UK government guidance says the consumer connectable product security regime came into effect on 29 April 2024. It addresses manufacturer, importer and distri
Official source publication date: . AndroidSBC review date: 2026-10-26.
What does the UK government guidance require businesses to consider?
The UK consumer connectable product security regime took effect on 29 April 2024. Government guidance describes duties for manufacturers, importers and distributors of products that fall within scope.
Key points from the official publication
- Products in scope must meet the applicable security requirements before being made available to UK consumers.
- The regime addresses universal or easily guessable default passwords, a public route for reporting security issues, and transparency about the minimum security-update period.
- A Statement of Compliance must accompany an in-scope product and contain the information required by the legislation.
- Manufacturers, importers and distributors have different statutory duties, including action where they know or believe a compliance failure exists.
- Scope and exemptions must be checked against the finished connectable product; a component board and the marketed final device are not automatically treated as the same product.
Practical actions for an Android product project
- Specify unique credential and first-boot provisioning behavior.
- Publish a vulnerability disclosure contact and handling process.
- State the minimum supported security-update period for the finished product.
- Assign responsibility for the Statement of Compliance and retain supporting records.
What does this mean for Android board and embedded-device projects?
Projects should document unique credential behavior, vulnerability-reporting contact details, the declared minimum security-update period and the Statement of Compliance process. Confirm whether the finished product is in scope; an Android board component is not automatically equivalent to the marketed finished device.
What should buyers and engineering teams verify?
- The exact board, PCB revision, SoC, BSP branch, kernel and Android build.
- The finished product’s intended use, wireless modules, enclosure and destination market.
- Security-update ownership, vulnerability contact, support period and incident process.
- Which controlled report, declaration or certificate applies to the exact configuration.
This article is an engineering summary, not legal or conformity-assessment advice. Requirements can change; confirm the current official text and obtain qualified local advice for the finished product.
Buyer FAQ
Common procurement and engineering questions related to this update are answered below. Project decisions must use the current official requirements and the exact product configuration.
Does UK PSTI apply to every industrial Android motherboard?
Not necessarily. Scope is assessed for the relevant consumer connectable product and the role of each business in its supply chain. The finished product, intended market and applicable exclusions must be reviewed.
What security information should be agreed before UK supply?
Agree credential behavior, vulnerability-reporting contact, minimum security-update period, supported versions, update delivery and the party responsible for the Statement of Compliance and retained evidence.
Can the board supplier issue the finished product Statement of Compliance?
Only if that supplier is the responsible party for the in-scope finished product and can support the required declaration. Component information can assist, but responsibilities must not be assumed or transferred implicitly.
Official primary source
Primary source
UK Department for Science, Innovation and Technology
Read the original official publication
Source URL: https://www.gov.uk/government/publications/the-uk-product-security-and-telecommunications-infrastructure-product-security-regime
Editorial note: This is an original AndroidSBC engineering summary of the cited official publication. It is not legal advice and does not claim that every Android board or finished device is certified for the named market.
