Vulnerability Disclosure Policy Requirements for UK Smart Products

The UK Product Security and Telecommunications Infrastructure (PSTI) Act, effective April 29, 2024, establishes baseline cybersecurity requirements for consumer smart/IoT products sold in the UK — including unique default passwords, published vulnerability disclosure procedures, and clear minimum security-update periods — and imposes compliance obligations and recordkeeping on manufacturers with penalties up to £10 million or 4% of global revenue. The guidance explains scope, exemptions, compliance demonstration, expected market and security impacts, and recommends organizations review or implement vulnerability disclosure programs and other baseline controls.