Compliance tools · Cybersecurity and data protection

PSTI Act 2022 compliance tool

PSTI Act 2022 (c. 46) · United Kingdom · Binding instrument

Name anyone on your staff. The system makes them your compliance person.

A member of your own staff, with no compliance background, reads the training module, answers the interview, and finishes with your PSTI Act 2022 documentation cited article by article. The knowledge stays in the business.

Every account level runs inside a dedicated Claude account. Anyone can try a toolkit in their own Claude account; compliance work runs in a dedicated one. The Claude Max plan is £90 a month, paid to Anthropic, and is not included in any level.

See a finished report before you pay

PSTI Act 2022 (c. 46) is a binding instrument in the United Kingdom. Security requirements for consumer connectable products sold in the UK.

The free assessment screens for PSTI Act 2022 when a business places physical products on the market, or manufactures goods, or imports goods. The Act covers internet-connectable and network-connectable consumer products.

Screen your business against all 116 agent toolkits, free →

• Your exact position under PSTI Act 2022: what is in place, what is missing, and what to do about each gap.
• Documentation with article citations, ready for auditors, insurers, customers and public buyers.
• A trained person inside the business who understands what the regulation requires, and stays.
• A dated record of every section completed, with the reports themselves staying in your own Claude account. The toolkit is carried by an account level, see the plans.
• All of it completed in-house, at your own pace, without booking a single meeting.

Check that PSTI Act 2022 applies to your business, free →

Does PSTI Act 2022 apply to my business?

The PSTI Act 2022 applies to you if you are a manufacturer, importer or distributor of internet-connectable or network-connectable consumer products made available to consumers in the United Kingdom, or an authorised representative acting for a manufacturer not established in the United Kingdom (Section 7, Section 51). A relevant connectable product is one that is internet-connectable or network-connectable and is not an excepted product (Section 4).

Who does PSTI Act 2022 apply to?

It applies to manufacturers, importers and distributors of relevant connectable products made available to consumers in the United Kingdom, and to authorised representatives acting for manufacturers not established in the United Kingdom (Section 7, Section 51). Part 2 applies to network operators exercising or seeking code rights, and to required grantors and site providers party to the notices, counter-notices and court proceedings.

Does PSTI Act 2022 apply to a small business?

The PSTI Act 2022 has no size threshold. The regime applies to any manufacturer, importer or distributor of internet-connectable or network-connectable consumer products sold in the United Kingdom regardless of size, and the compliance, record-keeping, notification and statement of compliance obligations apply to all relevant persons including small and medium-sized enterprises.

When does PSTI Act 2022 apply from, and what are the deadlines?

Part 1 came into force on 29 April 2024 by S.I. 2023/469, regulation 3, in so far as its provisions were not already in force. Notification deadlines run from the point a relevant person becomes aware of a compliance failure, not from a fixed calendar date, and must be met as soon as practicable or as soon as possible (Sections 11, 18, 24).

What does PSTI Act 2022 require me to do?

You must meet the applicable security requirements and produce, accompany, retain and publish statements of compliance, applied in parallel to manufacturers, importers and distributors. On becoming aware of a compliance failure you must remedy it as soon as practicable and notify the enforcement authority, and where specified conditions are met, affected UK customers, as soon as possible (Sections 11, 18, 24).

What records or documents does PSTI Act 2022 require me to keep or produce?

Manufacturers must maintain a written record of every investigation into a compliance failure or suspected compliance failure, and of every compliance failure itself, retained for 10 years from the day the record is made (Section 12). Importers carry an equivalent record-keeping and retention duty that also captures manufacturer-led investigations of which the importer becomes aware (Section 20).

What happens if I do not comply with PSTI Act 2022?

The maximum civil penalty for a single relevant breach is the greater of £10 million or 4 per cent of qualifying worldwide revenue for the most recent complete accounting period, with an additional daily penalty of up to £20,000 for a continuing breach (Sections 36 to 38, Section 37). Failure to comply with an enforcement notice is a criminal offence carrying an unlimited fine in England and Wales, or a fine up to level 5 on the standard scale in Scotland and Northern Ireland (Section 32, Section 45).

Does PSTI Act 2022 apply to a UK business selling into the EU?

The territorial scope of Part 1 is the United Kingdom: the duty attaches to a product made available to consumers in the United Kingdom, and to a relevant person acting in that market, regardless of where the relevant person is established. The instrument does not state how the Act applies to a UK business selling into the EU.

Does PSTI Act 2022 apply to an EU business selling into the UK?

The duty attaches to a product made available to consumers in the United Kingdom, and to a relevant person acting in that market, regardless of where the relevant person is established. An EU business selling into the UK market therefore falls within Part 1 on the same terms as a UK business.

How do I start complying with PSTI Act 2022?

The first practical step is to establish whether your product is a relevant connectable product, being internet-connectable or network-connectable and not an excepted product (Section 4). From there you meet the applicable security requirements and produce, accompany, retain and publish statements of compliance (Section 9).

Which ComplianceSME account includes the PSTI Act 2022 toolkit?

The PSTI Act 2022 agent toolkit is included in Compliance Complete.

Related in cybersecurity and data protection: GDPR · ePrivacy Directive · NIS2 Directive · CER Directive