OpenLegislation

The Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) (Amendment) (No. 2) Regulations 2025

Draft. This instrument was laid in draft and may differ from the one made. Look for the made version under its title.

Draft 2025, ISBN 9780348275384

Original text. legislation.gov.uk does not revise statutory instruments, so later amendments are not shown here. Changes made to it are listed under each provision when known.

Draft Regulations laid before Parliament under sections 3(3), 9(9) and 77(5) of the Product Security and Telecommunications Infrastructure Act 2022 (c. 46), for approval by resolution of each House of Parliament.

CONSUMER PROTECTION

Made ***

Coming into force

The Secretary of State makes these Regulations in exercise of the powers conferred by sections 3(1), 3(2)(a), 9(7) and 77(2)(a) of the Product Security and Telecommunications Infrastructure Act 2022f1 (“the 2022 Act”).

A draft of these Regulations has been laid before, and approved by, both Houses of Parliament in accordance with sections 3(3), 9(9) and 77(5) of the 2022 Act.

Annotations to the whole text

Footnotes

f1

2022 c. 46. See sections 3(4) and 9(8) for the definition of “specified”.

Contents

  1. 1Citation, commencement, extent and interpretation
  2. 2Amendment to the 2023 Regulations
  3. 3Amendment to regulation 2
  4. 4Insertion of regulation 4A
  5. 5Amendments to Schedule 2
  6. 6Regulation 6
  7. 7Regulation 7
  8. 8Insertion of Schedule 2A
  9. Signature
  10. Explanatory note

1Citation, commencement, extent and interpretation

(1)

These Regulations may be cited as the Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) (Amendment) (No. 2) Regulations 2025.

(2)

These Regulations come into force on the day after the day on which they are made.

(3)

These Regulations extend to England and Wales, Scotland and Northern Ireland.

(4)

In these Regulations, “the 2023 Regulations” means the Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023f1.

2Amendment to the 2023 Regulations

The 2023 Regulations are amended in accordance with regulations 3 to 8.

3Amendment to regulation 2

In regulation 2 (interpretation) in paragraph (1), at the appropriate places insert—

  • ““Japan JC-STAR STAR-1” means the Labeling Scheme based on Japan Cyber-Security Technical Assessment Requirements (JC-STAR) STAR-1 Conformance Requirements and Assessment Methods published by the Information-technology Promotion Agency, Japan (JST-CR-01-01-2024R1, December 2024)f1;”;

  • ““Singapore Cybersecurity Labelling Scheme” means the Cybersecurity Labelling Scheme published by the Cyber Security Agency of Singapore, the specifications for which are in document CCC SP-151-2 CLS(IoT) Scheme Specifications (version 1.4, April 2025)f2.”.

4Insertion of regulation 4A

After regulation 4, insert—

“Deemed compliance with the requirement to have a relevant connectable product accompanied by a statement of compliance

4A

Schedule 2A specifies the conditions under which a manufacturer is to be treated as having complied with the requirement to have a relevant connectable product accompanied by a statement of compliance for the purposes of section 9 (statements of compliance).”.

5Amendments to Schedule 2

(1)

Paragraph 1 of Schedule 2 (conditions for deemed compliance with security requirements) to the 2023 Regulations is amended according to paragraphs (2) to (4).

(2)

In paragraph 1(1), for “the condition in sub-paragraph (2) is” substitute “any of the conditions in sub-paragraphs (2) to (4) are”.

(3)

In paragraph 1(2), for “The condition is that” substitute “Condition A is that”.

(4)

After paragraph 1(2), insert—

“(3)

Condition B is that the relevant connectable product, of which they are the manufacturer, is currently assigned a conformance label under the Japan JC-STAR STAR-1 as an indicator of compliance with the requirements set out in JC-STAR STAR-1, and that label has not expired.

(4)

Condition C is that the relevant connectable product, of which they are the manufacturer, is currently awarded a label under any level of the Singapore Cybersecurity Labelling Scheme as an indicator of compliance with the requirements set out in that scheme, and that label has not expired.”.

6

(1)

Paragraph 2 of Schedule 2 (conditions for deemed compliance with security requirements) to the 2023 Regulations is amended according to paragraphs (2) to (4).

(2)

In paragraph 2(1), for “the condition in sub-paragraph (2) is” substitute “any of the conditions in sub-paragraphs (2) to (2B) are”.

(3)

In paragraph 2(2), for “The condition is that” substitute “Condition A is that”.

(4)

After paragraph 2(2), insert—

“(2A)

Condition B is that the relevant connectable product, of which they are the manufacturer, is currently assigned a conformance label under the Japan JC-STAR STAR-1 as an indicator of compliance with the requirements set out in JC-STAR STAR-1, and that label has not expired.

(2B)

Condition C is that the relevant connectable product, of which they are the manufacturer, is currently awarded a label under any level of the Singapore Cybersecurity Labelling Scheme as an indicator of compliance with the requirements set out in that scheme, and that label has not expired.”.

7

(1)

Paragraph 3 of Schedule 2 (conditions for deemed compliance with security requirements) to the 2023 Regulations is amended according to paragraphs (2) to (4).

(2)

In paragraph 3(1), for “the condition in sub-paragraph (2) is” substitute “any of the conditions in sub-paragraphs (2) to (2B) are”.

(3)

In paragraph 3(2), for “The condition is that” substitute “Condition A is that”.

(4)

After paragraph 3(2), insert—

“(2A)

Condition B is that the relevant connectable product, of which they are the manufacturer, is currently assigned a conformance label under the Japan JC-STAR STAR-1 as an indicator of compliance with the requirements set out in JC-STAR STAR-1, and that label has not expired.

(2B)

Condition C is that the relevant connectable product, of which they are the manufacturer, is currently awarded a label under any level of the Singapore Cybersecurity Labelling Scheme as an indicator of compliance with the requirements set out in that scheme, and that label has not expired.”.

8Insertion of Schedule 2A

After Schedule 2 (conditions for deemed compliance with security requirements), insert—

“Schedule 2A

Conditions for deemed compliance with the requirement to have a relevant connectable product accompanied by a statement of compliance

Regulation 4A

1

A manufacturer is treated as having complied with the requirement at section 9(2) (statements of compliance) if any of the conditions in paragraphs 2 and 3 are met.

2

Condition A is that the relevant connectable product, of which they are the manufacturer, is currently assigned a conformance label under Japan JC-STAR STAR-1 as an indicator of compliance with the requirements set out in JC-STAR STAR-1, and that label has not expired.

3

Condition B is that the relevant connectable product, of which they are the manufacturer, is currently awarded a label under any level of the Singapore Cybersecurity Labelling Scheme as an indicator of compliance with the requirements set out in that scheme, and that label has not expired.”.

Signature

Name

Minister

Department for Science, Innovation and Technology

Explanatory note

(This note is not part of the Regulations)

These Regulations amend the Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023 (S.I. 2023/1007) (“the 2023 Regulations”).

Part 1 of the Product Security and Telecommunications Act 2022 (“the 2022 Act”) contains provisions that require manufacturers of relevant connectable products to, among other things, ensure they meet the relevant security requirements (set out in Schedule 1 to the 2023 Regulations) and ensure their products are accompanied by statements of compliance (see sections 8 and 9 of the 2022 Act). The 2022 Act also contain provisions that allow the Secretary of State to specify conditions which, if met, can allow a manufacturer to be treated as having complied with the requirements at sections 8 and 9 of the 2022 Act.

These Regulations specify conditions which, if met, allow manufacturers of a relevant connectable product to be treated as having complied with the security requirements and the requirement to have a product accompanied by a statement of compliance.

Regulation 3 inserts into the 2023 Regulations definitions setting out cybersecurity standards from both Japan and Singapore, which relate to the conditions for deemed compliance inserted into the 2023 Regulations by these Regulations.

Regulations 4 and 8 insert into the 2023 Regulations provisions setting out conditions, which, if met, will allow a manufacturer to be treated as having complied with the requirement to have a relevant connectable product accompanied by a statement of compliance.

Regulations 5 to 7 insert into the 2023 Regulations provisions setting out conditions, which, if met, will allow a manufacturer to be treated as having complied with the relevant security requirements.

An Explanatory Memorandum is published alongside this instrument at https://www.legislation.gov.uk.