# Product Security and Telecommunications Infrastructure Act 2022, Section 2: Further provision about regulations under section 1

Extent: E+W+S+N.I.

(1) A security requirement may relate to (among other things) all the relevant connectable products of—
(a) a relevant person, or
(b) a relevant person of a particular description.
(2) For the purposes of subsection (1), the relevant connectable products of a relevant person are—
(a) in the case of a person who is a manufacturer, any relevant connectable products in respect of which the person is a manufacturer;
(b) in the case of a person who is an importer, any relevant connectable products in respect of which the person is an importer;
(c) in the case of a person who is a distributor, any relevant connectable products in respect of which the person is a distributor.
(3) A security requirement may be described by reference to (among other things)—
(a) any software used for the purposes of, or in connection with, the operation of a relevant connectable product;
(b) any software used by a person in the course of, or in connection with, using a relevant connectable product;
(c) any software used for the purposes of providing a service to a person by means of a relevant connectable product;
and for these purposes it does not matter whether the software is installed on the product or whether the software or service is provided by a manufacturer of the product.
(4) A security requirement may (among other things) require a relevant person to do something in relation to a relevant connectable product, including in relation to times after a relevant connectable product has been made available in the United Kingdom.
(5) Regulations under section 1 are subject to the negative resolution procedure if the only provision they make under that section is provision—
(a) varying any description of—
(i) products to which a security requirement relates, or
(ii) software by reference to which a security requirement is described, or
(b) otherwise altering any term used in describing a security requirement without altering the effect of the security requirement or the extent to which it applies in any case.
(6) Except as provided by subsection (5), regulations under section 1 are subject to the affirmative resolution procedure.

---
Source: https://www.legislation.gov.uk/ukpga/2022/46/section/2 (the official version)
Page: https://openlegislation.uk/product-security-and-telecommunications-infrastructure-act-2022/section-2
Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives.