What is the UK PSTI Act?

What is the PSTI Act?

The Product Security and Telecommunications Infrastructure Act 2022 (PSTI) sets security rules, in Part 1, for products that connect to the internet or to a network. The security requirements are in SI 2023/1007, which applies across the United Kingdom and has been in force since 29 April 2024.12

The full title of the Regulations is the Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023. They extend to England and Wales, Scotland and Northern Ireland.2

PSTI is about the security of the product. It does not cover radio spectrum, power limits or operating licenses. For those, see two-way radio licensing and radio regulations by country.

What are the three PSTI security requirements?

Schedule 1 of the Regulations sets three requirements: a unique or user-set password, a published contact for vulnerability reports, and a published support period for security updates. Makers must meet all three, and importers and distributors must meet them too, so every seller in the chain checks the same points.2

The three requirements in plain words:

1. Passwords. A password must be unique per product or set by the user. It may not follow a counter, rest on public information or be an unencrypted serial number. Cryptographic keys, API keys and pairing PINs in non-IP protocols are not counted as passwords for this rule.
2. Reporting vulnerabilities. The maker publishes at least one contact point and says when a reporter gets an acknowledgment and status updates. The contact is free, in English and needs no personal data.
3. Support period. The maker publishes a defined support period with an end date, in English, in plain words and with equal prominence on its own sales page. Cutting a published period short breaks the requirement. Since 25 February 2025 a longer period must be published too.

What is a statement of compliance?

A statement of compliance is a short document that travels with the product. A maker, importer or distributor may not make a relevant product available in the UK without it, or without a summary of it.1 Makers and importers keep a copy for 10 years or the support period, whichever is longer.2

Schedule 4 lists the content: product type or batch, the maker's name and address, a declaration that Schedule 1 was met, the defined support period, the signatory, and place and date.2

Who must comply: makers, importers and distributors?

All three roles carry their own duty. The trigger is that the person intends the product to be a UK consumer connectable product, or ought to be aware that it will be. The table sets out the duty of each role: maker, importer and distributor.1

A UK consumer connectable product is one made available to UK consumers and not supplied before. A model sold to businesses falls in too when identical products are sold to consumers.3 Government guidance says sellers of own-brand products count as makers.4

Which products does PSTI cover and exclude?

A relevant connectable product can connect to the internet, or to a network in the two ways the Act defines. A product that connects over an IP protocol is covered, and so is a product that links to two or more devices at once over a non-IP protocol and to an internet-connectable product.5

Schedule 3 excludes EV charge points, medical devices (with a software exception), smart meter products, desktop and laptop computers and non-cellular tablets (children's products excepted), vehicle types already approved under EU vehicle acts, and certain products supplied in Northern Ireland under Windsor Framework rules.24 Radios have no category of their own.

Which radios does PSTI touch?

The Act tests connectivity. In practice, the table shows how that test fits four common products: an analog PMR446 radio, a Bluetooth walkie-talkie, an LTE PoC radio sold to consumers and a PoC radio sold only to businesses. The wording of the Act decides each case.5

The Bluetooth pairing PIN is not a "password" under requirement 1. Requirements 2 and 3 still apply to a Bluetooth model that is in scope.25

PSTI does not have a mark. The proof is the statement of compliance and the published contact and support period, while UKCA and CE belong to the radio rules covered below.

How are PSTI penalties enforced?

The Secretary of State is the enforcement authority, and gov.uk says the Office for Product Safety and Standards (OPSS) enforces on its behalf.14 A penalty notice can reach the greater of £10 million and 4% of qualifying worldwide revenue, plus up to £20,000 per day after the payment deadline.1

The company gets 28 days to make representations and 28 days to appeal to the First-tier Tribunal. The Act also provides compliance, stop and recall notices.1

What changed in 2025?

Two amending instruments changed the Regulations in 2025. SI 2025/211 deals with extended support periods and vehicle exceptions, and SI 2025/1267 deals with deemed compliance through Japanese and Singaporean labels. The dates in force and the effects are listed below.2

• SI 2025/211, in force 25 February 2025: makers must publish an extended support period, and vehicle types covered by EU vehicle approval acts are excluded.2
• SI 2025/1267, in force 4 December 2025: Japan's JC-STAR STAR-1 labels and Singapore Cybersecurity Labelling Scheme labels count as deemed compliance with the three requirements and the statement duty.2

The Regulations call for a first review report within five years, by 29 April 2029.2

What are UKCA and CE in Great Britain?

PSTI sits next to the product rules for radio equipment, the Radio Equipment Regulations 2017 (SI 2017/1206). In Great Britain, manufacturers may use UKCA, CE or both. Since 1 October 2024, SI 2024/696 has kept CE recognition for radio equipment, and the current guide says the UK "continues to recognise the CE marking".678

A radio that carries CE and meets the GB requirements can therefore be sold in Great Britain, and CE is the mark for the EU and Northern Ireland.

UKCA may sit on a label or on an accompanying document until 31 December 2027.6 A UKCA-only product cannot go to the EU or Northern Ireland. Ofcom handles spectrum matters and Trading Standards handles product safety.6 Marks in other countries are in radio approval marks by country.

What applies in Northern Ireland?

Northern Ireland follows the EU Radio Equipment Directive under the Windsor Framework. Delegated Regulation (EU) 2022/30 added requirements for network protection, privacy and fraud protection for certain radio equipment, and these have applied to the Northern Ireland market since 1 August 2025.9

CE is the mark there, or CE plus UKNI if a UK body assessed the product. Products for this market may not carry UKCA.9

A product made available in Northern Ireland under Annex 2 legislation is excepted from PSTI by Schedule 3. In practice, this means a radio covered by the RED rules there follows the RED cyber requirements instead.2

The EU Cyber Resilience Act applies from 11 December 2027 in the EU. For Northern Ireland, Council Decision (EU) 2025/799 sets the EU position to add it to Annex 2 of the Windsor Framework, and adding it needs a decision of the EU-UK Joint Committee.1011

How does PSTI compare with the EU Cyber Resilience Act?

Both laws make a maker answerable for the security of a connected product. The EU act is wider and longer: it starts later, covers consumer and business products, and adds conformity assessment, CE marking and reporting deadlines. The table compares the two.10

The EU column comes from the Regulation's text and the Commission's guidance.10 The full EU picture is in the Cyber Resilience Act for radios.

What is the PSTI timeline?

The dates below follow the Act, the Regulations and the gov.uk guidance. The main steps are the Regulations in force on 29 April 2024, CE recognition continuing in Great Britain from 1 October 2024, and the 2025 amendments. A first review report of the Regulations is due by 29 April 2029.27

What does PSTI mean for makers, importers, companies and users?

Makers. A connectable model aimed at UK consumers needs the three requirements and a statement of compliance. The LTE PoC models and phone-linked Bluetooth models are the lines to check. Put the vulnerability contact and the support end date on the product page in English. Radio conformity stays with UKCA or CE.

Importers and shops. You carry your own duty. Ask the supplier for the statement of compliance before you list a model. A seller that puts its own name on a white-label radio is the maker in the Act's eyes.4

Companies. A PoC fleet bought for staff is outside PSTI when no identical model is sold to consumers. The three requirements still make a good checklist for buying: a named contact for vulnerabilities and an end date for updates. Radio licenses are in two-way radio licensing.

Consumers. A connectable product's page should show the support end date and a way to report a fault. An analog PMR446 radio is outside PSTI. Marks for other countries are in radio approval marks.

Questions

Sources

1. Product Security and Telecommunications Infrastructure Act 2022, Part 1 · legislation.gov.uk
2. The Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023, SI 2023/1007 · legislation.gov.uk
3. PSTI Act 2022, section 54: UK consumer connectable product · legislation.gov.uk
4. Regulations: consumer connectable product security · GOV.UK, Department for Science, Innovation and Technology
5. PSTI Act 2022, Part 1, sections 4 and 5 · legislation.gov.uk
6. Radio Equipment Regulations 2017: Great Britain · GOV.UK
7. The Product Safety and Metrology etc. (Amendment) Regulations 2024, SI 2024/696 · legislation.gov.uk
8. Placing UKCA or CE marked products on the market in Great Britain · GOV.UK
9. Radio Equipment Regulations 2017: Northern Ireland · GOV.UK
10. Regulation (EU) 2024/2847, Cyber Resilience Act · EUR-Lex