The New Threshold for UK Exports: The PSTI Cyber Security Act Explained
Which products are covered by PSTI?
In one line: consumer products that can connect to the internet. Including but not limited to:
- Smartphones, tablets, computers
- Smart-home devices (cameras, speakers, doorbells, bulbs, sockets)
- Wearables (smart watches, bands)
- Connected appliances, connected toys
Not applicable:medical devices (separate regulation), smart meters (separate regulation), enterprise IT equipment, purely Bluetooth earphones (don't connect to the internet)
Three core requirements
Universal default-password ban
No factory default passwords (like admin/admin, 123456) allowed. Each device must use a unique password, or force the user to change it on first use. This is to fend off Mirai-style botnet attacks — the direct trigger for PSTI's enactment.
Vulnerability disclosure mechanism
The manufacturer must publicly publish a security-vulnerability reporting route: contact email, reporting process, and a promised response time. This isn't just a security@ email — you need a defined SLA.
Security update period statement
At product launch you must state the minimum period the product will receive security updates (e.g. "at least 3 years from purchase date"). And you must honour it after launch. If you claim 3 years but stop updating after 1 — that's a false statement and also punishable.
Compliance method: self-declaration + technical documentation on file
PSTI doesn't require third-party certification; the manufacturer self-declares (a Statement of Compliance). But you must keep technical documentation on file for inspection.
- Compliance period: about 1-2 weeks (document review + product inspection)
- No separate mark required (info is reflected on the product/packaging)
- Regulator: OPSS (Office for Product Safety and Standards)
PSTI vs EU cybersecurity requirements
PSTI is based on ETSI EN 303 645. The EU's RED cybersecurity requirements (EN 303 645 / Cyber Resilience Act) overlap with PSTI but aren't identical. If you export to both the EU and UK, it's best to build to the higher standard.
Which products don't need to worry about PSTI?
- Purely Bluetooth earphones/speakers (not connected to the internet via WiFi or cellular)
- Purely wired devices
- Non-consumer B2B devices
- Medical devices, smart meters (regulated separately)
👉 For more detailed UKCA+PSTI info: UK UKCA/PSTI certification wiki
Exporting connected products to the UK?
We'll assess your PSTI compliance status and prepare your Statement of Compliance
📞 Free Consultation