What the rules require

The UK’s consumer connected product security regime came into force on 29 April 2024. It requires manufacturers of connectable products to ban weak default passwords, publish a point of contact for reporting security issues, and state the minimum period during which security updates will be provided. The rules cover many consumer devices, including phones, televisions, fridges and smart doorbells. The Office for Product Safety and Standards (OPSS) is responsible for enforcement.

What it means for connected product makers

The requirements apply to products sold in the UK, so manufacturers and importers need to document how passwords are set, how vulnerabilities can be reported and how long updates will be supported. The government announcement describes the law as a way to protect consumers from cyber criminals. Companies that sell connected hardware into the UK should check their product documentation and support policies against these obligations. This article summarises the announcement and is not legal advice.