Key takeaways
- UK PSTI doesn't just require a device to meet its three Schedule 1 security requirements; it requires the manufacturer to write that claim down, in a specific format, and keep it on file.
- A manufacturer can fail section 9 (no statement, or an incomplete one) even if the product itself genuinely meets the security requirements — the paperwork obligation is independent of the technical one.
- Regulation 7 of the PSTI Security Requirements Regulations 2023 (SI 2023/1007) points to Schedule 4 for the statement's required content.
- Note that the clock for both runs from the date the statement was issued, and the comparison is against the support period stated in the document, not a support period decided later.
UK PSTI doesn't just require a device to meet its three Schedule 1 security requirements; it requires the manufacturer to write that claim down, in a specific format, and keep it on file. That document is the statement of compliance, created under section 9 of the Product Security and Telecommunications Infrastructure Act 2022. It is a self-declared conformity document, similar in spirit to an EU declaration of conformity, and its exact required contents sit in secondary legislation most device makers never read until an enforcement authority asks for it.
The two separate duties
PSTI actually creates two distinct obligations, in two sections of the Act:
| Section | Duty |
|---|---|
| Section 8 — Duty to comply with security requirements | The product itself must meet the applicable Schedule 1 security requirements (or Schedule 2 deemed-compliance conditions) |
| Section 9 — Statements of compliance | The manufacturer must separately draw up a document stating, in its own opinion, that it has met those requirements |
A manufacturer can fail section 9 (no statement, or an incomplete one) even if the product itself genuinely meets the security requirements — the paperwork obligation is independent of the technical one.
The seven items Schedule 4 requires
Regulation 7 of the PSTI Security Requirements Regulations 2023 (SI 2023/1007) points to Schedule 4 for the statement's required content. Schedule 4 lists seven items:
The product— identified by type and batch. Name and address of each manufacturer, and of each authorised representative where one applies. A declaration that the statement is prepared by or on behalf of the manufacturer A declaration of compliance, stating the manufacturer's opinion that it has met either the Schedule 1 security requirements, or the Schedule 2 deemed-compliance conditions (compliance achieved through a specified standard or scheme). The defined support periodfor the product, as it stood when the manufacturer first supplied the product. Signature, name and function of the signatory The place and date of issueof the statement.
Where the statement refers to compliance with a named standard, Schedule 4 also requires the standard's identification number, version and date of issue to be included.
Who keeps it, and for how long
| Role | Regulation | Retention period |
|---|---|---|
| Manufacturer | Regulation 8 | Whichever is longer: 10 years from issue, or the product's defined support period |
| Importer | Regulation 9 | Same test: whichever is longer, 10 years from issue or the support period |
Note that the clock for both runs from the date the statement was issued, and the comparison is against the support period stated in the document, not a support period decided later. A manufacturer that extends a product's support period after issuing the original statement should consider whether a fresh statement is warranted, since the retained document is what an enforcement authority will check against.
What the statement is not
A PSTI statement of compliance is a self-declaration, not third-party certification. Nothing in sections 8 or 9 requires an independent lab or certification body to test the product before the manufacturer signs it. This is a lighter-weight regime than, for example, UK conformity assessment routes that require a notified body, and it puts the legal risk of an inaccurate statement squarely on the manufacturer and the signatory named in Schedule 4 item (f). See our UK PSTI and US Cyber Trust Mark guide for how this self-declaration approach compares with PSTI's own enforcement penalties and with the US programme's third-party testing model.
Building the statement from what you already need for PSTI
Most of a Schedule 4 statement reuses work a manufacturer has already done for PSTI's three substantive Schedule 1 requirements:
- The support-period item (e) is the same figure you must already publish, in English and free of charge, under the Schedule 1 update-period requirement — see our vulnerability disclosure policy and security.txt guide for the related reporting-contact piece of PSTI.
- The compliance declaration (item d) is where your internal evidence — password-uniqueness design, the published vulnerability-reporting contact, and the update-period commitment — gets turned into a signed statement rather than left as internal records.
- Items (a), (b), (f) and (g) are administrative: product identification, manufacturer details, signatory and date. These are the items most often missed when a statement is drafted once and never updated for a new batch or model variant.
What device makers should do now
Draft a Schedule 4 templatecovering all seven items, not just the compliance declaration, so a new product line only needs its product-specific facts filled in. Name a real signatorywith an actual function/title, per item (f) — not a generic "Compliance Department" line. Tie the support-period figure in item (e) to the one already publishedunder Schedule 1, so the two documents cannot drift apart. Set a retention clock per product batch, tracking the longer of 10 years or the stated support period, and keep it alongside your technical file, not just in a signed-and-filed folder. Brief your importersRegulation 9 makes an importer independently responsible for retaining a copy — if they never receive one from you, they cannot meet their own PSTI duty. Keep a separate file for the EU sideA PSTI statement of compliance does not substitute for an EU declaration of conformity under the Cyber Resilience Act — the two markets use different legal mechanisms even where the underlying security work overlaps.
SoftWSP can check a device's documentation, including the statement of compliance, against PSTI's Schedule 1 requirements and Schedule 4 format alongside EU CRA work: see device firmware security.
This guide is general information, not legal advice.
Sources
- UK Public General Acts: Product Security and Telecommunications Infrastructure Act 2022, c. 46, section 8
- UK Public General Acts: Product Security and Telecommunications Infrastructure Act 2022, c. 46, section 9
- UK Statutory Instruments: The Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023 (SI 2023/1007), regulation 7
- SI 2023/1007, Schedule 4 (statement of compliance contents)
- SI 2023/1007, regulations 8 and 9 (retention by manufacturer and importer)
- UK government: the UK Product Security and Telecommunications Infrastructure (PSTI) product security regime
Frequently asked questions
What is a PSTI statement of compliance?
It is the document a manufacturer must draw up under section 9 of the Product Security and Telecommunications Infrastructure Act 2022, stating the manufacturer's own opinion that a relevant connectable product meets the applicable security requirements. Section 8 of the Act creates the underlying duty to comply with the security requirements in the first place; section 9 creates the separate duty to produce this statement.
What exactly must the statement of compliance contain?
Schedule 4 to the Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023 (SI 2023/1007) lists seven items: (a) the product, by type and batch; (b) the name and address of each manufacturer and, where applicable, each authorised representative; (c) a declaration that the statement is prepared by or on behalf of the manufacturer; (d) a declaration that, in the manufacturer's opinion, it has complied with either the Schedule 1 security requirements or the Schedule 2 deemed-compliance conditions; (e) the defined support period that was correct when the manufacturer first supplied the product; (f) the signature, name and function of the signatory; and (g) the place and date of issue.
How long does a statement of compliance have to be kept, and by whom?
Regulation 8 requires the manufacturer to retain a copy for whichever is longer: 10 years from the date the statement was issued, or the product's defined support period. Regulation 9 places the same retention duty on importers, who must also keep a copy for whichever of those two periods is longer, even though they did not draw the statement up themselves.
Can a shorter summary be given out instead of the full statement?
Section 9 of the Act allows a manufacturer to make available either the statement of compliance itself or a summary of it. The current regulations set out Schedule 4's content requirements for the full statement; the exact minimum content a summary version must still cover is not separately itemised in the Regulations in the same way, so a manufacturer relying on a summary should check the Regulations' current text and OPSS guidance before dropping any Schedule 4 item from it.
Is one statement of compliance enough for a whole product range, or does each unit need its own?
Schedule 4 item (a) requires the statement to identify the product by type and batch, and the Act allows multiple manufacturers to jointly prepare a single statement for a product. In practice this means a statement of compliance is issued per product type/batch, not reissued for every individual unit, but a new batch with a materially different build or support-period commitment needs its own statement reflecting the facts that were correct for that batch.
In this cluster
