The UK product security regime, in force since 29 April 2024, sets three baseline requirements for connectable consumer products: no universal default passwords, a published way to report security issues, and a published minimum period for security updates. It binds manufacturers, importers and distributors.
Who has to comply
GOV.UK describes the duties as applying to manufacturers, importers and distributors of relevant connectable products. A manufacturer includes a business that has a product designed or made and sells it under its own name. A business that sells another firm's product under its own name or trademark counts too. Importers bring products into the UK from outside it, and distributors such as retailers make products available to buyers.
The rules cover relevant consumer products that can connect to the internet or a network. That includes smart speakers, cameras, connected appliances and similar devices.
Requirement 1: passwords
Passwords must be unique per product, or capable of being defined by the user. A unique password cannot be built from an incremental counter, from public information, or from an identifier such as a serial number, unless it is protected by an accepted encryption or keyed hashing method.
The aim is to stop makers shipping every unit with the same login, so one leaked password cannot open thousands of devices.
Requirement 2: a way to report vulnerabilities
Manufacturers must provide information on how to report security issues about their product. They must also state how long they will take to acknowledge a report and how often they will send status updates until it is resolved. The information must be free to access, in English, available without a prior request, and easy to understand.
Requirement 3: minimum update period
Manufacturers must publish the minimum length of time a product will receive security updates, along with an end date, in terms a non-technical reader can follow. Buyers can then compare products on support, not just features.
What is outside scope
The regulations guidance lists several exclusions. They include electric vehicle charge points, medical devices, smart meter products, and desktop, laptop and tablet computers without cellular connectivity unless designed for children under 14. Certain vehicles were added by a 2025 amendment. Products supplied in Northern Ireland under specific Windsor Framework legislation are also covered separately.
If you make or sell connected products, check the current text yourself before relying on this summary. This post does not cover penalties, which you should confirm with the regulator's guidance.
How buyers can use it
You do not need to read the law to benefit. When you shop, look for the three things: how to change the password at setup, where the maker publishes a security contact, and the update end date. A product missing all three is worth a pause.
Quick check
Does the regime cover phones and smart home hubs?
It covers relevant connectable consumer products in general. Check the GOV.UK exclusions list for the specific cases that are carved out, such as medical devices and some computers.
Is a unique password per device enough on its own?
It is one of three requirements. The password must also avoid counters, public information and serial numbers, and the maker must meet the other two requirements.
Sources
Last reviewed: 19 October 2026.
