See Full Document Text
Status: This is the original version (as it was originally made). This
item of legislation is currently only available in its original format.
STATUTORY INSTRUMENTS
2025 No. 1267
CONSUMER PROTECTION
The Product Security and Telecommunications Infrastructure
(Security Requirements for Relevant Connectable
Products) (Amendment) (No. 2) Regulations 2025
Made - - - - 3rd December 2025
Coming into force - - 4th December 2025
The Secretary of State makes these Regulations in exercise of the powers conferred by sections
3(1), 3(2)(a), 9(7) and 77(2)(a) of the Product Security and Telecommunications Infrastructure Act
2022(1) (“the 2022 Act”).
A draft of these Regulations has been laid before, and approved by, both Houses of Parliament in
accordance with sections 3(3), 9(9) and 77(5) of the 2022 Act.
Citation, commencement, extent and interpretation
1.—(1) These Regulations may be cited as the Product Security and Telecommunications
Infrastructure (Security Requirements for Relevant Connectable Products) (Amendment) (No. 2)
Regulations 2025.
(2) These Regulations come into force on the day after the day on which they are made.
(3) These Regulations extend to England and Wales, Scotland and Northern Ireland.
(4) In these Regulations, “the 2023 Regulations” means the Product Security and
Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products)
Regulations 2023(2).
Amendment to the 2023 Regulations
2. The 2023 Regulations are amended in accordance with regulations 3 to 8.
Amendment to regulation 2
3. In regulation 2 (interpretation) in paragraph (1), at the appropriate places insert—
(1) 2022 c. 46. See sections 3(4) and 9(8) for the definition of “specified”.
(2) S.I. 2023/1007, amended by S.I. 2025/211.Document Generated: 2025-12-05
Status: This is the original version (as it was originally made). This
item of legislation is currently only available in its original format.
““Japan JC-STAR STAR-1” means the Labeling Scheme based on Japan Cyber-Security
Technical Assessment Requirements (JC-STAR) STAR-1 Conformance Requirements and
Assessment Methods published by the Information-technology Promotion Agency, Japan
(JST-CR-01-01-2024R1, December 2024)(3);”;
““Singapore Cybersecurity Labelling Scheme” means the Cybersecurity Labelling Scheme
published by the Cyber Security Agency of Singapore, the specifications for which are in
document CCC SP-151-2 CLS(IoT) Scheme Specifications (version 1.4, April 2025)(4).”.
Insertion of regulation 4A
4. After regulation 4, insert—
“Deemed compliance with the requirement to have a relevant connectable product
accompanied by a statement of compliance
4A. Schedule 2A specifies the conditions under which a manufacturer is to be treated as
having complied with the requirement to have a relevant connectable product accompanied
by a statement of compliance for the purposes of section 9 (statements of compliance).”.
Amendments to Schedule 2
5.—(1) Paragraph 1 of Schedule 2 (conditions for deemed compliance with security
requirements) to the 2023 Regulations is amended according to paragraphs (2) to (4).
(2) In paragraph 1(1), for “the condition in sub-paragraph (2) is” substitute “any of the conditions
in sub-paragraphs (2) to (4) are”.
(3) In paragraph 1(2), for “The condition is that” substitute “Condition A is that”.
(4) After paragraph 1(2), insert—
“(3) Condition B is that the relevant connectable product, of which they are the manufacturer,
is currently assigned a conformance label under the Japan JC-STAR STAR-1 as an indicator of
compliance with the requirements set out in JC-STAR STAR-1, and that label has not expired.
(4) Condition C is that the relevant connectable product, of which they are the manufacturer, is
currently awarded a label under any level of the Singapore Cybersecurity Labelling Scheme as an
indicator of compliance with the requirements set out in that scheme, and that label has not expired.”.
6.—(1) Paragraph 2 of Schedule 2 (conditions for deemed compliance with security
requirements) to the 2023 Regulations is amended according to paragraphs (2) to (4).
(2) In paragraph 2(1), for “the condition in sub-paragraph (2) is” substitute “any of the conditions
in sub-paragraphs (2) to (2B) are”.
(3) In paragraph 2(2), for “The condition is that” substitute “Condition A is that”.
(3) The Labeling Scheme based on Japan Cyber-Security Technical Assessment Requirements (JC-STAR) STAR-1 Conformance
Requirements and Assessment Methods (JST-CR-01-01-2024R1, December 2024) is the standard set by the Information-
technology Promotion Agency, Japan, to indicate that an internet of things product has achieved the minimum level of security
functionality required. The standard is available free of charge at https://www.ipa.go.jp/en/security/jc-star/tekigou-kizyun-
guide/label1/s6ckaf000000ggej-att/STAR-1_Conformance_Requirements_and_Assessment_Methods.pdf. A copy can also
be inspected free of charge by appointment by contacting the Office for Product Safety and Standards at Stanton Avenue,
Teddington, Middlesex, TW11 0JZ or by email at OPSS.enquiries@businessandtrade.gov.uk.
(4) The Singapore Cybersecurity Labelling Scheme, the specifications for which are in document CCC SP-151-2 CLS(IoT)
(version 1.4, April 2025), is the standard set by the Cyber Security Agency of Singapore to provide an indication of the
level of security in the network-connected smart devices. The specifications for the standard are available free of charge
at https://isomer-user-content.by.gov.sg/36/186ab950-9b72-4856-9d62-172dae018777/CCC%20SP-151-2%20CLS%28IoT
%29%20Scheme%20Specifications%20v1.4.pdf. A copy can also be inspected free of charge by appointment by contacting
the Office for Product Safety and Standards at Stanton Avenue, Teddington, Middlesex, TW11 0JZ or by email at
OPSS.enquiries@businessandtrade.gov.uk.
2Document Generated: 2025-12-05
Status: This is the original version (as it was originally made). This
item of legislation is currently only available in its original format.
(4) After paragraph 2(2), insert—
“(2A) Condition B is that the relevant connectable product, of which they are the manufacturer,
is currently assigned a conformance label under the Japan JC-STAR STAR-1 as an indicator of
compliance with the requirements set out in JC-STAR STAR-1, and that label has not expired.
(2B) Condition C is that the relevant connectable product, of which they are the manufacturer,
is currently awarded a label under any level of the Singapore Cybersecurity Labelling Scheme as an
indicator of compliance with the requirements set out in that scheme, and that label has not expired.”.
7.—(1) Paragraph 3 of Schedule 2 (conditions for deemed compliance with security
requirements) to the 2023 Regulations is amended according to paragraphs (2) to (4).
(2) In paragraph 3(1), for “the condition in sub-paragraph (2) is” substitute “any of the conditions
in sub-paragraphs (2) to (2B) are”.
(3) In paragraph 3(2), for “The condition is that” substitute “Condition A is that”.
(4) After paragraph 3(2), insert—
“(2A) Condition B is that the relevant connectable product, of which they are the manufacturer,
is currently assigned a conformance label under the Japan JC-STAR STAR-1 as an indicator of
compliance with the requirements set out in JC-STAR STAR-1, and that label has not expired.
(2B) Condition C is that the relevant connectable product, of which they are the manufacturer,
is currently awarded a label under any level of the Singapore Cybersecurity Labelling Scheme as an
indicator of compliance with the requirements set out in that scheme, and that label has not expired.”.
Insertion of Schedule 2A
8. After Schedule 2 (conditions for deemed compliance with security requirements), insert—
“Schedule 2A Regulation 4A
Conditions for deemed compliance with the requirement to have a
relevant connectable product accompanied by a statement of compliance
1. A manufacturer is treated as having complied with the requirement at section 9(2)
(statements of compliance) if any of the conditions in paragraphs 2 and 3 are met.
2. Condition A is that the relevant connectable product, of which they are the manufacturer,
is currently assigned a conformance label under Japan JC-STAR STAR-1 as an indicator of
compliance with the requirements set out in JC-STAR STAR-1, and that label has not expired.
3. Condition B is that the relevant connectable product, of which they are the manufacturer,
is currently awarded a label under any level of the Singapore Cybersecurity Labelling Scheme
as an indicator of compliance with the requirements set out in that scheme, and that label has
not expired.”.
Lloyd of Effra
Parliamentary Under-Secretary of State
Department for Science, Innovation and
3rd December 2025 Technology
3Document Generated: 2025-12-05
Status: This is the original version (as it was originally made). This
item of legislation is currently only available in its original format.
EXPLANATORY NOTE
(This note is not part of the Regulations)
These Regulations amend the Product Security and Telecommunications Infrastructure (Security
Requirements for Relevant Connectable Products) Regulations 2023 (S.I. 2023/1007) (“the 2023
Regulations”).
Part 1 of the Product Security and Telecommunications Act 2022 (“the 2022 Act”) contains
provisions that require manufacturers of relevant connectable products to, among other things,
ensure they meet the relevant security requirements (set out in Schedule 1 to the 2023 Regulations)
and ensure their products are accompanied by statements of compliance (see sections 8 and 9 of
the 2022 Act). The 2022 Act also contain provisions that allow the Secretary of State to specify
conditions which, if met, can allow a manufacturer to be treated as having complied with the
requirements at sections 8 and 9 of the 2022 Act.
These Regulations specify conditions which, if met, allow manufacturers of a relevant connectable
product to be treated as having complied with the security requirements and the requirement to have
a product accompanied by a statement of compliance.
Regulation 3 inserts into the 2023 Regulations definitions setting out cybersecurity standards from
both Japan and Singapore, which relate to the conditions for deemed compliance inserted into the
2023 Regulations by these Regulations.
Regulations 4 and 8 insert into the 2023 Regulations provisions setting out conditions, which, if met,
will allow a manufacturer to be treated as having complied with the requirement to have a relevant
connectable product accompanied by a statement of compliance.
Regulations 5 to 7 insert into the 2023 Regulations provisions setting out conditions, which, if met,
will allow a manufacturer to be treated as having complied with the relevant security requirements.
An Explanatory Memorandum is published alongside this instrument at https://
www.legislation.gov.uk.
4