Product Security and Telecommunications Infrastructure Act 2022

11 Duties to take action in relation to compliance failure

(1) This section applies if, at any time after a relevant connectable product has been made available in the United Kingdom—

(a) a manufacturer of the product becomes aware, or ought to be aware, of a compliance failure in relation to the product, and

(b) the manufacturer is aware, or ought to be aware, that the product is or will be a UK consumer connectable product.

(2) The manufacturer must, as soon as is practicable, take all reasonable steps to—

(a) prevent the product from being made available to customers in the United Kingdom (where it has not already been so made available);

(b) remedy the compliance failure.

(3) The manufacturer must notify the persons listed in subsection (4) of the compliance failure as soon as possible.

This is subject to subsection (8).

(4) The persons referred to in subsection (3) are—

(a) the enforcement authority;

(b) any other manufacturer of the product of which the manufacturer is aware;

(c) any importer or distributor to whom the manufacturer supplied the product;

(d) in a case where specified conditions are met, any customer in the United Kingdom to whom the manufacturer supplied the product.

(5) In subsection (4)(d) “specified” means specified in regulations made by the Secretary of State.

Regulations under this subsection are subject to the negative resolution procedure.

(6) The notification under subsection (3) must include the following information—

(a) details of the compliance failure;

(b) any risks of which the manufacturer is aware that are posed by the compliance failure;

(c) any steps taken by the manufacturer to remedy the compliance failure and whether or not those steps have been successful.

(7) When the manufacturer notifies a person within subsection (4)(b) or (c) of the compliance failure, the manufacturer must also inform the person whether or not the manufacturer has notified the enforcement authority of the compliance failure.

(8) Where the manufacturer became aware of the compliance failure as a result of being contacted about it by a relevant person in accordance with this Chapter, the manufacturer does not need to notify the relevant person of the compliance failure.

(9) In this section “compliance failure” means a failure by a manufacturer of the product to comply with a relevant security requirement relating to the product.