Journey
PSTI IoT compliance check
Quick compliance check for IoT manufacturers, importers, and distributors. Confirm product scope, verify three mandatory security requirements, identify your supply chain role, and confirm your statement of compliance obligations.
PSTI product security compliance check
The Product Security and Telecommunications Infrastructure Act 2022 (PSTI Act) has applied to consumer connectable products since 29 April 2024. Use this check to confirm your compliance position.
-
Is your product in scope?
The PSTI Act covers consumer connectable products: devices that connect to the internet or a network and are sold to UK consumers. Check whether your product is in scope before proceeding.
- In scope: smart TVs, routers, IoT cameras, smart speakers, wearables, smart home devices, connected toys, connected alarms
- Excluded: medical devices (MDR 2002), smart meters, EV chargepoints, desktop/laptop computers without cellular connectivity
If your product is excluded, PSTI does not apply. If you are unsure, consult OPSS guidance or seek legal advice.
IoT product security compliance (PSTI Act)
Full details of which products are in scope, what is excluded, and how to determine your obligations.
-
Do your products meet the three security requirements?
All in-scope products must meet three baseline requirements before being placed on the UK market.
-
What is your supply chain role?
Your obligations under the PSTI Act depend on your role. Identify which applies to each product you handle.
- Manufacturer: designs or produces products, or markets them under its own name
- Importer: UK-established business placing a non-UK manufacturer's products on the UK market
- Distributor: in the supply chain but neither manufacturer nor importer
You may hold more than one role for different products. Each role carries distinct duties.
Product safety responsibilities across the supply chain
Understand the specific duties that apply to manufacturers, importers, and distributors under UK product safety law.
-
Is your statement of compliance in order?
Manufacturers must produce a statement of compliance for each product. Importers must verify a valid statement exists before placing goods on the UK market.
- Statement must confirm the product meets all three security requirements
- Must be kept for at least 10 years
- Must be provided to OPSS on request
- Must accompany the product (or a link to it)
-
Ongoing duties
Compliance is not one-off. Review your position when products are updated, when new products enter your range, and when OPSS guidance changes.
gov.uk
GOV.UK PSTI product security guidance (opens in a new tab)
Official OPSS guidance on the consumer connectable product security requirements.
Cyber security requirements for UK businesses
Broader cyber security obligations including Cyber Essentials, ICO breach notification, and NIS regulations.