{
  "url": "https://openlegislation.uk/draft-product-security-and-telecommunications-infrastructure-security-requirements-for-relevant-connectable-products-regulations-2023/schedule-1/paragraph-2",
  "json_url": "https://openlegislation.uk/draft-product-security-and-telecommunications-infrastructure-security-requirements-for-relevant-connectable-products-regulations-2023/schedule-1/paragraph-2.json",
  "legislation": "ukdsi/2023/9780348249767",
  "legislation_title": "The Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023",
  "legislation_url": "https://openlegislation.uk/draft-product-security-and-telecommunications-infrastructure-security-requirements-for-relevant-connectable-products-regulations-2023",
  "path": "schedule/1/paragraph/2",
  "kind": "paragraph",
  "number": "2",
  "heading": "Information on how to report security issues",
  "text": "(1) The following sub-paragraphs apply to—\n(a) hardware of the product;\n(b) software which is pre-installed on the product at the point at which the product is supplied to a customer;\n(c) software which must be installed on the product for all manufacturer’s intended purposes of the product that use—\n(i) hardware;\n(ii) software that is pre-installed at the point at which the product is supplied to a customer; or\n(iii) software that is installable;\n(d) software used for, or in connection with, any manufacturer’s intended purpose of the product unless the product is a smartphone or a tablet computer capable of connecting to cellular networks.\n(2) The following information must be published—\n(a) at least one point of contact to allow a person (“P”) to report to the manufacturer security issues relating to the categories listed in sub-paragraph (1) for any of the manufacturer’s relevant connectable products for which they have an obligation under section 8 (duty to comply with security requirements); and\n(b) when P will receive—\n(i) an acknowledgment of the receipt of a security issues report; and\n(ii) status updates until the resolution of the reported security issues.\n(3) The information in sub-paragraph (2) must be accessible, clear and transparent, and must be made available to P—\n(a) without prior request for such information being made;\n(b) in English;\n(c) free of charge; and\n(d) without requesting the provision of P’s personal information.",
  "extent": null,
  "status": null,
  "version": "current",
  "annotations": [],
  "outstanding_effects": [],
  "provenance": {
    "source": "legislation.gov.uk",
    "source_url": "https://www.legislation.gov.uk/ukdsi/2023/9780348249767/schedule/1/paragraph/2",
    "retrieved_at": "2026-10-30T14:43:05.521439+00:00"
  },
  "licence": "Open Government Licence v3.0",
  "licence_url": "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/",
  "attribution": "Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives."
}