ByteSize: New UK cybersecurity requirements for consumer connected devices

Why should I read this?

The UK Product Security and Telecommunications Act 2022 (Act) and Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023 raise the bar for the safety and cybersecurity of consumer, connectable devices (aligning the UK with EU cyber resilience).

The Act comes into force on 29 April 2024 and places greater responsibility on manufacturers, importers and distributors.

A product may meet the definition of a UK consumer connectable product even if it is solely aimed at business customers, e.g. if identical products have been made available to UK consumers by another distributor.

It is vital that manufacturers, distributors and importers of consumer connectable products are aware of the requirements, implement such requirements where applicable, and that relevant obligations are flowed down through supply chain contracts.

Impacted products include: smartphones, wearable tech, cameras, home automation, IoT base stations/hubs, alarm systems, smart TVs, speakers and toys.

What should I do?

29 April 2024 is fast approaching. Manufacturers, importers and distributors must carry out a review of their product portfolio and risk assessment to understand whether consumer connected products are within scope.

Identify and assess your contractual supply chain and how you, and your suppliers, distributors and importers around you, will comply with the Act. These obligations should be fed through the entire supply chain, so you can be confident the requirements are met at every stage of the product’s journey.

This may also impact procurement when conducting due diligence when selecting vendors and component suppliers.

Those selling across borders will also need to consider local laws, including the EU Cyber Resilience Act. Overall, in the increasingly smart world of connected devices, cybersecurity and safety compliance is paramount; market leaders may wish to require more than the baseline standards.

What else do I need to know about the UK PSTI Act?

The regime is wide reaching across the supply chain, placing responsibility on manufacturers, importers and distributors of consumer connectable products in the UK.

Chapter 2 sets out the compliance requirements placing different obligations on manufacturers, importers and distributors, depending on their role in the supply chain.

Obligations include: banning universally default or easily guessable passwords; publishing information on how to report security issues and minimum-security update periods; investigating and taking action against both suspected and actual compliance failures; and providing statements of compliance.

Breaches of the Act can result in strict enforcement from the Office for Product Safety and Standards, with sanctions ranging from product recalls, stop notices, and fines of up to £10 million or 4% worldwide annual turnover. Non-compliance also raises the prospect of disputes and litigation.

Further reading

• ByteSize: Monthly TMT case updates