{
  "url": "https://openlegislation.uk/product-security-and-telecommunications-infrastructure-act-2022/section-2",
  "json_url": "https://openlegislation.uk/product-security-and-telecommunications-infrastructure-act-2022/section-2.json",
  "legislation": "ukpga/2022/46",
  "legislation_title": "Product Security and Telecommunications Infrastructure Act 2022",
  "legislation_url": "https://openlegislation.uk/product-security-and-telecommunications-infrastructure-act-2022",
  "path": "section/2",
  "kind": "section",
  "number": "2",
  "heading": "Further provision about regulations under section 1",
  "text": "(1) A security requirement may relate to (among other things) all the relevant connectable products of—\n(a) a relevant person, or\n(b) a relevant person of a particular description.\n(2) For the purposes of subsection (1), the relevant connectable products of a relevant person are—\n(a) in the case of a person who is a manufacturer, any relevant connectable products in respect of which the person is a manufacturer;\n(b) in the case of a person who is an importer, any relevant connectable products in respect of which the person is an importer;\n(c) in the case of a person who is a distributor, any relevant connectable products in respect of which the person is a distributor.\n(3) A security requirement may be described by reference to (among other things)—\n(a) any software used for the purposes of, or in connection with, the operation of a relevant connectable product;\n(b) any software used by a person in the course of, or in connection with, using a relevant connectable product;\n(c) any software used for the purposes of providing a service to a person by means of a relevant connectable product;\nand for these purposes it does not matter whether the software is installed on the product or whether the software or service is provided by a manufacturer of the product.\n(4) A security requirement may (among other things) require a relevant person to do something in relation to a relevant connectable product, including in relation to times after a relevant connectable product has been made available in the United Kingdom.\n(5) Regulations under section 1 are subject to the negative resolution procedure if the only provision they make under that section is provision—\n(a) varying any description of—\n(i) products to which a security requirement relates, or\n(ii) software by reference to which a security requirement is described, or\n(b) otherwise altering any term used in describing a security requirement without altering the effect of the security requirement or the extent to which it applies in any case.\n(6) Except as provided by subsection (5), regulations under section 1 are subject to the affirmative resolution procedure.",
  "extent": "E+W+S+N.I.",
  "status": null,
  "version": "current",
  "annotations": [
    {
      "type": "I",
      "label": "I1",
      "text": "S. 2 not in force at Royal Assent, see s. 79(2)"
    },
    {
      "type": "I",
      "label": "I2",
      "text": "S. 2 in force at 29.4.2024 by S.I. 2023/469, reg. 3"
    }
  ],
  "outstanding_effects": [],
  "provenance": {
    "source": "legislation.gov.uk",
    "source_url": "https://www.legislation.gov.uk/ukpga/2022/46/section/2",
    "retrieved_at": "2026-10-29T08:53:55.212760+00:00"
  },
  "licence": "Open Government Licence v3.0",
  "licence_url": "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/",
  "attribution": "Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives."
}