The Department for Science, Innovation and Technology (DSIT) has published an explanatory memorandum for the Revised Telecommunications Security Code of Practice 2026. This updated code provides detailed technical guidance to Tier 1 and Tier 2 public telecommunications providers in the United Kingdom, supporting compliance with statutory security duties under the Communications Act 2003, as amended by the Telecommunications (Security) Act 2021 and related regulations.

Key updates in the revised code include new guidance on network automation, signalling, privileged access workstations, application programming interfaces (APIs), and patching and updates. These changes reflect evolving technologies, emerging cyber threats, and feedback from industry stakeholders, particularly regarding the practical implementation of security measures.

The revised code was developed following an eight-week public consultation and an additional cost survey, with input from telecoms providers, Ofcom, and the wider public. The government made amendments to the draft code in response to concerns about costs, timelines, and technical feasibility.

The instrument does not introduce new statutory duties or regulatory requirements but clarifies the government's preferred approach to demonstrating compliance. The financial impact on affected providers is expected to be low, with main costs arising from familiarisation and implementation of technical and organisational measures. The revised code is intended to be periodically reviewed and updated as new threats and technologies emerge.

This update is assessed as Low Impact.

Key reasons for low impact:

• The revised code provides guidance only and does not introduce new statutory duties or regulatory requirements.
• Financial impact on affected providers is expected to be minor, mainly related to familiarisation and technical adjustments.
• The scope is limited to Tier 1 and Tier 2 public telecoms providers with turnover above £50 million.

Who is affected?

Large and medium-sized public telecommunications providers operating in the UK.

Conclusion

The revised code clarifies and updates technical guidance, supporting compliance with existing security obligations, but does not create new mandatory requirements or significantly alter market access or product approval processes.