Use the UK’s connected-product security law as three procurement questions for cameras and IoT devices

Since 29 April 2024, UK law requires consumer connectable products to ship without guessable shared passwords, to publish how to report security issues, and to state a minimum security update period with an end date. Those three requirements make practical buying questions anywhere.

Source facts

The UK government’s product security regime guidance says the consumer connectable product security regime came into effect on 29 April 2024. Its duties apply to manufacturers, importers and distributors, and the Office for Product Safety and Standards enforces it.

The security requirements start with passwords: they must be unique per product or capable of being defined by the user, and unique passwords must not be based on incremental counters, publicly available information or unique identifiers such as a serial number, or be otherwise easily guessable. Manufacturers must also say how to report security issues and the timescales for acknowledgment and status updates.

Manufacturers must publish a minimum security update period, stating the minimum length of time security updates will be provided along with an end date. A statement of compliance must accompany each product, and importers and distributors must not make a product available without one.

Applicability

The regime is UK law for consumer connectable products and does not bind US purchases. Use it as a procurement benchmark; US federal and state rules, such as FCC equipment restrictions, apply separately.

DSE recommendation

DSE recommends asking every connected-device vendor for its password approach, vulnerability reporting route and security update end date before approving a product. Reject devices that ship with a shared default password, record each model’s security update end date in the asset inventory, and plan replacement before that date. Keep the vendor’s answers with the product approval so later purchases of the same model can be checked against them.

Verification

During commissioning, confirm each device required a unique or user-set credential, and compare installed models with the update end dates recorded at approval. Review the inventory annually for devices approaching or past their stated update period.

Official reference

GOV.UK — The UK Product Security and Telecommunications Infrastructure (Product Security) regime. Reviewed October 18, 2026.