UK's New Consumer Connectable Products Security Regulations Effective April 2024

Introduction

On April 29th, 2024, the United Kingdom's regulatory framework governing the security of consumer connectable products officially came into effect, mandating compliance from all entities operating within the supply chain of such products.

Central to this regulatory landscape are the provisions outlined in Part 1 of the Product Security and Telecommunications Infrastructure (PSTI) Act 2022, alongside the Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023.

Obligations for Manufacturers, Importers, and Distributors

Manufacturers, importers, and distributors of pertinent pluggable products are obligated to adhere to specific mandates delineated within these regulations. This includes ensuring that their products meet the prescribed minimum safety standards. The Office of Product Safety and Standards (OPSS) assumes the pivotal role of enforcing the PSTI Act 2022 and its associated regulations, effective as of April 29th, 2024, operating under a Memorandum of Understanding (MoU) with the Department for Digital, Culture, Media & Sport (DSIT).

Under the purview of this legislation, manufacturers of consumer connectable products within the UK, colloquially referred to as 'smart' products, are compelled to ensure full compliance with the stipulated obligations. These obligations encompass adherence to requisite minimum-security protocols, safeguarding both consumers and critical infrastructure from potential vulnerabilities.

Legislative Components

The regulatory framework comprises two key legislative components:

• Part 1 of the Product Security and Telecommunications Infrastructure (PSTI) Act 2022
• The Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023

The PSTI Act received Royal Assent in December 2022, while the accompanying regulations were formally promulgated into law on September 14th, 2023, subsequent to the publication of a comprehensive draft in April 2023.

Guidance for Businesses

This guidance underscores the essential provisions that businesses must meticulously consider as they endeavor to navigate and adhere to the stringent requirements delineated within this regulatory regime, including robust cybersecurity measures to safeguard consumer data and protect against cyber threats.

Regulatory Impact

• Top Priority: Yes
• Type Certificate: No
• Spectrum Bands: No
• Import Changes HS Codes: No
• Standard Changes: Yes
• Product Changes: Yes
• Label Changes: No

Link to Source - https://www.gov.uk/government/publications/the-uk-product-security-and-telecommunications-infrastructure-product-security-regime#full-publication-update-history