UK Product Security and Telecommunications Infrastructure Act (PSTI)
The UK Product Security and Telecommunications Infrastructure Act 2022 (PSTI), with regulations effective April 29, 2024, establishes minimum security requirements for consumer connectable products sold in the UK. It is the first national legislation implementing the ETSI EN 303 645 baseline requirements. Applies to manufacturers, importers, and distributors of internet-connected consumer products.
UK Product Security and Telecommunications Infrastructure Act (PSTI) is a compliance framework from United Kingdom with 9 domains and 35 controls. The largest domains are Security Requirements for Connectable Products (10 controls), Enforcement and Compliance Management (8 controls), Economic Operator Duties (7 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (9)
Default Passwords
| Code | Title |
|---|---|
| UKPSTIACT-1 | Default Password Prohibition |
Distribution and Enforcement
| Code | Title |
|---|---|
| UKPSTIACT-4 | Distributor, Importer, Retailer Duties + Enforcement |
Economic Operator Duties
| Code | Title |
|---|---|
| PSTI-06 | Importer Duties |
| PSTI-07 | Distributor Duties |
| PSTI-15 | Authorised Representative for Non-UK Manufacturers |
| PSTI-16 | Marketplace and Online Listing Compliance |
| PSTI-19 | Supplier and Component Security Assurance |
| PSTI-3.3 | Authorised Representative Designation |
| PSTI-3.4 | Online Marketplace Operator Duties |
Enforcement and Compliance Management
| Code | Title |
|---|---|
| PSTI-09 | Compliance Failure Notification |
| PSTI-17 | Penalty and Enforcement Readiness |
| PSTI-2.1 | Non-Compliance Investigation Cooperation |
| PSTI-2.2 | Compliance Notice Remediation |
| PSTI-2.3 | Stop Notice and Recall Execution |
| PSTI-20 | Periodic Compliance Review and Continuous Improvement |
| PSTI-3.6 | Public Reporting of Compliance Failures |
| PSTI-3.7 | Penalty Awareness and Provisioning |
Scope and Excepted Products
Security Requirements for Connectable Products
| Code | Title |
|---|---|
| PSTI-02 | Prohibition of Universal Default Passwords |
| PSTI-03 | Vulnerability Disclosure Policy |
| PSTI-04 | Defined Support Period (Minimum Security Update Period) |
| PSTI-10 | Secure Software Update Delivery |
| PSTI-11 | Secure Storage of Credentials and Sensitive Data |
| PSTI-12 | Minimisation of Exposed Attack Surfaces |
| PSTI-13 | Resilience to Outages |
| PSTI-14 | Personal Data Protection on Device |
| PSTI-3.5 | Software Update Mechanism Security |
| PSTI-3.8 | Security Requirements Review on Product Change |
Statements of Compliance and Records
Support Period
| Code | Title |
|---|---|
| UKPSTIACT-3 | Defined Support Period and Statement of Compliance |
VDP
| Code | Title |
|---|---|
| UKPSTIACT-2 | Vulnerability Disclosure Policy and Reporting |
What is UK Product Security and Telecommunications Infrastructure Act (PSTI) and who does it apply to?
UK Product Security and Telecommunications Infrastructure Act (PSTI) is a compliance framework from United Kingdom with 9 domains and 35 controls. The UK Product Security and Telecommunications Infrastructure Act 2022 (PSTI), with regulations effective April 29, 2024, establishes minimum security requirements for consumer connectable products sold in the UK. It is the first national legislation implementing the ETSI EN 303 645 baseline requirements. Applies to manufacturers, importers, and distributors of internet-connected consumer products. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does UK Product Security and Telecommunications Infrastructure Act (PSTI) actually require?
UK Product Security and Telecommunications Infrastructure Act (PSTI) has 35 controls organised across 9 domains. The largest domains are Security Requirements for Connectable Products (10 controls), Enforcement and Compliance Management (8 controls), Economic Operator Duties (7 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of UK Product Security and Telecommunications Infrastructure Act (PSTI) do I already cover?
UK Product Security and Telecommunications Infrastructure Act (PSTI) does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement UK Product Security and Telecommunications Infrastructure Act (PSTI)?
Start your UK Product Security and Telecommunications Infrastructure Act (PSTI) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about UK Product Security and Telecommunications Infrastructure Act (PSTI) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 35 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 686 frameworks.
Get Started Free →Free forever — no credit card required