PSTI: importing smart and connectable products into the UK

What PSTI covers

The Product Security and Telecommunications Infrastructure regime applies to consumer products that can connect to the internet, and to network-connectable products that meet specific conditions — smart plugs, cameras, speakers, wearables, lighting and appliances with an app. The security requirements have applied since 29 April 2024. Note that a product which merely pairs with one other non-internet device is not automatically caught.

Several categories are excluded, including desktop and laptop computers and non-cellular tablets, EV charge points, medical devices, smart metering products and motor vehicles. Smartphones and cellular tablets are not excluded — do not assume 'it is a computer' covers a phone. Check the current exclusions before deciding you are out of scope.

If you import a product that is in scope, the obligations land on you. The Chinese manufacturer is outside UK law, so being the importer makes you the party a regulator deals with.

The statement of compliance is the gating document

You may not make a connectable product available in the UK unless it is accompanied by a statement of compliance, and you must keep a copy. Without it you cannot legally sell the product, however good it is.

The statement must contain eight things, not three. Alongside the product type and batch, the manufacturer's name and address, and the defined support period, it must state that it was prepared by or on behalf of the manufacturer, carry the manufacturer's actual declaration that the product complies, identify any standard relied on with its version and date, and be signed and dated with the signatory's name, function and place of issue. The declaration itself is the substantive core — a document listing only product details is not a statement of compliance.

What to ask the factory for, before you order

Ask for the statement of compliance in writing at the quoting stage, along with the declared security update support period and confirmation of how the product handles default passwords and vulnerability reporting.

If a factory cannot produce a statement, or offers a generic certificate covering a different model, treat that as a sourcing decision rather than a paperwork problem: you would be the one placing a non-compliant product on the market.

You cannot knowingly supply a failing product

Importers may not supply a product where they know or believe the manufacturer has failed to comply — but that is one duty of several. You must also meet the security requirements yourself, investigate where you are told of a possible failure after supply, contact the manufacturer and notify the enforcement authority where a failure arises, and keep records of those investigations for ten years.

Keep the statement, the correspondence and the model numbers together, so you can show what you checked and when.

Where this fits with other marking

PSTI sits alongside, not instead of, the other requirements for electricals — conformity marking, electrical safety and, for many products, WEEE producer obligations. See our guides on certifications and on WEEE for those.

We ask for security documentation as part of specifying connectable products, so the statement exists before production rather than being chased after the container has sailed.