To meet the three UK product security requirements, check that every shipped unit has a unique or user defined password, that a public page explains how to report security issues with response timescales, and that a clear minimum update period and end date are published before sale. Then keep evidence of each.
Step 1: confirm you are in scope
Ask whether your product is a consumer product that can connect to the internet or a network, and whether you are the manufacturer, an importer or a distributor. GOV.UK lists exclusions such as medical devices and electric vehicle charge points, so check the current text for your case. Record the decision and who made it.
Step 2: passwords
For each product line, answer these questions.
- Is the default password unique per unit, or does the user set it during setup?
- If unique, how is it generated? It must not use an incremental counter, public information, or an identifier such as a serial number, unless protected by accepted encryption or keyed hashing.
- Do any service accounts, debug logins or maintenance credentials share one password across devices?
- Does factory reset return the device to an unconfigured state and not to a shared default?
A design review plus a sample of production units is better evidence than a policy statement.
Step 3: vulnerability reporting
Publish a page that gives:
- a contact route for reporting security issues;
- how long you take to acknowledge a report;
- how often you will send status updates until the issue is resolved.
GOV.UK says this information should be free, in English, available without a prior request, and easy to understand. A contact form behind a login does not meet that. Also decide who reads the inbox, because an unattended address defeats the purpose.
Step 4: update period
Publish the minimum security update period and the end date, in terms a non-technical reader can understand, where the buyer will see it. Check the product page, the packaging and the support site agree. If you extend support later, you can update the date, but do not shorten a commitment you have already made without taking advice.
Step 5: keep the evidence
Keep dated screenshots of each page, the design review notes, the sample test results, and the name of the person who owns each requirement. Distributors and retailers should ask their suppliers for the same evidence rather than assuming it exists.
Where a software inventory helps
Update commitments depend on knowing what is inside your firmware. A software bill of materials and dependency scanning, such as Safeguard offers, show which third party components you would need to patch to honor the period you publish. You can try a free scan at gold.safeguard.sh/scan.
Quick check
Can an importer rely on the manufacturer's compliance?
GOV.UK states that importers and distributors have duties of their own. Ask for evidence rather than assuming.
Sources
Last reviewed: 19 October 2026.
