Since 29 April 2024, consumer smart products sold in the UK, such as smart TVs, cameras, speakers, plugs, wearables, routers and phones, must meet the Product Security and Telecommunications Infrastructure (PSTI) regime. It applies no matter when the product was made, and it covers manufacturers, importers and distributors. Global Approbation helps Indian IoT and electronics makers meet the requirements and prepare the Statement of Compliance.
The Three PSTI Security Requirements
| 1. No universal default passwords | Passwords must be unique per device or set by the user, with no easily guessable defaults |
|---|---|
| 2. Vulnerability reporting | A published way for anyone to report security issues, with acknowledgement and status updates |
| 3. Security update period | A clear, published minimum period during which security updates will be provided |
| Statement of Compliance | Must accompany the product, confirming compliance with the requirements |
| Enforcement | Office for Product Safety and Standards; penalties up to £10 million or 4% of worldwide turnover |
In Scope vs Excluded
- ✔ Smartphones & tablets
- ✔ Smart TVs & speakers
- ✔ Security cameras & doorbells
- ✔ Smart plugs, bulbs & appliances
- ✔ Wearables & fitness trackers
- ✔ Routers & IoT hubs
- ✘ Desktop & laptop computers (without cellular)
- ✘ Medical devices, smart meters and EV chargers (separate rules)
How Global Approbation Handles PSTI
- Scope check. Confirm whether your product is a consumer connectable product.
- Security review. Password handling, reporting process and update commitments reviewed (ETSI EN 303 645 alignment).
- Policy set-up. Vulnerability disclosure page and support-period publication.
- Statement of Compliance. Prepared for each product.
- Supply chain. Importer and distributor obligations explained.
PSTI: Frequently Asked Questions
When did PSTI start?
The product security regime has applied since 29 April 2024 to relevant consumer connectable products made available in the UK.
Does PSTI apply to stock made before April 2024?
Yes. The rules apply to products made available in the UK from that date, whenever they were manufactured.
Is PSTI the same as EU RED cybersecurity?
No. They are separate laws with different requirements. Meeting ETSI EN 303 645 helps with both, but each needs its own compliance evidence.
What are the penalties?
Up to £10 million or 4% of worldwide turnover, plus recall and stop notices.
Regulations, standards and deadlines change. Scope, testing route and timelines are confirmed product by product after our applicability review. Global Approbation is a consultancy and does not itself issue certificates; approvals are granted by the relevant authority, accredited laboratory or certification body.