United Kingdom · Electronics

UK PSTI Connectable Product Security

A practical guide to UK PSTI Connectable Product Security for electronics sold in the United Kingdom: who it applies to, what to prepare, and the mistakes that cause rejection.

Who needs it

Connectable products such as smart devices, routers, and connected cameras; Manufacturers, importers, and distributors selling to UK consumers

Authority

UK Office for Product Safety and Standards (OPSS)

Legal basis

Product Security and Telecommunications Infrastructure Act 2022

Local representative

A UK responsible person must be named for compliance

Timeline

Before the product is sold to UK consumers

Cost

Mostly engineering and documentation effort rather than fees

If you do not comply

Recall, fines, and enforcement action

Who needs this

Connectable products such as smart devices, routers, and connected cameras
Manufacturers, importers, and distributors selling to UK consumers

Documents you need

Statement of compliance
Security requirements assessment
Vulnerability disclosure policy
Security update support period statement

Compliance checklist

Tick each item as you collect it. Saved in this browser only.

Statement of compliance
Security requirements assessment
Vulnerability disclosure policy
Security update support period statement

How to comply

Confirm the product is a connectable product in scope
Meet the minimum security requirements
Publish a vulnerability disclosure policy and support period
Keep the statement of compliance for inspection

Brief for your lab or agent

Copy this into an email, then edit the product and channel.

Request: UK PSTI Connectable Product Security — United Kingdom
Product category: Electronics
Authority: UK Office for Product Safety and Standards (OPSS)
Legal basis: Product Security and Telecommunications Infrastructure Act 2022

Documents we already have:
  1. Statement of compliance
  2. Security requirements assessment
  3. Vulnerability disclosure policy
  4. Security update support period statement

Questions:
  1. Does our product fall under UK PSTI Connectable Product Security in the United Kingdom?
  2. Which test standards or evidence do you accept?
  3. What is the current fee and lead time?
  4. Is a local representative required, and can you act as one?

Cost and timeline

Before the product is sold to UK consumers.

Mostly engineering and documentation effort rather than fees.

Common rejection reasons

No published support period
Default universal passwords left enabled
Vulnerability disclosure contact missing

Registration, notification, or certification is not the same as approval. Keep the technical file current and make sure the label, listing, and submitted data match.