What is the UK PSTI Act?
The Product Security and Telecommunications Infrastructure (PSTI) Act is UK law, in force since 29 April 2024, that sets minimum security requirements for consumer connectable products sold in the UK — most notably, banning universal default passwords.
The Act targets exactly the pattern this site's Compliance Index tracks: a single, shared default password (like admin/admin) that's identical across every unit of a product, documented and exploitable at scale. Under PSTI, manufacturers of new consumer IoT products — routers, smart cameras, connected doorbells, and similar — can no longer ship with this pattern; each unit must either have a unique default credential or force the user to set one before the device becomes usable.
The Act also requires manufacturers to publish a minimum security-update support period for each product, and to provide a public point of contact for reporting security vulnerabilities — requirements aimed at the broader IoT security problem beyond just default passwords.
PSTI applies to products first made available on the UK market from 29 April 2024 onward — it isn't retroactive to devices already sold before that date, which is part of why ssid.ai's Compliance Index still finds a meaningful share of tracked models (many older or non-UK-specific) shipping a universal default.
FAQ
- Does PSTI apply to routers sold outside the UK?
- PSTI is UK law specifically — it governs products made available on the UK market. A router sold only in other markets isn't directly bound by it, though manufacturers selling globally often apply the same safer credential pattern across all markets rather than maintaining a UK-specific variant.
- What counts as a "consumer connectable product" under PSTI?
- Broadly, internet- or network-connectable consumer products — routers, smart home devices, connected appliances, wearables, and similar. The Act has some exclusions (certain medical devices, smart meters covered under separate regulation, and a few other categories).
- Is the EU Cyber Resilience Act the same as PSTI?
- No — they're separate laws in different jurisdictions with overlapping but not identical requirements. The EU's Cyber Resilience Act (and the related Radio Equipment Directive) targets similar default-password and security-update problems across EU member states.