From 29th April 2024, the new Product Security and Telecommunications Infrastructure (PSTI) Act will come into force in the UK, which governs the safety requirements for all network and internet connected and connectable products, in order to give the consumer better security protection.
This includes those which form part of the ‘Internet of Things ’ as well as other connected products. It is therefore important to understand what the Act covers and how it could affect you.
Key takeaways from the new PSTI act
- The PSTI act works to create an enforcement in order to prevent cyber-vulnerable products from being sold within the UK
- The PSTI act comes into effect on 29th April 2024 and manufacturers of IoT products must comply with the security requirements laid out in the act
- The PSTI act’s goal is to ensure that consumer connectable products are most secure against cyber attacks
PTSI requirements
The requirements are being brought in to prevent any malicious activity, and so all relevant products must not have universal default passwords but, therefore, must all have their own unique passwords in order to aid security for the consumer.
It is also important that all products have a plan for dealing with any weaknesses in their software that may emerge and that there is a contact point where vulnerabilities can be reported. The Act also requires there to be a level of transparency for consumers in relation to their security updates. This will ensure that devices disclose how long they will continue to receive these updates during their lifespan.
What products are covered by the PSTI act?
Products that can be connected to a network or internet are required to comply with the latest legislation. The IOT (internet of things) devices include:
- Smartphones
- Connected cameras, TV’s and speakers
- Connected children’s devices
- Connected safety products
- IOT base stations and hubs
- Wearable connected fitness trackers
- Outdoor leisure products that are not wearable
- Connected home automation products
- Connect home appliances
- Smart home assistants
What products are excluded from the PSTI act?
The following products are excluded from the PSTI act:
- Charging points for electric vehicles
- Medial devices as long as they fall under the MDR (Medical Device Regulation)
- Smart meters
- Desktops, laptops and tablets that cannot be connected to cellular networks
- Products sold in Northern Ireland
What are the security requirements?
- Ban default passwords: Products that have a default or easy-to-guess password are an easy target for cyber criminals
- Vulnerability disclosure policy: Security researchers regularly identify security flaws in products, but need to be able to pass this information onto the manufacturer of the product so they can take action, before criminals do so. The new legislation will provide measures to help ensure vulnerabilities are identified and flagged
- Transparency: Consumers should know if their product will be supported with security updates, and if so, what the minimum length of time is that they can expect that support to continue
Implementation steps
To comply with the PSTI, your organisation should implement the following steps:
Identify products
A review of all digital products made available in the UK to determine whether they fall under the PSTI legislation or not
Identify role
For each product you sell, determine the organisations role whether this be manufacturer, importer or distributor
Security requirements
Each product should comply with the security requirements in place, if these are not being met then action should be taken
Security issue handling
Create and implement a process for how security issues will be handled. This may require an agreement with all parties in the supply chain to ensure security issues are communicated with the end users.
Compliance failure management
You should implement a process for logging and responding to any issues regarding compliance failure, including notifying the OPSS.
Who must comply with the PSTI act?
Manufacturers, importers and distributors of consumer connectable products need to follow the security requirements laid out by this law. The PSTI act also requires these individuals to ensure that their product comes with a statement of compliance and to take the required action should there be a problem meeting those security requirements.
In order to be compliant, any relevant products not only need to meet these new requirements, but they also need to be accompanied by a ‘statement of compliance’.
These new regulations mean that any products which do not comply cannot be placed on the market in the UK after 29th April 2024. They also cannot be sold to the end consumer after this date irrespective of when they were acquired by the retailer. It is therefore important to understand how many products could be affected and where they are in order to take remedial action as quickly as possible.
The risks of non compliance
Anyone who fails to comply with these regulations could face some hefty penalties, with fines reaching a maximum of 4% of the global qualifying turnover of the entity or up to £10 million, whichever is the greatest for the most recent accounting period. For those who already have stock which might be affected within their supply chain, it is therefore very important that they act now to ensure the products are compliance or they could face these fines or alternatively the withdrawal or recall of the product from the market.
As the PTSI Act comes into law, it is important that all internet and network connectable products are brought into line immediately. Manufacturers, distributors and retailers all have a responsibility to ensure that their products meet all of the necessary requirements before the deadline, which is now looming ever closer.
Authorised Representative Service can offer representation for the PSTI act as an additional service to our standard representation, get in touch with us today to find out what is involved.
Get in touch today
Our Authorised Representative Service has offices both in the UK and Ireland, making us easy to deal with and providing a one-stop-shop for manufacturers wherever they are in the world.
We are specialists in EU and UK product safety legislation and offer a comprehensive service to ensure that your product meet the requirements ready for market in the European Union. Get in touch with us today to find out more about how we can help you and your business.