Advice for manufacturers on the coming PSTI regulation

This report summarizes the UK PSTI Act 2022 and the Security Requirements for Relevant Connectable Products Regulations 2023, effective 29 April 2024, detailing obligations for manufacturers, importers, distributors, and authorized representatives. It highlights core security requirements—unique or user-defined passwords, declared support lifecycles, a vulnerability disclosure policy, and a mandated compliance statement—alongside OPSS enforcement powers and significant penalties (including daily fines up to £20,000 and maximum penalties of £10M or 4% global revenue). The document advises proactive compliance steps such as secure-by-design practices, vendor PoC testing, incident preparedness, and training, while noting supply chain considerations for non-compliant products.