PSTI and the Cyber Security and Resilience Bill
PSTI sets security rules for connectable consumer products and has been in force since April 2024. The Cyber Security and Resilience Bill (CSRB) would regulate services and the systems behind them. A connected-device business could face both.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
The short answer
PSTI covers the security of connectable consumer products. The Cyber Security and Resilience Bill (CSRB) covers the security of services and the systems behind them. A company can fall under one, both or neither.
The Product Security and Telecommunications Infrastructure Act 2022 product regime started on 29 April 2024 and is already law. The Bill has not yet passed.
How they compare
| PSTI product security regime | Cyber Security and Resilience Bill | |
|---|---|---|
| What it regulates | Consumer connectable products | Essential, digital and managed services, data centres, load controllers and critical suppliers |
| Who has duties | Manufacturers, importers and distributors | Regulated organisations and designated suppliers |
| Main requirements | No universal default or easily guessable passwords; a published way to report security issues; published minimum security update periods | Manage risks to systems; report incidents; notify customers, for some categories; register, for some categories |
| Enforcer | Office for Product Safety and Standards, for DSIT | Sector regulators and the Information Commission |
| Maximum fine | Up to £10 million or 4% of qualifying worldwide revenue, whichever is greater | Up to the greater of £17 million and 4% of turnover |
| Status | In force since 29 April 2024 | Not yet law |
What PSTI covers
PSTI applies to consumer products that connect to the internet or a network, such as smartphones, smart speakers, connected fridges and doorbells. Excluded products include:
- electric vehicle charge points
- medical devices
- smart meter products
- desktops, laptops and tablets without cellular capability, unless designed exclusively for under-14s
- certain vehicles, since 25 February 2025
Each product must also be accompanied by a statement of compliance, which may be digital.
PSTI does not generally regulate enterprise products sold only to businesses. Check the legal definitions if your product could reach consumers.
Where the two could overlap
A smart product with a cloud service. A smart camera may have to meet PSTI rules as a product, while the provider's cloud platform might be a separate question under the Bill's cloud definition. Check the definition, because the service must meet tests including on-demand, self-service access to scalable computing resources.
Energy smart appliances. The Bill brings in large load controllers, and refers to relevant energy smart appliances when measuring a controller's capacity. The device maker and controller may have different duties.
A product business with managed services. A connected-device company that also manages customer IT could be an RMSP for that service, unless the size exclusion applies.
Selling to regulated customers. A manufacturer may be asked for security commitments by regulated customers, and could be considered for critical supplier designation if it supplies directly to one and the impact test is met.
Where they don't connect
Meeting one regime won't satisfy the other. PSTI's three product requirements won't prove you manage risks to the systems behind a service, while a mature service-security programme won't produce the compliance statement or published update period a product needs.
Incident reporting is also different. The Bill sets 24-hour and 72-hour reporting for regulated services. PSTI requires a way for people to report security issues, plus action if you find a compliance failure, which is a different kind of obligation.
A practical check for product companies
- List products and sales channels. Could consumers buy this product in the UK?
- List services separately. Include apps, cloud platforms, remote management and support access.
- Record your role. You might be the manufacturer, importer or distributor for one product and just a distributor for another.
- Check the size test for service categories. Micro and small enterprises are excluded from RDSP and RMSP status. See our small business guide. PSTI does not rely on that exclusion.
- Connect vulnerability handling. Use your PSTI reporting channel as an input to your incident process, so that serious reports reach the right people.
- Check update commitments. Make sure support periods you publish match what your teams can deliver.
- Look at EU sales. The EU Cyber Resilience Act sets wider rules for products with digital elements.
Sources
Frequently asked questions
No universal default or easily guessable passwords, a published way to report security issues, and published minimum security update periods, plus a statement of compliance.
No. They regulate different things, and a product requirement will not prove you manage the risks behind a service.
The Office for Product Safety and Standards, on behalf of DSIT.
The Bill’s micro and small exclusion does not apply to PSTI. Check your role under PSTI separately.