Part 1 Product Security and Telecommunications Infrastructure Act 2022 (“PSTIA“) sets out security requirements for internet connected products (e.g. smart speakers and wearable tech) to help secure them against cyberattacks (e.g. loss of data or cyber fraud). The requirements are set out in the Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023 which come into force on 29 April 2024.

The requirements apply to products, intended for use by consumers, that are either capable of connecting to the internet (internet-connectable products) or that can connect directly or indirectly to an internet-connectable product. They apply to the product’s hardware and associated software (even when not installed on the hardware). Exempted products include computers unless they are designed exclusively for children under 14. The requirements, which are imposed on manufacturers (or their authorised representative), relate to:

• the creation of default passwords (which must be unique for each product (and not easily guessable) or defined by the user);
• providing information to the public on how to report security issues; and
• publishing the minimum length of time (expressed as a period with an end date) for which security updates will be provided.

There are also requirements to rectify and report incidents or non-compliance and to retain documentation. Compliance with parts of the existing European standard ETSI EN303 645 will provide deemed compliance with the security requirements. Further, manufacturers must provide a statement of compliance which should accompany the product.

Under the Act, importers and distributors must not make products available without the statement of compliance, or where they do not conform with the Regulations. Penalties for breach include fines of up to £100m or 4% of a company’s worldwide revenue and a power to order product recalls. The UK Office for Product Safety and Standards is responsible for enforcing the PSTIA.

On 26 January 2024, the Government updated its short Guidance on the Regulations, essentially to ensure that businesses understand the need for compliance by 29 April 2024.

For more information, click here.