Draft Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) (Amendment) (No. 2) Regulations 2025

The Japanese and Singaporean labelling schemes require manufacturers to ensure that their products meet a set of baseline security requirements that are based on European Telecommunications Standards Institute standard EN 303 645 on cyber-security for consumer IOT products—a standard that the UK developed in partnership with over 90 countries and to which we aligned our own security requirements. Products issued with a valid label under either scheme will therefore have an equivalent or greater level of cyber-security than required under the UK’s PSTI regime.

There is no security advantage in duplicating compliance processes for manufacturers that have already met equivalent or higher security standards. Our focus must be on removing undue burdens from businesses, reducing unnecessary costs and opening the door for UK businesses to succeed in markets around the world. Subject to the approval of the House, the draft regulations will establish two alternative routes for manufacturers of consumer connectable products to demonstrate compliance with the UK’s product security regime.

On 23 October, at Singapore international cyber week 2025, the UK’s Department for Science, Innovation and Technology and Singapore’s Cyber Security Agency formally signed a memorandum of understanding on the mutual recognition of consumer internet of things cyber-security regimes. The UK will also shortly be signing an MOU with Japan. Those MOUs represent a significant step forward in our international collaboration on digital security and innovation. They each establish a framework for recognising cyber-security certifications across borders. When both MOUs come into effect, UK businesses will benefit from streamlined access to the Japanese and Singaporean labelling schemes, boosting their product credibility and market appeal in those regions. The draft regulations will enable the UK to uphold its commitments, allow Japanese and Singaporean businesses to trade more easily with our market and reinforce our shared dedication to securing the connected device supply chain.

Regulations 4 and 8 amend the 2023 regulations to provide for deemed compliance with the requirement under section 9 of the 2022 Act that relevant connectable products must be accompanied by a statement of compliance. Under new regulation 4A and schedule 2A to the 2023 regulations, a manufacturer will be deemed to have complied with this requirement where the relevant connectable product carries a valid label under Japan’s JC-STAR STAR-1 labelling scheme, or a label under any level of the Singapore cyber-security labelling scheme. Regulations 5 to 7 amend schedule 2 to the 2023 regulations to provide for deemed compliance with other relevant security requirements set out in schedule 1 to those regulations, where a manufacturer’s product carries either such label. Regulation 3 inserts definitions of Japan’s JC-STAR STAR-1 scheme and the Singapore cyber-security labelling scheme into the 2023 regulations for the purposes of the deeming provisions.

Cyber-security is not just a technical issue; it is a strategic priority. By aligning with like-minded nations and reducing unnecessary barriers to trade, we are strengthening our digital resilience, supporting UK businesses and protecting our consumers. The UK must continue to lead by example, championing the global adoption of cyber-security standards and advancing mutual recognition, which are both a vital part of establishing a trusted global supply chain of connected products.

These new mutual recognition arrangements, which will be implemented in part by the draft regulations, will not only reduce the regulatory burden on businesses, but streamline compliance and support our ambition to make the UK a more attractive and competitive market for secure digital products. The draft regulations will extend and apply to the whole of the United Kingdom and will have practical effect throughout the United Kingdom. I hope the Committee will recognise their importance.

Diversifying the supply chain and the market for internet-connectable products has benefits for price competition, product choice and consumer confidence. It also reduces over-reliance on exports from individual states in an era of increasing geopolitical tensions. Charles Parton, senior research fellow in international security at the Royal United Services Institute, has highlighted the multifaceted risks of over-reliance on Chinese cellular internet of things modules, or CIMs. Those are hardware components that enable internet of things devices to connect to the internet via cellular networks, and they are essential for devices that need remote connectivity without relying on wi-fi or wired networks. Chinese products already have more than 50% of the international market for those components. While the use of CIMs is widespread, the option of purchasing products from strategic partners with common security concerns and goals is likely to assist in improving consumers’ ability to choose the most secure products.

For the reasons that I have stated, we are supportive of the regulations. Nevertheless, I would be grateful if the Minister could answer a couple of questions. What assessment was undertaken to determine the equivalence of the Japanese and Singaporean regimes? Can the Government quantify, either in value or in volume, the trade that the regulations are expected to deliver in the first year, if not in coming years?

This growing connectivity brings convenience but also new risks. The Government have taken action to ensure that UK consumers and businesses purchasing consumer connectable products are better protected from the risk of cyber-attacks, fraud or even, in the most serious cases, physical danger. The cyber-security regulatory landscape is evolving, with countries around the world, including Japan and Singapore, introducing similar regimes. The UK must remain agile and forward-looking to maintain its leadership in this space. The draft regulations will ensure that the UK remains a global leader in product cyber-security, while strengthening our position as an attractive destination for digital innovation and trade.

By recognising Japanese and Singaporean IOT labelling schemes, we are reducing unnecessary regulatory burdens, supporting UK businesses to expand internationally and enabling Japanese and Singaporean manufacturers to bring compliant products to our market more efficiently. This measure is a practical step forward in delivering the Government’s mission to drive economic growth and build a more resilient digital economy. It also complements our efforts to harmonise security standards across major economies, in partnership with Brunei, the United Arab Emirates, Australia, Germany, Finland, South Korea, Canada, Japan, Singapore and Hungary, via the global cyber-security labelling initiative. With forecasts suggesting that the global IOT market will grow to 24.1 billion devices by 2030, generating more than £1.1 trillion in annual revenue, it is more essential than ever that we enhance the security of connected products on a global scale.