How UK law now sets minimum security standards for smart devices

For years, connected gadgets were sold with little information about how long they would stay secure, and some shipped with the same default password on every unit. A UK law now sets a baseline that manufacturers, importers and retailers have to meet.

The rules come from the Product Security and Telecommunications Infrastructure Act 2022, often shortened to PSTI. The consumer product security part of the regime has applied since April 2024.

What the law requires

The regime applies to consumer products that can connect to the internet or to other devices. That covers smartphones, smart TVs, smart speakers, connected cameras and doorbells, wearables, games consoles, routers and many smart home appliances.

Manufacturers have to meet three core requirements.

No universal default passwords. A device cannot ship with a password that is the same across every unit, such as "admin" or "password", or one that can easily be guessed from public information. It must either have a unique password per device or make the user set their own when setting it up.

A way to report security flaws. The manufacturer must publish a point of contact so that security researchers and members of the public can report vulnerabilities, and must say how quickly they will acknowledge reports and keep the reporter updated.

A stated minimum support period. The manufacturer must tell buyers the minimum length of time for which the product will receive security updates. This has to be published in a clear and accessible way and provided at the point of sale.

Importers and distributors, including retailers, have duties too. They must not sell products they know or suspect do not comply.

Some products are outside this regime because they are covered by other rules, including vehicles, smart meters, medical devices and electric vehicle chargers. Desktop and laptop computers are also generally excluded.

Why the support period matters

Every connected device runs software that will eventually contain security flaws. Updates fix those flaws. Once a manufacturer stops issuing them, any newly discovered weakness stays open for good, and a device that still works perfectly can become a way into your home network.

Before the law, buyers often had no way of knowing whether a cheap smart plug would be supported for months or years. The support period now has to be stated, so it can be compared alongside price and features.

The law sets a minimum disclosure, not a minimum length. A manufacturer can choose a short period, but it has to say so.

How to check before you buy

The support period should be shown on the product listing, the packaging or a linked page from the retailer or manufacturer. It is often described as a "minimum security update period" and may be given as an end date.

A few practical habits help:

• For devices you expect to keep for a long time, such as a TV or router, look for a support period that matches how long you plan to use it.
• Check how updates are installed. Automatic updates are the safest option for most people.
• If a device asks you to set a password during setup, choose a strong one rather than reusing a password from elsewhere.
• Be cautious with very cheap unbranded devices from online marketplaces, where it can be harder to identify who is responsible.

Enforcement and reporting problems

The regime is enforced by the Office for Product Safety and Standards, part of the Department for Business and Trade. It can issue notices, require products to be withdrawn or recalled, and impose financial penalties.

If you come across a device that seems to break the rules, such as one with a shared default password or no stated support period, you can report it through Citizens Advice's consumer service, which passes cases to Trading Standards.

The National Cyber Security Centre publishes free guidance on setting up smart devices securely at home, including how to check that updates are switched on.