Product Security and Telecommunications Infrastructure Act 2022

Part 1 gives ministers power to specify security requirements for relevant connectable products made available to UK consumers, and sets duties for manufacturers, importers and distributors: complying with the requirements, statements of compliance, investigating and acting on compliance failures, and keeping records. It provides enforcement notices, recall notices and monetary penalties. Part 2 amends the Electronic Communications Code and related law on the installation and sharing of telecommunications infrastructure.

It is the UK's baseline security law for consumer smart and internet-connected products, backed by regulations that ban universal default passwords and require vulnerability-reporting and security-update information.

Use it when making, importing or selling connectable consumer products in the UK, or for rights over telecoms infrastructure on land.

Manufacturers, importers and distributors of consumer connectable products in the UK; telecoms operators and landowners for Part 2.

CURRENT. Royal Assent 6 December 2022; the product security regime applies from 29 April 2024. Read the official PDF on this page for the operative text.

Sections 1-3 (security requirements) → duties of manufacturers → enforcement → Part 2.