Product Security and Telecommunications Infrastructure Act 2022

24 Duties to take action in relation to distributor’s compliance failures

(1) This section applies if, at any time after a distributor of a relevant connectable product makes it available to a customer in the United Kingdom—

(a) the distributor becomes aware, or ought to be aware, of a compliance failure in relation to the product, and

(b) the distributor is aware, or ought to be aware, that the product is a UK consumer connectable product.

(2) The distributor must, as soon as is practicable, take all reasonable steps to remedy the compliance failure.

(3) The distributor must notify the persons listed in subsection (4) of the compliance failure as soon as possible.

(4) The persons referred to in subsection (3) are—

(a) the enforcement authority, and

(b) in a case where specified conditions are met, any customer in the United Kingdom to whom the distributor supplied the product.

(5) In subsection (4)(b) “specified” means specified in regulations made by the Secretary of State.

Regulations under this subsection are subject to the negative resolution procedure.

(6) The notification under subsection (3) must include the following information—

(a) details of the compliance failure;

(b) any risks of which the distributor is aware that are posed by the compliance failure;

(c) any steps taken by the distributor to remedy the compliance failure and whether or not those steps have been successful.

(7) In this section “compliance failure” means a failure by the distributor to comply with a relevant security requirement relating to the product.