The Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023

Information on minimum security update periods

3.—(1) The following sub-paragraphs apply to—

(a) hardware of the product that is capable of receiving security updates;

(b) software that is capable of receiving security updates where that software is pre-installed on the product at the point at which the product is supplied to a customer;

(c) software that is capable of receiving security updates which must be installed on the product for all manufacturer’s intended purposes of the product that use—

(i) hardware;

(ii) software that is pre-installed at the point at which the product is supplied to a customer; or

(iii) software that is installable;

(d) software developed by or on behalf of any manufacturer that is capable of receiving security updates and used for, or in connection with, any manufacturer’s intended purpose of the product unless the product is a smartphone or a tablet computer capable of connecting to cellular networks.

(2) The defined support period must be published.

(3) If a manufacturer extends the minimum length of time for which security updates will be provided, creating a new defined support period, the new defined support must be published as soon as is practicable.

(4) The information in sub-paragraphs (2) and (3) must be accessible, clear and transparent, and must be made available to a person (“P”)—

(a) without prior request for such information being made;

(b) in English;

(c) free of charge;

(d) without requesting the provision of P’s personal information; and

(e) in such a way that is understandable by a reader without prior technical knowledge.

(5) Where a manufacturer publishes an invitation to purchase a relevant connectable product on its own website or on a non-paid for website under its control that contains information described in regulation 6(4)(a) of the 2008 Regulations, the information in sub-paragraphs (2) and (3) must be published alongside or otherwise given equal prominence to the information described in that regulation.

(6) The security requirements in this paragraph are not met if the defined support period is shortened after the publication of the information in sub-paragraph (2).

(7) In this paragraph—

“the 2008 Regulations” means the Consumer Protection from Unfair Trading Regulations 2008(1);

“invitation to purchase” has the meaning given in regulation 2(1) of the 2008 Regulations.

(1)

S.I. 2008/1277.