GB · PSTI Act 2022; Security Requirements Regulations 2023, SI 2023/1007
Consumer connectable products: baseline security duties
Identify the market and product category first. Each dossier separates legal duties, referenced standards, evidence and the comparison needed for an award.
Product Scope
Relevant consumer products connectable to the internet or a network, with listed exemptions. Check special exclusions for certain NI products, vehicle categories, EV charge points, medical devices, smart meters and specified computers. Wireless and physical safety remain separate obligations.
Requirements
The three baseline requirements address passwords, a published vulnerability-reporting contact/process and transparency about the minimum security-update period. Passwords must meet the Regulations’ uniqueness or user-definition rules and not use prohibited predictable forms. Publishing a support period does not impose a universal statutory minimum number of years.
Required Evidence
Provide the required statement of compliance accompanying the product, password-generation/initialisation evidence, published vulnerability contact and response information, support-period publication and technical records. Check importers’ and distributors’ duties. There is no general mandatory third-party PSTI certification replacing the manufacturer’s duties.
Comparison for the Awards
These are defined compliance duties, not a comprehensive cyber-resilience score. A longer declared update period or a penetration test requires a separate valid comparison basis before being claimed as above regulatory requirements.
Version & Transition
Applies from 29 April 2024. The February 2025 vehicle exemptions and NI exception in the current guidance must be retained; do not treat the regime as identical to EU RED cybersecurity rules.
Official Sources
Applicability depends on the product classification, intended use, configuration and actual sales territory. Manufacturing, placing-on-the-market and testing dates, together with transition provisions, are checked as required by each applicable rule. The directory identifies sources; it does not replace assessment of the specific model. Standards are identified by reference, and their authoritative texts remain with the issuing bodies. Official source documents retain their original language.