# UK PSTI Act Compliance Cybersecurity & Data Protection Laws ###### Product Security and Telecommunications Infrastructure Act 2022 ## Every Consumer Smart Product Sold in the UK Must Now Meet 3 Mandatory Security Requirements. Can You Prove Compliance Across Your Entire Product Line? PSTI compliance requires every manufacturer, importer, and distributor of consumer connectable products to ban default passwords, publish vulnerability disclosure policies, and declare security update support periods. Enforcement is live. Fines reach £10 million or 4% of global turnover. Certivo automates PSTI evidence collection from supplier security attestations to audit-ready Statements of Compliance. 3 Mandatory security requirements for every connectable product £10M Maximum penalty or 4% of global turnover (whichever is greater) 10 years Minimum record retention period for compliance documentation ## Regulation Overview - **Jurisdiction:** United Kingdom - **Regulatory Body:** Office for Product Safety and Standards (OPSS), under Department for Business and Trade - **Regulation Number:** Product Security and Telecommunications Infrastructure Act 2022 + 2023 Regulations (SI 2023/1007) - **Effective Date:** April 29, 2024 (full enforcement live) - **Official Source:** [UK Product Security and Telecommunications Infrastructure Official Source](https://www.gov.uk/government/publications/the-uk-product-security-and-telecommunications-infrastructure-product-security-regime) - **Key Threshold:** All consumer connectable products sold in the UK market # What is the UK PSTI Act? The UK PSTI Act is the world's first national legislation mandating minimum cybersecurity requirements for consumer connectable products. For supply chain and product compliance teams, the Act requires documented evidence that every internet-connectable and network-connectable product meets three baseline security requirements before it can be sold in the UK. The three mandatory requirements align with the first three provisions of the ETSI EN 303 645 standard: ban on universal default passwords, a published vulnerability disclosure policy, and transparency on security update support periods. Manufacturers must issue a Statement of Compliance (SoC) for every product. Importers and distributors must verify the SoC accompanies each product before making it available. PSTI compliance requires security evidence from every component supplier whose software or firmware is embedded in a connectable product. When products span multiple tiers of supply, tracing compliance back to each contributor becomes a supply chain data challenge. ## Key Components / Sub-Frameworks - **Obligation:** Three mandatory requirements: passwords, vulnerability disclosure, update transparency - **Schedule 1:** Security requirements for manufacturers - **Obligation:** Compliance with ETSI EN 303 645 provisions 5.1-1, 5.1-2, 5.2-1, 5.3-13 satisfies requirements - **Schedule 2:** Deemed compliance conditions - **Obligation:** Must accompany every product; retained for 10 years by manufacturers and importers - **Statement of Compliance (SoC):** Self-declaration document - **Obligation:** Compliance Notices, Stop Notices, Recall Notices, Monetary Penalties - **OPSS Enforcement:** Market surveillance and penalties - **Obligation:** Medical devices, smart meters, EV charge points, automotive vehicles, computers without cellular - **Excepted Products:** Products exempt from PSTI scope - **Obligation:** Motor vehicles and associated systems formally exempted; deemed compliance conditions refined - **2025 Regulations Amendment:** Updated deemed compliance and exemptions ## OPSS Is Actively Enforcing PSTI—With Powers to Issue £10M Fines, Stop Notices, and Public Disclosure of Non-Compliance. The PSTI Act has been fully enforceable since April 29, 2024. OPSS can issue Compliance Notices, Stop Notices, Recall Notices, and Monetary Penalties up to £10 million or 4% of global turnover—plus daily penalties of £20,000 for ongoing violations. Products already in distribution channels must also comply. Non-compliance is a criminal offence. ## Key Compliance Requirements # Who Must Comply - Manufacturers of consumer connectable products sold in the UK - Importers placing connectable products on the UK market - Distributors making connectable products available in the UK - Non-UK manufacturers selling through UK importers or authorized representatives - Companies embedding third-party software or firmware in connectable products - Retailers selling internet-connectable or network-connectable consumer products # Key Thresholds #### All consumer connectable products Internet-connectable or network-connectable products not specifically exempted #### £10M or 4% global turnover Maximum monetary penalty for non-compliance (whichever is greater) #### £20,000/day Daily penalty for ongoing violations following enforcement notice #### 10 years Minimum retention period for Statement of Compliance and compliance records ## Core Obligations 1. **Password Security** `Ban universal default passwords; each device requires unique password or user-defined password` **DEADLINE:** From April 29, 2024 (live) 2. **Vulnerability Disclosure Policy** `Publish accessible mechanism for external vulnerability reporting` **DEADLINE:** From April 29, 2024 (live) 3. **Security Update Transparency** `Declare minimum support period for security updates in clear, consumer-accessible language` **DEADLINE:** From April 29, 2024 (live) 4. **Statement of Compliance** `Prepare SoC and ensure it accompanies every product sold` **DEADLINE:** From April 29, 2024 (live) 5. **Record Retention** `Manufacturers and importers must retain SoC and investigation records` **DEADLINE:** Minimum 10 years from date product is made available ## PSTI-Specific Pain Points ###### The Default Password Discovery Problem Your product portfolio spans 150 SKUs from 30 suppliers. OPSS requires proof that no product ships with a universal default password. Three suppliers use shared firmware with factory-set credentials. Two cannot confirm whether passwords are unique per device. Without component-level security attestations, you cannot verify compliance across your full range. ###### The Statement of Compliance Gap Every connectable product needs a Statement of Compliance before it reaches consumers. The SoC must reference specific security requirements, include manufacturer details, and accompany the product. You have 80 product families, each with multiple firmware versions. Generating and managing SoCs at scale—while keeping them current with each update—overwhelms manual tracking. ###### The Supply Chain Blind Spot PSTI holds you responsible for security requirements even when third-party firmware is embedded in your product. Your Tier 2 supplier provides a Wi-Fi module with its own software stack. Does it support vulnerability reporting? What is its security update commitment? Without structured supplier cybersecurity evidence, you inherit risk you cannot quantify. ###### The Multi-Market Compliance Collision Your products ship to the UK and the EU. PSTI requires three security requirements now. The EU Cyber Resilience Act requires 21 essential requirements by December 2027. Both reference ETSI EN 303 645, but with different scopes and obligations. Managing parallel evidence streams across jurisdictions without a centralized compliance platform creates duplication, confusion, and gaps. ## Certivo in Action ### Certivo in Action—PSTI Workflow GET EVIDENCE IN Collect Security Attestations and Firmware Evidence from Every Supplier—Without the Chasing CORA launches targeted campaigns to collect supplier cybersecurity declarations, password security confirmations, vulnerability disclosure evidence, and update commitments automatically. - Launch PSTI compliance campaigns to hundreds of suppliers with one click - CORA-powered outreach in suppliers' native languages - Accept any format: PDFs, security questionnaires, ETSI self-assessments, freeform responses - Track response rates and escalate non-responders automatically MAKE SENSE OF IT Know Instantly Which Products Meet All Three PSTI Security Requirements—and Which Don't CORA parses supplier attestations, validates security evidence against PSTI's three mandatory requirements, and flags non-conformities automatically. - CORA extracts password policies, vulnerability disclosure mechanisms, and update periods from declarations - Automatic validation against PSTI Schedule 1 requirements and ETSI EN 303 645 deemed compliance conditions - Real-time alerts when supplier evidence gaps or non-conformities are detected - Product-level compliance status dashboard with per-requirement breakdown ⚠️ PROVE COMPLIANCE OUT Generate Statements of Compliance and Audit Packages in Hours, Not Weeks Produce PSTI-ready Statements of Compliance, customer-facing security documentation, and OPSS-ready evidence packages instantly from validated supplier data. - One-click Statement of Compliance generation per product or product family - Pre-formatted evidence packages for OPSS enforcement inquiries - Customer-specific PSTI compliance documentation with full traceability - Complete audit trail for every validation, supplier response, and compliance decision ## One Supplier Submission. Validation Against All 3 PSTI Requirements. Statements of Compliance in Hours. Certivo collects supplier cybersecurity evidence, extracts security attributes from any document format, validates against PSTI's mandatory requirements and ETSI EN 303 645 deemed compliance conditions, and generates audit-ready Statements of Compliance automatically. When OPSS updates enforcement guidance or new requirements are introduced, Certivo reassesses your portfolio—before enforcement notices arrive. ## Features Tabs ### Declaration Collection Certivo's automated campaigns achieve 95% response rates vs. 20-30% with manual outreach. - Targeted campaigns by product line, supplier tier, or component type - Multi-language outreach in suppliers' native languages - Intelligent follow-up sequences adapting to supplier behavior - Format-agnostic: PDFs, ETSI self-assessments, security questionnaires, freeform responses ### Security Evidence Extraction Every supplier attestation parsed to requirement level automatically—no manual data entry. - Deep extraction of password policies, vulnerability disclosure mechanisms, and update commitments - Parses ETSI EN 303 645 test reports, ISO/IEC 29147 documentation, and proprietary formats - Multi-language document processing across global supplier base - Anomaly detection for incomplete, contradictory, or outdated security declarations ### Requirement Monitoring Always validated against current PSTI requirements—not your last compliance audit. - Automatic sync with OPSS guidance updates and regulatory amendments - Validation against both PSTI Schedule 1 and Schedule 2 deemed compliance conditions - Proactive alerts when regulatory changes affect your product portfolio - Historical tracking of compliance status changes per product and supplier ### Statement of Compliance Generate Statements of Compliance in hours instead of weeks of manual compilation. - One-click SoC generation with full product and manufacturer details per Schedule 4 - Supplier evidence chain with complete traceability per component - Batch generation across product families and firmware versions - Response tracking and 10-year retention management for OPSS compliance ### Multi-Market Compliance One supplier submission validates against PSTI and EU CRA simultaneously—no duplicate campaigns. - Parallel validation against UK PSTI, EU CRA, and ETSI EN 303 645 - Jurisdiction-specific documentation packages from shared evidence base - Gap analysis identifying where PSTI compliance covers CRA requirements and where gaps remain - Roadmap support as UK government expands PSTI to cover additional ETSI provisions ## Related Regulations - **EU Cyber Resilience Act (CRA):** CRA mandates 21 essential requirements for products with digital elements; PSTI covers 3 baseline requirements Combined Value: Single supplier evidence collection satisfies both UK and EU cybersecurity frameworks - **ETSI EN 303 645:** Global IoT security standard; PSTI's three requirements derived from its first three provisions Combined Value: Deemed compliance pathway mapped automatically; full standard validation available - **EU Radio Equipment Directive (RED):** RED delegated acts impose cybersecurity requirements on wireless products; PSTI covers same device categories in UK Combined Value: Unified evidence base for UK and EU connected product market access - **CE / UKCA Marking:** PSTI Statement of Compliance parallels CE/UKCA conformity declarations Combined Value: Integrated compliance documentation across product safety and cybersecurity - **CMMC 2.0 (US):** US defense contractor cybersecurity maturity; overlapping supply chain security evidence Combined Value: Multi-framework validation from one supplier submission - **NIS2 Directive (EU):** NIS2 covers organizational cybersecurity; CRA/PSTI cover product-level security Combined Value: Supplier evidence supports both product and entity-level cybersecurity compliance ## Managing PSTI alongside related cybersecurity regulations eliminates duplicate supplier requests. Certivo validates one submission against multiple frameworks. ### Industries Most Impacted \ \ **Electronics Manufacturing** Your Pain Point Broad IoT product portfolios; embedded firmware from multiple suppliers; rapid product cycles \ \ **Consumer Goods** Your Pain Point Smart home devices, wearables, connected toys; high SKU counts; consumer-facing update obligations \ \ **Industrial & Heavy Equipment** Your Pain Point Connected sensors and controllers sold to UK consumers; legacy firmware challenges \ \ **Automotive Manufacturing** Your Pain Point Connected vehicle accessories and aftermarket devices in scope (vehicles themselves exempted) \ \ **Medical Devices & Equipment** Your Pain Point Medical devices exempted but connected wellness/health consumer products in scope \ \ **Semiconductor & High-Tech** Your Pain Point Chips and modules with embedded firmware used in downstream connectable products \ \ **Aerospace & Defense** Your Pain Point Connected consumer-facing products and accessories; dual-use components \ \ **Energy & Infrastructure** Your Pain Point Smart meters exempted but connected energy management products in scope ## Return on Investment ##### 80% ###### Reduction in Compliance Labor ###### From Manual Evidence Chasing to Automated Attestation Management CORA collects and validates supplier cybersecurity evidence automatically. Your team focuses on non-conformity resolution—not chasing security questionnaires and compiling Statements of Compliance manually. ##### 4 hours ###### To Statement of Compliance ###### SoC Generation Acceleration Generate complete, audit-ready Statements of Compliance in hours—not the weeks of manual compilation across suppliers, firmware versions, and product families. ##### Real-Time ###### Continuous Audit-Ready Documentation ###### Proactive PSTI Compliance Assurance When OPSS updates guidance or the UK government expands PSTI requirements, Certivo reassesses your portfolio and flags gaps instantly. Stay enforcement-ready without quarterly scrambles. ## Key Statistics - **3:** PSTI security requirements validated per product with automatic regulatory sync - **99.2%:** Security evidence extraction accuracy from supplier declarations - **95%:** Supplier response rate with CORA-powered campaigns ## Frequently Asked Questions ### What products and companies are subject to UK PSTI obligations? Any manufacturer, importer, or distributor of consumer connectable products sold in the UK market must comply. This includes all internet-connectable and network-connectable products—smartphones, smart home devices, wearables, connected appliances, routers, and IoT products. Medical devices, smart meters, EV charge points, automotive vehicles, and computers without cellular connectivity are currently exempted. ### What are the penalties for PSTI non-compliance? OPSS can issue Compliance Notices, Stop Notices requiring products to be pulled from sale, Recall Notices, and Monetary Penalties up to £10 million or 4% of qualifying global turnover—whichever is greater. Daily penalties of up to £20,000 apply for ongoing violations. OPSS can also publicly disclose non-compliance. Failure to comply with an enforcement notice is a criminal offence. ### How does Certivo manage PSTI Statements of Compliance at scale? CORA collects supplier security attestations, validates evidence against all three PSTI requirements, and generates Statements of Compliance per product, product family, or firmware version. Certivo manages 10-year retention obligations, tracks SoC currency across product updates, and produces OPSS-ready evidence packages on demand—reducing generation time from weeks to hours. ### What declaration formats does Certivo accept from suppliers? Certivo accepts any format: PDF security attestations, ETSI EN 303 645 test reports, ISO/IEC 29147 documentation, Excel questionnaires, and freeform responses. CORA extracts security evidence regardless of format or language, eliminating the need to standardize supplier inputs across your global supply chain. ### How does PSTI compliance relate to the EU Cyber Resilience Act and ETSI EN 303 645? PSTI's three requirements are derived from ETSI EN 303 645 provisions 5.1-1, 5.1-2, 5.2-1, and 5.3-13. The EU CRA mandates 21 broader requirements by December 2027. Certivo validates one supplier submission against PSTI, CRA, and the full ETSI standard simultaneously—identifying where PSTI compliance satisfies CRA requirements and where additional evidence is needed, eliminating duplicate collection campaigns.