The UK\u2019s consumer connected product security regime comes into effect three weeks today, 29 April 2024.\u00a0 The law will impact consumer products connected to the internet, such as smartphones, printers, speakers, fridges, doorbells: the list goes on.<\/p>\n
The law imposes obligations on manufacturers, importers and distributors (such as retailers),\u00a0no matter their location, if their product is for sale in the UK.<\/p>\n
Here, product law expert and Director at Fieldfisher,\u00a0Aonghus Heatley, explains what the law is and what you can do if you’re not already prepared.<\/p>\n
What is the new law?<\/strong><\/p>\n The\u00a0Product Security and Telecommunications Infrastructure Act 2022\u00a0(the\u00a0PSTI Act) aims to ensure that UK consumers are not put at risk by insecure technology products.<\/p>\n Aonghus explains:\u00a0“Smart devices have in the past been compromised at scale by cybercriminals. The objective of the new requirements is to prevent such security breaches, for example by strengthening default passwords. Other requirements (and more will be added in future) include providing information to the public on how to report security issues and on minimum security update periods (such as in an End-of-Life policy)”.<\/p>\n I’m a retailer, not a manufacturer \u2013 does it affect me?<\/strong><\/p>\n “Yes. If you are selling a product, it’s your responsibility to make sure the product complies with the new requirements.\u00a0 While many retailers have been actively driving compliance along their supply chains in anticipation of the 29 April commencement date, we are speaking with a number of retailers who were either unaware that the products they sell, even those already on their shelves or in their warehouses, must be in compliance with the regime’s requirements when it comes into effect or who have been unable to get their supply-chain partners \u2013 such as importers or manufacturers \u2013 to engage with them.\u00a0 Non-compliance could result in those retailers being criminally liable.<\/p>\n “Retailers are having to proactively discuss the new requirements with their supply-chains, many of which are of some length and complexity.\u00a0 In many cases, there are no direct contractual arrangements that can be relied upon to facilitate this.<\/p>\n “Retailers are also having to take practical steps themselves: the regime requires that products are accompanied by a ‘Statement of Compliance’ which retailers will need to enclose or affix to products which they currently hold.”<\/p>\n I’m a Spanish-based distributor \u2013 surely this doesn’t affect me?<\/strong><\/p>\n “If the product you are shipping is going to go on sale in the UK and you are responsible for importing it, the regulation does affect you. You could be committing a criminal act by shipping a non-compliant product to the UK.”<\/p>\n I have stock in a warehouse \u2013 surely this doesn’t have to comply?<\/strong><\/p>\n “Usually, new products laws affect products which are first placed on the market after the law comes into force. But that’s not the case here: the PSTI requirements will apply to products already in the supply chain.\u00a0 If, for example, you have stock in a warehouse awaiting distribution, it needs to be brought into compliance before 29 April.”<\/p>\n What if I’m not ready by 29 April?<\/strong><\/p>\n “It remains to be seen what enforcement posture the relevant regulator, the Office for Product Safety and Standards (OPSS), will take.\u00a0 While we have found them to be reasonable and pragmatic in the past, enhancing cybersecurity against malicious actors is a nationally important issue for the UK.\u00a0 This may result in the OPSS taking a harder line than might otherwise be expected, even where it is clear that a company has made all reasonable efforts try to ensure compliance on 29 April.<\/p>\n “The regulator is, we think, more likely to use\u00a0the carrot than the stick. That’s not to say if they came across an egregious example of non-compliance, they wouldn’t use that as an example to show they mean business. If, for example, you were selling a webcam for a child’s bedroom that could easily be hacked \u2013 for example, because it uses an easily guessable default password \u2013 you could find yourself facing criminal penalties.<\/p>\n “Some retailers will likely accept the risk of committing an offence by continuing to sell non-compliant products.\u00a0 Others will want to avoid the commission of an offence at all costs.\u00a0 We expect that there will be a large number of retailers which will try to take a middle-ground: trying to do what they can to ensure compliance, but without taking non-compliant products off the shelves on 29 April.”<\/p>\n What are the penalties of non-compliance?<\/strong><\/p>\n “Companies can be landed with fines of up to \u00a310 million ($12.73 million), or 4% of qualifying worldwide revenue, whichever is higher.”<\/p>\n Will the PTSI Act change?<\/strong><\/p>\n “The PSTI Act will be enhanced as technology evolves. If you consider that\u00a0three-quarters of UK homes\u00a0now contain some sort of smart device or appliance\u00a0the current household there can be no doubt that further regulations will be coming down the line.”<\/p>\n