PSTI IoT compliance check
- 2 steps
UK Act of Parliament
2022
United Kingdom
Product Security and Telecommunications Infrastructure Act 2022
At a glance
Who this Act binds
Business-side actors with duties under this Act, ranked by how often they appear.
- Manufacturer 18
- Trader 9
- Distributor 5
- Any Person 3
- Employer 1
- Director or Officer 1
Plus 1 non-business duty on Crown ministers, regulators, local authorities or tribunals — shown collapsed under each section below.
Step-by-step journeys using this legislation
Walkthroughs that take you from a real business situation to compliance.
Relevant guidance
Practical guides for businesses affected by this Act, ordered by how closely they engage with it.
Direct — cites this Act
1 guidesOther Acts binding the same actors
For each actor bound by this Act, the other UK Acts that bind them most often. Useful for understanding the full compliance landscape facing each role.
Manufacturers also bound by 472 other Acts (top 5 shown)
- Pressure Equipment (Safety) Regulations 2016 2016 91 duties
- Lifts Regulations 2016 2016 70 duties
- The Ecodesign for Energy-Related Products and Energy Information Regulations 2021 2021 70 duties
- Non-Automatic Weighing Instruments Regulations 2016 2016 67 duties
- Pyrotechnic Articles (Safety) Regulations 2015 2015 64 duties
Traders also bound by 826 other Acts (top 5 shown)
- Value Added Tax Regulations 1995 1995 413 duties
- Companies Act 2006 2006 243 duties
- The Large and Medium-sized Companies and Groups (Accounts and Reports) Regulations 2008 2008 114 duties
- Insolvency (England and Wales) Rules 2016 2016 62 duties
- Building Societies Act 1986 1986 56 duties
Distributors also bound by 177 other Acts (top 5 shown)
- The Marketing of Fruit Plant and Propagating Material (England) Regulations 2017 2017 28 duties
- The Marketing of Fruit Plant and Propagating Material (Wales) Regulations 2017 2017 26 duties
- The Marketing of Fruit Plant and Propagating Material Regulations (Northern Ireland) 2017 2017 25 duties
- Electricity Safety, Quality and Continuity Regulations 2002 2002 21 duties
- THE ELECTRICITY SAFETY, QUALITY AND CONTINUITY REGULATIONS (NORTHERN IRELAND) 2012 2012 19 duties
Any Person also bound by 2338 other Acts (top 5 shown)
- Human Medicines Regulations 2012 2012 169 duties
- Merchant Shipping Act 1995 1995 144 duties
- Insolvency (England and Wales) Rules 2016 2016 101 duties
- Road Traffic Act 1988 1988 95 duties
- Air Navigation Order 2016 2016 95 duties
Employers also bound by 694 other Acts (top 5 shown)
- The Income Tax (Pay As You Earn) Regulations 2003 2003 236 duties
- Provision and Use of Work Equipment Regulations 1998 1998 120 duties
- TULRCA 1992 1992 72 duties
- Employment Rights (Northern Ireland) Order 1996 (current NI employment law) 1996 52 duties
- Income Tax (Earnings and Pensions) Act 2003 2003 50 duties
Directors and Officers also bound by 425 other Acts (top 5 shown)
- Insolvency (England and Wales) Rules 2016 2016 161 duties
- Companies Act 2006 2006 108 duties
- Insolvency Act 1986 1986 72 duties
- The Large and Medium-sized Companies and Groups (Accounts and Reports) Regulations 2008 2008 55 duties
- The Housing Administration (England and Wales) Rules 2018 2018 26 duties
What this Act requires
Sections that create concrete duties on businesses or carry penalties. Procedural and definitional sections are folded into the “Browse other sections” expander at the bottom of each group. Click any section title to read the source text on legislation.gov.uk.
Part 1 — Product security
Duty to comply with security requirements
Fine up to £17,500,000- Ensure connectable products meet UK security requirements Manufacturer
- Ensure your UK consumer connectable products meet security requirements Manufacturer
Statements of compliance
- Provide a statement of compliance with connectable products Manufacturer
Duty to investigate potential compliance failures
- Investigate possible product security compliance failures Manufacturer
- Investigate potential security compliance failures in smart products Manufacturer
Duties to take action in relation to compliance failure
- Stop sales and fix security failures in connected products Manufacturer
- Take action on product security compliance failures Manufacturer
Duty to maintain records
- Keep records of product security investigations and failures Manufacturer
- Maintain records of security investigations and compliance failures Manufacturer
Duties to take action in relation to manufacturer’s compliance failure
- Authorised representatives must report manufacturer security failures Manufacturer
- Notify ICO of product security compliance failures Manufacturer
Duty to comply with security requirements
- Ensure imported connectable products meet security requirements Trader
- Ensure products meet UK security standards Manufacturer
Statements of compliance
- Ensure imported connectable products have a statement of compliance Manufacturer
Duty not to supply products where compliance failure by manufacturer
- Do not supply products with known security compliance failures Trader
- Do not supply connectable products with known security failures Manufacturer
Duty to investigate potential compliance failures of importer or manufacturer
- Investigate any reported product compliance failures Trader
- Investigate potential security compliance failures Manufacturer
Duties to take action in relation to importer’s compliance failure
- Fix product security failures and notify ICO and customers Employer
- Remedy and report security failures in your imported products Manufacturer
Duties to take action in relation to manufacturer’s compliance failure
- Act for products with security failures if you are an importer Manufacturer
- Take action when an imported product has a security compliance failure Trader
Duty to maintain records of investigations
- Keep records of product security investigations for 10 years Manufacturer
- Keep records of security investigations for imported products Trader
Duty to comply with security requirements
- Ensure smart products meet UK security requirements Distributor
- Ensure your connectable products meet UK security requirements Trader
Statements of compliance
- Do not supply connectable products without a statement of compliance Distributor
Duty not to supply products where compliance failure by manufacturer
- Do not supply non‑compliant consumer connectable products Trader
- Do not sell products with known manufacturer security failures Distributor
Duties to take action in relation to distributor’s compliance failures
- Fix product security failures and notify ICO and customers Trader
- Remedy and report security failures in digital products Distributor
Duties to take action in relation to manufacturer’s compliance failure
- Act on and report security compliance failures in products you distribute Distributor
- Notify manufacturer, regulator and supply chain of product security failures Trader
Failure to comply with enforcement notice
Unlimited fine- Fail to comply with enforcement notice Any Person
Determining the amount of a penalty
Other duties (1) — Crown / regulator
- Secretary of State must ensure penalties are appropriate and proportionate Crown / Minister / Government department
Enforcement of penalty notices
Unlimited fine- Non-payment of product security fines Any Person
Offence of purporting to act as authorised to exercise enforcement function
Unlimited fine- Pretend to be authorised to enforce product security Any Person
Offences by directors, partners etc
- Liable for corporate offence when you consent, connive or neglect Director or Officer
Browse 33 other sections in this Part — procedural / definitional / commencement
Power to specify security requirements
Further provision about regulations under section 1
Power to deem compliance with security requirements
Relevant connectable products
Types of product that may be relevant connectable products
Excepted products
Relevant persons
Enforcement of Part 1
Delegation of enforcement functions
Compliance notices
Stop notices
Recall notices
Power to vary or revoke enforcement notices
Appeals against enforcement notices
Compensation for notices wrongly given
Appeals against decisions under section 34
Monetary penalties
The relevant maximum
Penalty notices: further provision
Appeals against penalty notices
Forfeiture
Further provision about forfeiture
Appeals against decisions under section 42
Power to inform public about compliance failures
Power to publish details of enforcement action taken against relevant persons
Power to recall products
Disclosure of information
Means of giving notices
Liability of authorised representatives
Guidance
Meaning of “UK consumer connectable product”
Meaning of “supply”
Meaning of other expressions used in Part 1
Part 2 — Telecommunications infrastructure
Browse 19 other sections in this Part — procedural / definitional / commencement
Rights under the electronic communications code to share apparatus
Upgrading and sharing of apparatus: subsisting agreements
Upgrading and sharing of apparatus installed before 29 December 2003
Power to fly lines from apparatus kept by another operator
Rent under tenancies conferring code rights: England and Wales
Rent under tenancies conferring code rights: Northern Ireland
Compensation relating to code rights: England and Wales
Compensation relating to code rights: Northern Ireland
Jurisdiction of court in relation to tenancies in England and Wales
Refusal of application for code rights on grounds of national security etc
Unresponsive occupiers
Arrangements pending determination of certain applications under code
Use of alternative dispute resolution
Complaints relating to the conduct of operators
Jurisdiction of First-tier Tribunal in relation to code proceedings in Wales
Power to impose time limits on the determination of code proceedings
Rights of network providers in relation to infrastructure
Power to make consequential amendments
Meaning of “the electronic communications code”
Part 3 — Final provisions
Browse 5 other sections in this Part — procedural / definitional / commencement
Power to make transitional or saving provision
Regulations
Extent
Commencement
Short title
Other sections — not classified into a Part
These sections sit outside the numbered Parts — usually provisions added or moved by later amendments.
Browse 1 other section
Unresponsive occupiers: consequential amendments
Official guidance
Authoritative sources published by regulators or government explaining this legislation.
- Statement: Electronic Communications Code – Proposed Template Notices resulting from Product Security and Telecommunications Infrastructure Act 2022 amendments to the Code (opens in a new tab) from Ofcom Detailed Guidance
- Device security principles for manufacturers | National Cyber Security Centre (opens in a new tab) from NCSC Detailed Guidance
- Android | National Cyber Security Centre (opens in a new tab) from NCSC Detailed Guidance
- ETSI EN 303 645: Cyber Security for Consumer IoT (opens in a new tab) Detailed Guidance
- OPSS enforcement guidance for consumer connectable products (opens in a new tab) from OPSS Publication
- GOV.UK PSTI product security guidance (opens in a new tab) from OPSS Detailed Guidance
- How do we ensure security of personal information in IoT? (opens in a new tab) from ICO Detailed Guidance
Enforcement and responsible bodies
The regulators that administer or enforce this legislation.
Ofcom
PrimaryOffice of Communications
Regulates telecoms, TV, radio, video-on-demand, postal services, and online safety. Issues licences for telecoms providers, manages spectrum. Now enforces Online Safety Act …
Office for Product Safety and Standards
Product safety regulator responsible for ensuring consumer products are safe. Enforces product safety regulations, UKCA marking requirements, and works with market surveillance …
Explore more
Browse legislation
Find other UK business legislation with related guidance.
Regulators
Learn more about the bodies that enforce this legislation.