipment
Your Pain Point
Connected sensors and controllers sold to UK consumers; legacy firmware challenges


Automotive Manufacturing
Your Pain Point
Connected vehicle accessories and aftermarket devices in scope (vehicles themselves exempted)


Medical Devices & Equipment
Your Pain Point
Medical devices exempted but connected wellness/health consumer products in scope


Semiconductor & High-Tech
Your Pain Point
Chips and modules with embedded firmware used in downstream connectable products


Aerospace & Defense
Your Pain Point
Connected consumer-facing products and accessories; dual-use components


Energy & Infrastructure
Your Pain Point
Smart meters exempted but connected energy management products in scope

Return on Investment

80%

Reduction in Compliance Labor

From Manual Evidence Chasing to Automated Attestation Management

CORA collects and validates supplier cybersecurity evidence automatically. Your team focuses on non-conformity resolution—not chasing security questionnaires and compiling Statements of Compliance manually.

4 hours

To Statement of Compliance

SoC Generation Acceleration

Generate complete, audit-ready Statements of Compliance in hours—not the weeks of manual compilation across suppliers, firmware versions, and product families.

Real-Time

Continuous Audit-Ready Documentation

Proactive PSTI Compliance Assurance

When OPSS updates guidance or the UK government expands PSTI requirements, Certivo reassesses your portfolio and flags gaps instantly. Stay enforcement-ready without quarterly scrambles.

Key Statistics

• 3: PSTI security requirements validated per product with automatic regulatory sync
• 99.2%: Security evidence extraction accuracy from supplier declarations
• 95%: Supplier response rate with CORA-powered campaigns

Frequently Asked Questions

What products and companies are subject to UK PSTI obligations?

Any manufacturer, importer, or distributor of consumer connectable products sold in the UK market must comply. This includes all internet-connectable and network-connectable products—smartphones, smart home devices, wearables, connected appliances, routers, and IoT products. Medical devices, smart meters, EV charge points, automotive vehicles, and computers without cellular connectivity are currently exempted.

What are the penalties for PSTI non-compliance?

OPSS can issue Compliance Notices, Stop Notices requiring products to be pulled from sale, Recall Notices, and Monetary Penalties up to £10 million or 4% of qualifying global turnover—whichever is greater. Daily penalties of up to £20,000 apply for ongoing violations. OPSS can also publicly disclose non-compliance. Failure to comply with an enforcement notice is a criminal offence.

How does Certivo manage PSTI Statements of Compliance at scale?

CORA collects supplier security attestations, validates evidence against all three PSTI requirements, and generates Statements of Compliance per product, product family, or firmware version. Certivo manages 10-year retention obligations, tracks SoC currency across product updates, and produces OPSS-ready evidence packages on demand—reducing generation time from weeks to hours.

What declaration formats does Certivo accept from suppliers?

Certivo accepts any format: PDF security attestations, ETSI EN 303 645 test reports, ISO/IEC 29147 documentation, Excel questionnaires, and freeform responses. CORA extracts security evidence regardless of format or language, eliminating the need to standardize supplier inputs across your global supply chain.

How does PSTI compliance relate to the EU Cyber Resilience Act and ETSI EN 303 645?

PSTI's three requirements are derived from ETSI EN 303 645 provisions 5.1-1, 5.1-2, 5.2-1, and 5.3-13. The EU CRA mandates 21 broader requirements by December 2027. Certivo validates one supplier submission against PSTI, CRA, and the full ETSI standard simultaneously—identifying where PSTI compliance satisfies CRA requirements and where additional evidence is needed, eliminating duplicate collection campaigns.