The UK product security regime "came into effect on 29 April 2024," according to GOV.UK. It covers relevant consumer products that can connect to the internet or a network, and the duties fall on manufacturers, importers and distributors selling to UK consumers. The Office for Product Safety and Standards enforces it.
Safeguard does not certify products. This is a checklist for engineers building connected products, such as the smart devices and moving machines in homes and shops.
What's affected
GOV.UK lists three security requirements:
- "banning universal default and easily guessable passwords"
- "publishing information on how to report security issues"
- "publishing information on minimum security update periods"
GOV.UK also lists items out of scope, including EV charge points, medical devices and smart meter products, and certain vehicles from 25 February 2025 amendments. Check the guidance to see if your product falls in or out.
How to check if you're exposed
- Passwords: does every unit ship with a unique password, or force the user to set one at setup?
- Reporting: is there a public page with a contact and timescales for acknowledgement?
- Updates: is the minimum update period published, and can your release process actually deliver fixes for that long?
What to do now
- Keep a component list per firmware release, so a library flaw can be traced to every shipped model.
- Scan it regularly and keep a record of decisions.
- Publish a security contact and a plain support period.
- Test factory provisioning for unique credentials.
Why it matters
The update period is a promise to maintain the whole software stack, including third party components, for a stated time. Without an inventory, the promise is hard to keep.
Try it yourself
See how VEX style statements record whether a known flaw affects your product.
Click through it at your own pace, or open it full screen.
Quick check
What are the three PSTI security requirements?
Banning universal default and easily guessable passwords, publishing how to report security issues, and publishing minimum security update periods.
