# Use the UK’s connected-product security law as three procurement questions for cameras and IoT devices > Since 29 April 2024, UK law requires consumer connectable products to ship without guessable shared passwords, to publish how to report security issues, and to state a minimum security update period with an end date. Those three requirements make practical buying questions anywhere. - Canonical URL: https://update.dsesecurity.com/updates/uk-psti-connectable-product-security-procurement-questions/ - Publisher: Detection Systems & Engineering (DSE Security) - Author: DSE Security Editorial Team - Published: 2026-10-18T21:00:37+00:00 - Modified: 2026-10-18T22:22:07+00:00 - Last reviewed by DSE: 2026-10-18 - Resource type: Explainer - DSE priority: Information - Topics: Cybersecurity, Video Surveillance - Reading time: 2 minutes ## What you need to know Since 29 April 2024, UK law requires consumer connectable products to ship without guessable shared passwords, to publish how to report security issues, and to state a minimum security update period with an end date. Those three requirements make practical buying questions anywhere. ## Potentially affected Organizations buying cameras, doorbells, smart locks, sensors and other connected devices, and the integrators and resellers who specify them. ## DSE recommendation DSE recommends asking every connected-device vendor for its password approach, vulnerability reporting route and security update end date before approving a product. ## Article Since 29 April 2024, UK law requires consumer connectable products to ship without guessable shared passwords, to publish how to report security issues, and to state a minimum security update period with an end date. Those three requirements make practical buying questions anywhere. ## Source facts The UK government’s [product security regime guidance](https://www.gov.uk/government/publications/the-uk-product-security-and-telecommunications-infrastructure-product-security-regime) says the consumer connectable product security regime came into effect on 29 April 2024. Its duties apply to manufacturers, importers and distributors, and the Office for Product Safety and Standards enforces it. The security requirements start with passwords: they must be unique per product or capable of being defined by the user, and unique passwords must not be based on incremental counters, publicly available information or unique identifiers such as a serial number, or be otherwise easily guessable. Manufacturers must also say how to report security issues and the timescales for acknowledgment and status updates. Manufacturers must publish a minimum security update period, stating the minimum length of time security updates will be provided along with an end date. A statement of compliance must accompany each product, and importers and distributors must not make a product available without one. ## Applicability The regime is UK law for consumer connectable products and does not bind US purchases. Use it as a procurement benchmark; US federal and state rules, such as FCC equipment restrictions, apply separately. ## DSE recommendation DSE recommends asking every connected-device vendor for its password approach, vulnerability reporting route and security update end date before approving a product. Reject devices that ship with a shared default password, record each model’s security update end date in the asset inventory, and plan replacement before that date. Keep the vendor’s answers with the product approval so later purchases of the same model can be checked against them. ## Verification During commissioning, confirm each device required a unique or user-set credential, and compare installed models with the update end dates recorded at approval. Review the inventory annually for devices approaching or past their stated update period. ## Official reference [GOV.UK — The UK Product Security and Telecommunications Infrastructure (Product Security) regime](https://www.gov.uk/government/publications/the-uk-product-security-and-telecommunications-infrastructure-product-security-regime). Reviewed October 18, 2026. ## Primary reference - Name: GOV.UK — The UK Product Security and Telecommunications Infrastructure (Product Security) regime - Authority: www.gov.uk - URL: https://www.gov.uk/government/publications/the-uk-product-security-and-telecommunications-infrastructure-product-security-regime - Source publication date: Not stated by the source ## Citation and use Preferred citation: “Use the UK’s connected-product security law as three procurement questions for cameras and IoT devices,” DSE Security, https://update.dsesecurity.com/updates/uk-psti-connectable-product-security-procurement-questions/ Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/ Usage and citation policy: https://update.dsesecurity.com/usage/ Copyright © 2026 Detection Systems & Engineering. All rights reserved.