Selling smart devices? What the UK product security rules mean for retailers

If your business sells anything that connects to the internet or to other devices, a law that came into force on 29 April 2024 applies to you, and not only if you make the product. Many consumer gadgets that connect to the internet fall under the UK's product security regime. Plenty of small online shops, installers and resellers have never looked at it. This post explains, in plain terms, what the rules say, who they cover and what a sensible small business should do this week.

What the law is

The rules come from Part 1 of the Product Security and Telecommunications Infrastructure Act 2022 and the 2023 security requirements regulations. According to the government's guidance, the regime has applied since 29 April 2024. It is enforced by the Office for Product Safety and Standards (OPSS), which sits within the Department for Business and Trade.

The government's guidance sets out three security requirements for consumer connectable products:

• Universal default passwords and easily guessable passwords are banned.
• The manufacturer must publish how people can report security problems.
• The manufacturer must publish information on the minimum period for which the product will receive security updates.

Who is covered, and why a retailer should care

The guidance names four groups. The first is manufacturers, including anyone who has a product designed or made and sells it under their own name or trademark. The second is anyone who markets another manufacturer's product under their own name or trademark. The third is importers, who bring products into the UK from outside it. The fourth is distributors, which the guidance describes as retailers: anyone who makes a product available in the UK and is neither the manufacturer nor the importer.

That last group is the one many small firms miss. If you run an online shop selling smart home gadgets, or you supply and fit connected products for customers, you may be a distributor. The guidance says distributors must comply with the Act's obligations and the regulations' security requirements, including the duties around the statement of compliance. They also have duties to investigate potential compliance failures, to keep records and to act on failures.

If you put your own brand on a white label product from an overseas supplier, the first and second groups are the ones to read closely, because the manufacturer duties can land on you.

What the three requirements mean in practice

The detail sits in Schedule 1 of the regulations, which I read on legislation.gov.uk.

Passwords. Passwords must either be unique to each product or set by the user. A product-unique password cannot rely on sequential counters, public information or serial-number-style identifiers, unless it is protected by an approved method. Passwords also must not be easy to guess by industry standards. Cryptographic keys, certain pairing PINs for non-internet protocols and API keys are excluded.

Reporting problems. The manufacturer must publish at least one contact point for reporting security issues, and say when a reporter will get an acknowledgment and status updates until the issue is resolved. The information must be easy to find and understand, in English, free to access, and available without asking for personal data or a prior request.

Update periods. The manufacturer must publish the defined support period for security updates. If the period is extended, the new one must be published as soon as is practicable. The information must be understandable without technical knowledge, and on a sales page it must be shown alongside, or given equal prominence to, certain pricing information. If a published period is later shortened, the requirements are not met.

The statement of compliance

Products should come with a statement of compliance. The guidance says the Act requires it to "accompany" the product and defines it as a document, but it does not require a physical copy, so a digital version can work. This matters for online sellers: when you take a product from a supplier, ask for the statement and check that it is there before you list the item.

What is not covered

The guidance lists some exclusions:

• Electric vehicle charge points.
• Medical devices.
• Smart meter products.
• Desktop, laptop and tablet computers without cellular connectivity, unless designed exclusively for children under 14.
• Products made available in Northern Ireland under certain legislation listed in the Windsor Framework.
• Certain vehicles, since 25 February 2025.

Most ordinary consumer smart gadgets are not on that list, so assume a product is in scope unless you have confirmed otherwise.

What enforcement looks like

OPSS says it chooses proportionate action based on the facts of each case, aiming to prevent or reduce harm and change business behaviour. Its tools include a Compliance Notice, a Stop Notice, a Recall Notice, a Monetary Penalty and a Forfeiture Order. Failing to comply with a Compliance, Stop or Recall Notice is an offence.

The penalty ceiling is high. The fixed monetary penalty can be the greater of £10 million or 4% of qualifying worldwide revenue, with a daily penalty of up to £20,000 for continuing non-compliance. Those are maximums, and OPSS says it weighs factors such as harm, culpability, cooperation and compliance history. Before most notices or penalties, it issues a Notice of Intent, and you can make written representations within 10 days, or 28 days for monetary penalties. You can appeal to the First-tier Tribunal within 28 days.

OPSS also says it may publish details of compliance failures where that is in the public interest, even where no enforcement action is taken. For a small shop, the reputational side could matter as much as the fine.

The guidance does not say where enforcement will focus, so treat the approach as risk-based rather than relaxed.

A practical checklist for this week

• List what you sell. Mark every product that connects to the internet, Bluetooth or Wi-Fi.
• Work out your role. Are you a distributor, an importer or a brand owner? The duties differ.
• Ask suppliers for the statement of compliance for each in-scope product, and keep a copy.
• Check the product pages. Is the support period for security updates shown clearly next to the price? If not, ask the manufacturer for it.
• Test a sample unit. Does it ship with a shared default password such as a common word or number? If so, stop selling it and tell the supplier.
• Keep records. The guidance says there is a duty to maintain records but does not say what or for how long, so keep supplier details, statements and your checks together.
• Know who to tell. OPSS asks businesses to report compliance failures to opss.enquiries@businessandtrade.gov.uk, with details of the failure, the risks and the steps taken.

If you build the product or the software

If you design connected hardware, or an app that controls it, the three requirements become design decisions: how a device is first set up, where your vulnerability contact lives on your site, and how you commit to update periods. These are much cheaper to settle before launch than after. If you want help with the app, website or cloud side, our mobile apps and cloud and security pages explain how we approach it.

The short version

The law is not just for manufacturers. If you make connected products available to UK customers, check your role, get the paperwork from suppliers, show the update period clearly and keep records. An hour with a spreadsheet now is far cheaper than a Compliance Notice later. This post is general information, not legal advice, so check the official guidance for your own products.