PSTI Act for IoT Devices: What UK Buyers Should Ask Their Suppliers
TL;DR: The PSTI Act is the UK law that sets minimum security rules for connectable products. Since 29 April 2024 manufacturers, importers and distributors of products made available to UK consumers must avoid default passwords, publish a way to report vulnerabilities and publish how long security updates will last. The penalty can reach the greater of £10 million or 4% of qualifying worldwide revenue. Many industrial IoT products sit outside the consumer test, but the rules are a sound checklist for any supplier.
Last updated: 22 October 2026
On this page
Key takeaways
- The PSTI Act, the Product Security and Telecommunications Infrastructure Act 2022, sets security requirements for connectable products. Its security rules came into force on 29 April 2024.
- It places duties on manufacturers, importers and distributors of products that are, or are intended to be, made available to consumers in the UK.
- There are three requirements in the regulations: no universal default passwords, a published way to report security issues, and a published minimum period for security updates.
- The maximum penalty is the greater of £10 million and 4% of qualifying worldwide revenue, plus daily penalties of up to £20,000 for a continuing breach after the fixed penalty.
- Industrial and business-only products are not automatically in scope, because the test is whether a product is made available to UK consumers, or is identical to a product that is. Do not assume. Ask the supplier.
- Whether or not a product is in scope, the three requirements make a useful buying checklist for any IoT device on your network.
A facilities manager buys twenty smart plugs for a building. An engineer fits a router at a pumping station. A school installs a Wi-Fi camera. Each one connects to a network, each one has a login, and each one is only as safe as its password, its update policy and the supplier’s willingness to hear about a flaw.
This guide is for buyers, IT teams and engineers who purchase connected devices in the UK. It explains what the PSTI Act says, who it applies to, how it treats industrial products, what the three security requirements are, what the penalties are, and which questions to put to a supplier. The legal points come from the Act and its regulations on legislation.gov.uk. It is not legal advice, so take specific questions about your own products to a solicitor.
What is the PSTI Act?
The PSTI Act is the Product Security and Telecommunications Infrastructure Act 2022. Part 1 of the Act lets the government set security requirements for relevant connectable products made available to consumers in the UK, and puts duties on the people who make, import and distribute them.
The Act itself is short on technical detail. It gives the Secretary of State the power to specify security requirements by regulations, and the regulations do the work. The Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023, SI 2023/1007, were made on 14 September 2023 and came into force on 29 April 2024. They extend to England and Wales, Scotland and Northern Ireland.
The main effect on buyers is that a supplier who has to comply must be able to show how.
Who has to comply with the PSTI Act?
Manufacturers, importers and distributors all have duties. Each must comply with the relevant security requirements if they intend a product to be a UK consumer connectable product, or are aware, or ought to be aware, that it will be one. The Act sets out the duty separately for each role, in sections 8, 14 and 21.
A manufacturer must comply with the security requirements. An importer and a distributor have a duty to comply too, and each may not make a product available in the UK unless it is accompanied by a statement of compliance or a summary of one. So a UK reseller of a covered product needs the manufacturer’s paperwork before it lists the product.
Where there is more than one manufacturer of a product, each must meet the requirements or satisfy the conditions for deemed compliance. This catches the case where one company designs a product and another builds it.
For a business that buys and installs products rather than selling them, the Act places no direct duty on you as a buyer. It does give you a lever. You can ask the supplier for the statement of compliance, and a supplier who is covered must be able to provide it.
Does the PSTI Act apply to industrial IoT?
Not automatically. The Act applies to relevant connectable products, which means products that can connect to the internet or to a network and are not excepted. Its duties bite when a product is or is intended to be a UK consumer connectable product. Section 54 sets the test.
Under section 54, a product is a UK consumer connectable product if it is, or has been, made available to consumers in the UK before being supplied elsewhere. It also counts if it is made available to customers who are not consumers and identical products meet the consumer condition. So a device sold only to businesses is not caught on its own, but the same model sold to households is.
That second condition matters. Many connected products straddle the line. A smart plug, a thermostat or a camera can sit in an office or a house. A pump controller or a substation switch almost certainly does not.
The regulations also list products that are excepted. Schedule 3 excepts electric vehicle charge points covered by the Electric Vehicles (Smart Charge Points) Regulations 2021, medical devices covered by the Medical Devices Regulations 2002, smart meter products supplied by licence holders and assured under the NCSC scheme, and desktop computers, laptops and tablets that cannot connect to cellular networks. There is also an exception for products supplied in Northern Ireland that are covered by certain EU legislation under the Windsor Framework.
Industrial sensors, routers and gateways are not on that list. Whether they are in scope depends on the consumer test, so a supplier is the right person to ask.
What are the three security requirements?
The regulations set three requirements in Schedule 1. Passwords must be unique per product or defined by the user. The manufacturer must publish a point of contact for reporting security issues, with timings for acknowledgement and updates. And the manufacturer must publish the defined support period for security updates.
| Requirement | What the regulations say | What to ask the supplier |
|---|---|---|
| Passwords | Unique per product, or defined by the user. Unique passwords must not be based on incremental counters, public information or serial numbers unless protected by good industry practice | Does the device ship with a shared default password? |
| Reporting security issues | Publish at least one contact point, and when the reporter will get an acknowledgement and status updates. Information must be free, in English and not require personal details | Where is the vulnerability reporting page? |
| Security update period | Publish the defined support period, which is a minimum length with an end date, and do not shorten it after publication | How long will this product receive security updates? |
On passwords, the regulations rule out the old pattern of admin and admin, and passwords such as password1 and password2 that differ by a counter. They also rule out passwords derived from a serial number unless that is done with an encryption method or keyed hashing algorithm accepted as good industry practice.
On reporting, the information must be accessible, clear and transparent. It must be available without a prior request, in English, free of charge, and without asking the reporter for personal information.
On updates, the defined support period must be published, and the regulations say the requirement is not met if the period is shortened after publication. If the manufacturer extends the period, the new date must be published as soon as practicable. Where a manufacturer invites purchase on its own website, the support period must be published alongside or given equal prominence to the price and other purchase information.
What are the penalties under the PSTI Act?
The Secretary of State can issue compliance notices, and can issue penalty notices of up to the greater of £10 million and 4% of the person’s qualifying worldwide revenue for the most recent accounting period. A penalty notice can also add a daily penalty of up to £20,000 for each day a breach continues after the fixed penalty is due.
The enforcement route has steps. If the Secretary of State has reasonable grounds to believe a person has failed to comply with a relevant duty, a compliance notice can require them to comply within a set period. A penalty notice must give at least 28 days to pay. A person cannot receive more than one penalty notice for a single breach.
For most suppliers the practical consequence is not the fine. It is the cost of being unable to list a product or the discovery that a distributor will not stock it without a statement of compliance.
What do real suppliers publish?
Some suppliers already publish PSTI evidence. Milesight has published a PSTI Statement of Compliance, issued in 2025, and Atop publishes vulnerability disclosure and vulnerability report pages. What they cover differs, so check which products each document applies to.
Milesight’s statement says it covers AI network cameras, AI network video recorders and Milesight VMS video management software. It states that Milesight products are shipped without default or pre-configured passwords and that credentials are set by the user, with a minimum of 8 and a maximum of 64 characters, and a mix of letters and numbers. It also states that security updates will be made available for a minimum period of three years after product release. Those statements apply to the products the document names, so for a Milesight sensor, gateway or router, ask for the evidence for that product.
Milesight’s vulnerability reporting page asks researchers to write to security@milesight.com, and says it will confirm receipt within 48 hours of receiving a report and keep the reporter updated through the process. That matches the reporting requirement the regulations describe.
Atop’s website lists a Vulnerability Disclosure Policy and a Vulnerability Report page in its footer. We have not checked for a published support period on every Atop product, so ask for one before you buy.
Which six questions should you ask a supplier?
Ask whether the product is in scope, whether it ships with a default password, where the vulnerability reporting page is, how long security updates last, whether there is a statement of compliance, and how you will be told about a fix. Write the answers down, because they are part of your own risk record.
- Is this product intended to be made available to consumers in the UK, and is a statement of compliance available for it?
- Does it ship with a default password, or does the user set one at first login? If there is a default, is it unique per device?
- Where is the published point of contact for reporting a security issue, and what response time is stated?
- What is the defined support period for security updates, with an end date?
- How are security fixes published, and how will we be notified?
- Which firmware version is the product shipping with today?
These questions suit any device you connect to a business network, not only those the Act covers. A router, a gateway or a sensor with a login is a door into your network. The NCSC’s guidance on operational technology says to change default passwords and to remove unused services, and our guide to OT cybersecurity best practices covers the wider controls.
How does the PSTI Act fit with other UK and EU rules?
The PSTI Act is one of several rules that touch connected products. It focuses on consumer products and three baseline requirements, and other rules cover different ground.
We cover the EU rules in our guide to the Cyber Resilience Act and the UK proposals in our guide to the Cyber Security and Resilience Bill. Both are relevant if you sell or operate connected equipment across borders.
For a UK business the sensible approach is to treat the PSTI requirements as a floor. Ask every supplier the same three questions about passwords, reporting and updates, and then add whatever your own risk assessment requires.
What mistakes do buyers make about the PSTI Act?
The common mistakes are assuming a product is covered or not covered without asking, accepting a statement that covers different products, ignoring the support period, leaving default passwords in place after install, and treating compliance as a one-off check. Each is avoidable.
- Assuming scope. The test is the consumer rule in section 54, so ask the supplier.
- A statement for the wrong product. Milesight’s statement names cameras, recorders and VMS. Check that the document covers the model you are buying.
- No end date. A support period must be a period with an end date. A promise of ongoing updates is not the same.
- Leaving the first password. Even a compliant product needs a strong password set at install, and reviewed when staff change.
- Checking once. Support periods and policies change. Keep the evidence and review it each year.
- Forgetting the network. A secure device still needs sensible segmentation. See our guide to PLC remote access for an outbound-only approach.
Frequently asked questions
What is the PSTI Act?
The PSTI Act is the Product Security and Telecommunications Infrastructure Act 2022. It lets the government set security requirements for connectable products made available to UK consumers. Its security regulations, SI 2023/1007, came into force on 29 April 2024 and cover passwords, vulnerability reporting and update periods.
What are the three PSTI security requirements?
Passwords must be unique per product or defined by the user, the manufacturer must publish a point of contact for reporting security issues with timings for responses, and the manufacturer must publish a defined support period for security updates, with an end date that cannot be shortened later.
Does the PSTI Act apply to industrial IoT products?
Not automatically. Duties apply where a product is, or is intended to be, a UK consumer connectable product, or is identical to products made available to consumers. A device sold only to businesses may be outside it, but ask the supplier rather than assume.
What is the penalty for breaking the PSTI Act?
A penalty notice can require payment of up to the greater of £10 million and 4% of qualifying worldwide revenue. It can add a daily penalty of up to £20,000 for each day a breach continues after the fixed penalty is due. The Secretary of State can also issue compliance notices.
Does Milesight comply with the PSTI Act?
Milesight publishes a PSTI Statement of Compliance, issued in 2025. It covers AI network cameras, network video recorders and Milesight VMS, and says products ship without default passwords and receive security updates for at least three years after release. Ask for evidence for the specific sensor, gateway or router you buy.
What should I ask a supplier about IoT security?
Ask whether a statement of compliance exists, whether the device ships with a default password, where vulnerabilities are reported, how long security updates last with an end date, and how fixes are announced. These questions work for any connected device, whether or not the Act applies.
Where to go next
List the connected devices you plan to buy, and ask each supplier the six questions above. If you want us to check the position for the Milesight and Atop products on your list, send them through the quote form and we will come back with the supplier evidence that exists for each.
For the legal text, read the Product Security and Telecommunications Infrastructure Act 2022 and the Security Requirements for Relevant Connectable Products Regulations 2023. For the supplier evidence quoted here, see Milesight’s PSTI Statement of Compliance and its vulnerability reporting page.
Next step
Get a priced kit list for your site
Answer three quick questions and tell us where to send it. An engineer replies within one working day with the parts, the prices and the lead time.
Rather talk it through? Call 023 9223 3611
Received. An engineer has it.
You will hear back within one working day with the parts, the prices and the lead time. A confirmation is on its way to your inbox.
If it is urgent, call 023 9223 3611.
