UK Product Security and Telecommunications Infrastructure Act (PSTI)
The UK's consumer connectable product security regime: Part 1 of the Product Security and Telecommunications Infrastructure Act 2022 and SI 2023/1007, in force 29 April 2024, as amended in 2025. Three security requirements for manufacturers: no universal default or guessable passwords, a published point of contact for security issues with acknowledgement and update timelines, and a published defined support period for security updates that is never shortened. Deemed compliance through ETSI EN 303 645 V2.1.1 provisions, ISO/IEC 29147 paragraphs, or (from 4 December 2025) Japan JC-STAR STAR-1 or Singapore Cybersecurity Labelling Scheme labels. Statements of compliance accompany products and are kept 10 years; manufacturers, importers and distributors must investigate, remedy, stop supply and notify the enforcement authority of compliance failures and keep records. Excepted: computers, medical devices, charge points, smart meters and (from February 2025) vehicles. Penalties up to GBP 10 million or 4 percent of worldwide revenue.
UK Product Security and Telecommunications Infrastructure Act (PSTI) is a compliance framework from United Kingdom with 4 domains and 22 controls. The largest domains are Importer duties – UK Product Security and Telecommunications Infrastructure Act (PSTI) (7 controls), Manufacturer and authorised representative duties – UK Product Security and Telecommunications Infrastructure Act (PSTI) (6 controls), Distributor duties – UK Product Security and Telecommunications Infrastructure Act (PSTI) (5 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (4)
Distributor duties – UK Product Security and Telecommunications Infrastructure Act (PSTI)
| Code | Title |
|---|---|
| uk-product-security-and-telecommunications-infrastructure-act-psti::D.21 | Distributor duty to comply with security requirements |
| uk-product-security-and-telecommunications-infrastructure-act-psti::D.22 | Distributor statement of compliance check |
| uk-product-security-and-telecommunications-infrastructure-act-psti::D.23 | No supply where the manufacturer has failed |
| uk-product-security-and-telecommunications-infrastructure-act-psti::D.24 | Distributor action on its own failures |
| uk-product-security-and-telecommunications-infrastructure-act-psti::D.25 | Distributor action on manufacturer failures |
Importer duties – UK Product Security and Telecommunications Infrastructure Act (PSTI)
Manufacturer and authorised representative duties – UK Product Security and Telecommunications Infrastructure Act (PSTI)
| Code | Title |
|---|---|
| uk-product-security-and-telecommunications-infrastructure-act-psti::AR.13 | Authorised representative escalation |
| uk-product-security-and-telecommunications-infrastructure-act-psti::M.10 | Investigating potential compliance failures |
| uk-product-security-and-telecommunications-infrastructure-act-psti::M.11 | Acting on and notifying compliance failures |
| uk-product-security-and-telecommunications-infrastructure-act-psti::M.12 | Records of investigations and failures |
| uk-product-security-and-telecommunications-infrastructure-act-psti::M.8 | Duty to comply with security requirements |
| uk-product-security-and-telecommunications-infrastructure-act-psti::M.9 | Statement of compliance and its retention |
Security requirements (Schedule 1) and deemed compliance – UK Product Security and Telecommunications Infrastructure Act (PSTI)
| Code | Title |
|---|---|
| uk-product-security-and-telecommunications-infrastructure-act-psti::R.1 | No universal default passwords |
| uk-product-security-and-telecommunications-infrastructure-act-psti::R.2 | Published point of contact for security issues |
| uk-product-security-and-telecommunications-infrastructure-act-psti::R.3 | Published defined support period |
| uk-product-security-and-telecommunications-infrastructure-act-psti::R.D | Deemed compliance routes |
What is UK Product Security and Telecommunications Infrastructure Act (PSTI) and who does it apply to?
UK Product Security and Telecommunications Infrastructure Act (PSTI) is a compliance framework from United Kingdom with 4 domains and 22 controls. The UK's consumer connectable product security regime: Part 1 of the Product Security and Telecommunications Infrastructure Act 2022 and SI 2023/1007, in force 29 April 2024, as amended in 2025. Three security requirements for manufacturers: no universal default or guessable passwords, a published point of contact for security issues with acknowledgement and update timelines, and a published defined support period for security updates that is never shortened. Deemed compliance through ETSI EN 303 645 V2.1.1 provisions, ISO/IEC 29147 paragraphs, or (from 4 December 2025) Japan JC-STAR STAR-1 or Singapore Cybersecurity Labelling Scheme labels. Statements of compliance accompany products and are kept 10 years; manufacturers, importers and distributors must investigate, remedy, stop supply and notify the enforcement authority of compliance failures and keep records. Excepted: computers, medical devices, charge points, smart meters and (from February 2025) vehicles. Penalties up to GBP 10 million or 4 percent of worldwide revenue. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does UK Product Security and Telecommunications Infrastructure Act (PSTI) actually require?
UK Product Security and Telecommunications Infrastructure Act (PSTI) has 22 controls organised across 4 domains. The largest domains are Importer duties – UK Product Security and Telecommunications Infrastructure Act (PSTI) (7 controls), Manufacturer and authorised representative duties – UK Product Security and Telecommunications Infrastructure Act (PSTI) (6 controls), Distributor duties – UK Product Security and Telecommunications Infrastructure Act (PSTI) (5 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of UK Product Security and Telecommunications Infrastructure Act (PSTI) do I already cover?
UK Product Security and Telecommunications Infrastructure Act (PSTI) does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement UK Product Security and Telecommunications Infrastructure Act (PSTI)?
Start your UK Product Security and Telecommunications Infrastructure Act (PSTI) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about UK Product Security and Telecommunications Infrastructure Act (PSTI) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 22 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.
Get Started Free →Free forever, no credit card required