HANSARD
Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) (Amendment) (No. 2) Regulations 2025
- Considered in Grand Committee
- 4:15 pm
- Moved by
- That the Grand Committee do consider the Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) (Amendment) (No. 2) Regulations 2025.
- Thank you very much. These draft regulations will be made under powers provided by the Product Security and Telecommunications Infrastructure Act 2022, also known as PSTI. The world-leading PSTI regulatory regime came into force on 29 April 2024. It better protects consumers, businesses and the wider economy from the harms associated with cyberattacks on consumer connectable products, such as mobiles, smart appliances and smart cameras.The law does so by banning the use of universal default or easily guessable passwords, such as “admin123”, reducing one of the most commonly exploited vulnerabilities in connectable products. Manufacturers must also ensure that they are transparent about the minimum length of time for which they will provide the much-needed security updates that patch vulnerabilities. They must also publish information on how to report security vulnerabilities directly to them and provide status updates about the reported issues.The PSTI Act was the world’s first legislation of its kind, but we are not alone in our commitment to improve the security of connected products. The UK advocates an industry-led, multi-stakeholder approach to standardisation, ensuring that technology and cyber standards are market driven, reflecting global best practices and delivering benefits for industry and citizens—contrasting with government-driven approaches, where standards are sometimes used to pursue political goals and ambitions.Across the world, countries that share our values are taking action. Two such countries are Japan and Singapore. Japan’s Ministry of Economy, Trade and Industry launched the Japan cyber-security technical assessment requirements labelling scheme for IoT products —JC-STAR—in March 2025. Similarly, the Cyber Security Agency of Singapore launched its cybersecurity labelling scheme for consumer smart devices in March 2020. Both the Japanese and Singaporean labelling schemes require manufacturers to ensure that their products meet a set of baseline security requirements that are based on the global standards of the cybersecurity for consumer internet of things from the European Telecommunications Standards Institute, also known as ETSI EN 303 645. This is a standard that the UK developed in partnership with over 90 other countries and to which we aligned our own security requirements.Officials have carefully reviewed the requirements of the schemes, and they both require unique passwords, vulnerability reporting and a period of product support. As such, products issued with a valid label under either scheme will therefore have an equivalent or greater level of cybersecurity than that required under the UK’s PSTI regime. There is, therefore, no security advantage in duplicating compliance processes for manufacturers that have already met these equivalent or higher security standards. Our focus is on removing undue burdens from businesses, reducing unnecessary costs and opening the door for UK businesses to succeed in markets around the world. Subject to the approval of this House, this draft instrument will establish two alternative routes for manufacturers of consumer connectable products to demonstrate compliance with the UK’s product security regime.
- My Lords, I have some sympathy for the Minister, with this being her first time going into something like this. This is not an area that I usually cover. Acronym hell may not be here, but you can see it from the edge of this debate.Basically, we are talking about something that makes trade easier and compatible. The instrument talks about making sure that things are safer in the current digital age. That is all to the good, but I have a couple of questions. How are we doing ongoing equivalence and oversight? How are we looking to make sure that we stay in touch with the regimes? How much are foreign regimes being monitored to make sure that this is all ongoing and happening?Also, what about the economic quantification? That is an important way of asking how practical it is, especially for smaller users and consumers in this field. Are we doing anything to make sure that it is practical and will work if you are an SME? That is very important because we may have made a wonderful thing that looks great on paper and in theory—probably on a computer screen, in this case—but how will it work in practice? How are we going to monitor that on the way through?Of course, a degree of congratulation is in order to any Government who make trade easier. How will this measure be used to make trade easier? Can the Minister give an example of how trade will be done more easily? I am struggling for the right word, but how will we make our regime more compatible with other regimes? Our biggest trading partner is still the European Union. How will our regime be more compatible with the EU’s? These are just a few things I hope the Minister will clarify when she responds.
- My Lords, I join the noble Lord, Lord Addington, in welcoming the Minister to her first appearance in Grand Committee. What better example could she have of the way in which things can develop in this place where there is agreement on all sides? She may have felt on Monday that it was not possible to reach agreement on the matters before us then, when she played a prominent part. Although the House of Lords has expressed its views strongly, I still think there is room for agreement, which I very much hope will follow. Having said that, perhaps I may set an example of what can be done and say that I approach this statutory instrument in a constructive spirit because we support cybersecurity protections for consumers.The UK consumer device security regime, which was introduced under the previous Government, set an important international benchmark. As more of our daily lives depend on connected devices, it is vital that products are secure by design and that consumers are protected from avoidable vulnerabilities. These regulations provide a practical amendment to the existing framework through recognising Singapore’s cybersecurity labelling scheme and Japan’s Japan JC-STAR STAR-1 as equivalent to our baseline. They remove unnecessary duplication for manufacturers, while at the same time maintaining consumer safety. Where trusted partners meet high standards—rooted, as the noble Baroness has just pointed out, in the same ETSI framework underpinning the UK regime—it is reasonable to avoid repeat testing and reduce barriers to trade. Therefore, we do not oppose the SI but, rather like the noble Lord, Lord Addington, I have a number of questions. I hope the Minister will be able to clarify a few points.My first question is similar to that of the noble Lord, Lord Addington. How will the Government monitor ongoing equivalence? The Singaporean and Japanese schemes may evolve. If their requirements then diverge from the UK’s baseline, what mechanism will be used to reassess or revoke recognition? If they move too far in the wrong direction, what will we do? As the noble Lord pointed out, this is particularly important for small and medium-sized enterprises that need some certainty about the way in which these regulations will be enforced. Secondly, on enforcement, where a product enters the UK market with a foreign label, will our regulators have access to the evidence underpinning that certification? What steps will be taken if a certified product is later found to contain vulnerabilities? Finally, while the impact is assessed as below the threshold for a full assessment, can the Minister share any indicative estimates of the expected benefits to business, whether in reduced compliance costs or faster access to market?
- 4:30 pm
- I thank both noble Lords for the fact that we find ourselves in agreement on the fundamental principle underlying this SI: common cybersecurity standards that facilitate trade are a good step forward for the UK and for global cybersecurity.I come to some of the questions raised. Regarding how this regime will be enforced, the Office for Product Safety and Standards is the regulator of the PSTI regime. It has a comprehensive set of enforcement powers and can act against any business found to be non-compliant. Only products with a valid, unexpired label, under either the Japanese or the Singaporean scheme, can be made available, and if a product is subsequently found to have a security risk, the enforcement body—the OPSS—can act in line with its published enforcement policy to ensure that consumers are protected from harm.Equally, Japan and Singapore have regulators overseeing their regimes. The Japanese Ministry of Economy, Trade and Industry and the Cyber Security Agency of Singapore are responsible for enforcing their respective labelling schemes. Although the mutual recognition pathway streamlines compliance, it does not remove accountability, and the OPSS will continue to monitor market activity and enforce if it sees any security failures. In addition, the Government will continue to engage with our international partners to ensure that the recognised schemes remain aligned with UK standards. That is part of this proposal.In respect of the EU, ETSI EN 303 645 is the international standard for consumer devices, and EU members follow it. As noble Lords will know, the EU has the CRA, which covers more than the PSTI, some of which has not yet come into effect. We are considering how best to align with that regime, which is quite different in nature.If the standards change fundamentally, both MoUs allow us to disengage, and the SI applies to these specific Japanese and Singaporean standards only. If they change too much, it would be invalid. That should provide some reassurance that these standards are equivalent, there are processes to ensure that they remain equivalent, and we can disengage if we need to.
- Motion agreed.