Guidance

Consumer connectable product security regulations

Updated 22 April 2024

Guidance on enforcement actions and associated rights

Part 1 of The Product Security and Telecommunications Infrastructure Act 2022

Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023

January 2024

OPSS enforces the above legislation. This guidance, which sits alongside our Enforcement Policy, explains the enforcement powers that are available to OPSS when addressing non-compliance with the legislation.

Information on the requirements of the legislation, and complying with these, is also available.

Read information about Part 1 of The Product Security and Telecommunications Infrastructure Act 2022 and The Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023.

1) Introduction

1.1 The Office for Product Safety and Standards (OPSS) is part of the Department for Business and Trade and enforces a range of regulations on behalf of the Secretary of State. Our primary purpose is to protect people and places from product-related harm, ensuring consumers and businesses can buy and sell products with confidence.

Read about our approach to delivering regulation.

1.2 The legislation enforced by OPSS includes the following: See footnote 1

• Part 1 of The Product Security and Telecommunications Infrastructure Act 2022 (‘the Act’)
• The Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023

References in this guidance to ‘OPSS’ refer to OPSS acting as the Secretary of State for the purpose of this legislation.

1.3 This enforcement guidance should be read alongside our Enforcement Policy. Our Enforcement Policy explains our approach to addressing non-compliance, providing a framework for our decision-making and helping those affected by our enforcement activities to understand how and why decisions are made, while this guidance explains the specific powers that are available to OPSS when addressing non-compliance under the Act.

1.4 The guidance explains the following actions that are available to OPSS under the Act:

a) service of a Compliance Notice on a business by OPSS, requiring action to be taken (see section 2)

b) service of a Stop Notice on a business by OPSS, prohibiting further non-compliance (see section 3)

c) service of a Recall Notice on a business by OPSS, requiring action to be taken to arrange the return of specified products (see section 4)

d) imposition of a Monetary Penalty on a business by OPSS, requiring payment of a financial penalty (see section 5)

e) application to a court for a Forfeiture Order (see section 6)

1.5 OPSS is able to publish details of compliance failures and is likely to do so where it considers it to be in the public interest to make consumers and other end users of a product aware of:

a) any risks associated with using the product

b) any steps that may be taken by customers to protect themselves from those risks

Publication of details of compliance failures may be considered both in cases where one of more of the above enforcement actions is taken, and in cases where enforcement action is not taken. Where enforcement action is taken, OPSS will publish details of that action in line with our Enforcement Policy.

1.6 This document does not explain our approach to prosecution, which is covered in our Enforcement Policy. OPSS is able to prosecute in relation to offences under the Act, including where there has been a failure to complete actions specified in a Compliance Notice, a Stop Notice or a Recall Notice (‘an enforcement notice’). Failure to comply with an enforcement notice is an offence liable on summary conviction to a fine.

1.7 Use of the enforcement actions that are available to OPSS is determined on the facts of the individual case, in line with our Enforcement Policy. We select proportionate action(s) with the aim of preventing or mitigating the risk of harm and/ or changing business behaviour, including through the use of sanctions.

1.8 Manufacturers and importers of relevant connectable products must investigate potential compliance failures and are under a duty to take action in relation to compliance failures that they become aware of, or ought to be aware of. Authorised representatives and distributors of relevant connectable products are also under a duty to take action in relation to compliance failures.

Further guidance to support businesses in preparing for and implementing effective product recalls and other corrective actions is available. While this guidance is focussed on product safety, much of the content is of relevance: PAS 7100:2022 Code of practice on product recall and other corrective actions.

1.9 Manufacturers, importers and distributors are required to notify certain persons of any compliance failure, including OPSS. Notifications to OPSS should be made to opss.enquiries@businessandtrade.gov.uk and should include the following information:

a) full details of the compliance failure

b) any risk posed by the compliance failure of which the person making the notification is aware

c) any steps that they have taken to remedy the compliance failure and whether or not those steps have been successful

d) in the case of an importer or distributor of the product, any steps that they are aware the manufacturer or importer has taken to remedy the compliance failure, and whether or not those steps have been successful

1.10 OPSS will take account of compliance with duties to take action in response to a compliance failure and with notification requirements in determining whether it is appropriate for it to take enforcement action and what that enforcement action should be, as set out in its Enforcement Policy.

1.11 This guidance also explains the statutory rights that are set out in the Act to make representations in respect of enforcement action that we are proposing to take, or to appeal enforcement action that we have taken.

1.12 Where you do not have statutory rights to make representations or appeal, you are still entitled to challenge any action that we are taking against you or your business. These rights to challenge are explained in our Challenges and Appeals Guidance.

Read our Challenges and Appeals Guidance.

1.13 If you have a concern about our approach, or the behaviour of our staff, please send us your comments or complaint. Our complaints processes are explained in our Complaints Procedure.

Read our Complaints Procedure.

2) Compliance Notices

2.1 Business obligations to take action in response to a compliance failure (see sections 1.8–1.10) include obligations on manufacturers and, in certain circumstances, importers, authorised representatives and distributors, to take all reasonable steps to remedy the compliance failure. Businesses should be aware that where they fail to comply with their obligations to take appropriate action in a timely manner, they may be required to act by means of a Compliance Notice.

2.2 A Compliance Notice is a written notice served by OPSS which requires a business to take action, within a specified period, to comply with a specified duty or duties. A Compliance Notice may specify the steps that must be taken in order to comply with the duty and may require evidence to be provided, within a specified period, to satisfy OPSS that the recipient of the notice has complied, or is complying, with the duty specified in the Compliance Notice.

2.3 OPSS is able to serve a Compliance Notice where it has reasonable grounds to believe that there has been a failure to comply with a duty listed in Chapter 2 of the Act, other than where a Compliance Notice has previously been served in relation to the same act or omission.

2.4 OPSS is able to use a Compliance Notice independently or in combination with other enforcement actions explained in this guidance. This allows us to tailor the use of enforcement actions to the circumstances.

2.5 OPSS will take any failure to complete the specified actions in a Compliance Notice satisfactorily within the specified period seriously and will consider prosecution (see section 1.6).

2.6 OPSS is likely to serve a Compliance Notice in response to non-compliance where we consider that advice or guidance alone is not an appropriate response, or as an escalating response where advice or guidance have not delivered the required improvements.

2.7 Before serving a Compliance Notice, OPSS will issue you with a notice indicating our intention. When we issue a Notice of Intent, you are entitled to make written representations to us in relation to the proposed Compliance Notice. You must do this within 10 days beginning on the day on which the notice of our intention is given. This allows you to raise any concerns in relation to the proposed Compliance Notice.

2.8 Once the period for making representations has expired, OPSS will consider any written representations and make a decision. Where we decide to proceed with the proposed notice, with or without modifications, we will serve the Compliance Notice.

2.9 Where OPSS decides to serve a Compliance Notice you are entitled to appeal against our decision to the First-tier Tribunal (see section 7). We will set out your rights when we inform you of our decision.

2.10 A Compliance Notice may be revoked by OPSS or may be varied, although the variation may not make the notice more onerous for the business. Where OPSS decides to revoke or vary a Compliance Notice, we will inform you in writing. Where OPSS decides to vary a Compliance Notice you are entitled to appeal against the variation to the First-tier Tribunal (see section 7).

2.11 OPSS publishes details of any Compliance Notice that we serve, in line with our Enforcement Policy. The published details may be updated to indicate where OPSS has subsequently determined that the requirements of the notice have been met, or where the Compliance Notice has been varied or revoked.

3) Stop Notices

3.1 Business obligations to take action in response to a compliance failure (see sections 1.8–1.10) include obligations on manufacturers and, in certain circumstances, importers, authorised representatives and distributors, to take all reasonable steps to prevent the product from being made available to customers in the United Kingdom. Businesses should be aware that where they fail to comply with their obligations to take appropriate action in a timely manner, they may be required to act by means of a Stop Notice.

3.2 A Stop Notice is a written notice served by OPSS on a business to prohibit non-compliant activities or to restrict non-compliant products being made available on the market until the business has taken the steps specified in the notice.

3.3 A Stop Notice may specify the steps that must be taken, and the period within which they must be taken, in order to comply with the notice, which may include informing customers of any risks posed by using the product. The Stop Notice may require evidence to be provided, within a specified period, to satisfy OPSS that the recipient of the notice is complying with it. In addition, the Stop Notice may make provision for OPSS to revoke the notice if the recipient of the notices takes specified steps within a specified period to comply with the relevant duty and, in this case, the notice will require evidence to be provided, within a specified period, to satisfy OPSS that the steps have been taken.

3.4 A Stop Notice may be served where OPSS has reasonable grounds to believe that a business is carrying on, or is likely to carry on, an activity in breach of a duty listed in Chapter 2 of the Act.

3.5 OPSS is able to use a Stop Notice independently or in combination with other enforcement actions explained in this guidance. This allows us to tailor the use of enforcement actions to the circumstances.

3.6 OPSS will take any failure to comply with a Stop Notice seriously and will consider prosecution (see section 1.6).

3.7 OPSS is likely to serve a Stop Notice where we consider that there is a need to prevent an activity that presents a risk of harm, and we are not satisfied that appropriate and timely action is being taken or will be taken by the business without our intervention.

3.8 Before serving a Stop Notice, OPSS will in most circumstances issue you with a notice indicating our intention. Where we issue a Notice of Intent, you are entitled to make written representations and objections to us in relation to the proposed Stop Notice. You must do this within 10 days beginning on the day on which the notice of our intention is given. This allows you to raise any concerns in relation to the proposed Stop Notice.

3.9 Once the period for making representations has expired, OPSS will consider any written representations and make a decision. Where we decide to proceed with the proposed notice, with or without modifications, we will serve the Stop Notice.

3.10 OPSS may serve a Stop Notice without first issuing a Notice of Intent where we consider there is an urgent need to do so, in order to address a risk to consumer health or safety.

3.11 Where OPSS decides to issue a Stop Notice you are entitled to appeal against our decision to the First-tier Tribunal (see section 7). We will set out your rights when we inform you of our decision.

3.12 A Stop Notice may be revoked by OPSS or may be varied, although the variation may not make the notice more onerous for the business. Where OPSS decides to revoke or vary a Stop Notice, we will inform you in writing. Where OPSS decides to vary a Stop Notice you are entitled to appeal against the variation to the First-tier Tribunal (see section 7).

3.13 OPSS publishes details of any Stop Notice that we serve, in line with our Enforcement Policy. The published details may be updated to indicate where the Stop Notice has been varied or revoked.

Compensation

3.14 Where a Stop Notice has been issued and, as a result, the recipient of the Stop Notice has suffered loss or damage, OPSS may be required to pay compensation. The obligation to compensate the recipient applies only where:

a) the relevant breach in respect of which the Stop Notice was served did not occur, and

b) the decision to serve the Stop Notice was not attributable to any neglect or default by the recipient of the notice.

3.15 In these circumstances, a recipient of a Stop Notice who wishes to claim compensation should do so in writing, using the contact details provided on the Stop Notice. In order for OPSS to make an informed decision on a claim for compensation, it is important that we are provided with the following information and that any available evidence to support the claim is provided when the claim is made:

a) full details and evidence of the loss or damage suffered

b) the amount of compensation sought

c) an explanation of how the Stop Notice caused the loss or damage

d) any steps taken to minimise the loss or damage.

3.16 OPSS will consider all information provided to support a claim for compensation and will give you written notice of its decision within 45 days. Where OPSS decides to refuse compensation, the claimant is entitled to appeal against our decision to the First-tier Tribunal (see section 7). Where OPSS decides to award compensation, the claimant is entitled to appeal the amount of compensation to be awarded (see section 7). We will set out your rights when we inform you of our decision.

4) Recall Notice

4.1 The legislation does not establish a specific duty to recall products from consumers or other end users, however OPSS will expect businesses to consider whether it is appropriate to do so, in light of the risk posed to end users by the product (see section 1.8 for guidance on preparing for and implementing effective product recalls and other corrective actions). Businesses should be aware that where they fail to act appropriately to protect end users, they may be required to act by means of a Recall Notice.

4.2 A Recall Notice is a written notice served by OPSS on a responsible business, requiring the business to make arrangements, within a specified period, for the return of products that have been supplied to consumers and other end users.

4.3 A Recall Notice may specify the steps that must be taken, and the period within which they must be taken, in order to comply with the notice, which may include informing customers of any risks posed by using the product. The Recall Notice may, in addition, require evidence to be provided, within a specified period, to satisfy OPSS that the recipient of the notice is complying with it, and may require information to be provided in relation to the product subject to the recall.

4.4 A Recall Notice may be served where OPSS has reasonable grounds to believe that there has been a compliance failure in relation to any UK consumer connectable product that has been supplied to customers and OPSS considers that any action being taken in respect of the compliance failure by the relevant business is inadequate.

4.5 OPSS may serve a Recall Notice only where it considers that a Compliance Notice, a Stop Notice or an application for a Forfeiture Order would not be sufficient to address the risks posed by the compliance failure. However, OPSS is able to use a Recall Notice in combination with those and/ or other enforcement actions as appropriate in the particular circumstances.

4.6 OPSS will take any failure to comply with a Recall Notice within the specified period seriously and will consider prosecution (see section 1.6). In addition:

• The failure to comply with a Recall Notice will be taken into account in any decision as to whether it is appropriate to impose a Monetary Penalty in respect of the compliance failure that led to the service of a Recall Notice.
• OPSS may itself take action to recall the product and is entitled to recover any costs or expenses reasonably incurred in doing so.

4.7 Before serving a Recall Notice, OPSS will in most circumstances issue you with a notice indicating our intention. However, we may serve a Recall Notice without first issuing a Notice of Intent where we consider there is an urgent need to do so. Where we issue a Notice of Intent, you are entitled to make written representations to us in relation to the proposed Recall Notice. You must do this within 10 days beginning on the day on which the notice of our intention is given. This allows you to raise any concerns in relation to the proposed Recall Notice.

4.8 Once the period for making representations has expired, OPSS will consider any written representations and make a decision. Where we decide to proceed with the proposed notice, with or without modifications, we will serve the Recall Notice.

4.9 Where OPSS decides to issue a Recall Notice you are entitled to appeal against our decision to the First-tier Tribunal (see section 7). We will set out your rights when we inform you of our decision.

4.10 A Recall Notice may be revoked by OPSS or may be varied, although the variation may not make the notice more onerous for the business. Where OPSS decides to revoke or vary a Recall Notice, we will inform you in writing. Where OPSS decides to vary a Recall Notice you are entitled to appeal against the variation to the First-tier Tribunal (see section 7).

4.11 OPSS publishes details of any Recall Notice that we serve, in line with our Enforcement Policy. The published details may be updated to indicate where the Recall Notice has been varied or revoked.

Compensation

4.12 Where a Recall Notice has been served and, as a result, the recipient of the Recall Notice has suffered loss or damage, OPSS may be required to pay compensation. The obligation to compensate the recipient applies only where:

a) the relevant breach in respect of which the Recall Notice was served did not occur, and

b) the decision to serve the Recall Notice was not attributable to any neglect or default by the recipient of the notice.

4.13 In these circumstances, a recipient of a Recall Notice who wishes to claim compensation should do so in writing, using the contact details provided on the Recall Notice. In order for OPSS to make an informed decision on a claim for compensation, it is important that we are provided with the following information and that any available evidence to support the claim is provided when the claim is made:

a) full details and evidence of the loss or damage suffered

b) the amount of compensation sought

c) an explanation of how the Recall Notice caused the loss or damage

d) any steps taken to minimise the loss or damage.

4.14 OPSS will consider all information provided to support a claim for compensation and will give you written notice of its decision within 45 days. Where OPSS decides to refuse compensation, the claimant is entitled to appeal against our decision to the First-tier Tribunal (see section 7). Where OPSS decides to award compensation, the claimant is entitled to appeal the amount of compensation to be awarded (see section 7). We will set out your rights when we inform you of our decision.

5) Monetary Penalty

5.1 OPSS may serve a Monetary Penalty Notice, requiring payment of a financial penalty within a specified period (the ‘penalty deadline’). A Monetary Penalty Notice may, in addition, require the payment of a further penalty in respect of each day that non-compliance continues beyond the penalty deadline. A penalty may therefore consist of two elements, with the second applying only where the recipient of the Monetary Penalty Notice fails to address continuing non-compliance. These two elements of the Monetary Penalty are distinguished in the legislation, and in this guidance, by use of the terms ‘fixed penalty’ and ‘daily penalty’. However, it is important to understand that the amount of the fixed penalty is not fixed by the legislation and that the amounts of both the fixed penalty and the daily penalty are determined by OPSS (see Penalty amount). OPSS can impose Monetary Penalties without recourse to the criminal courts.

5.2 A Monetary Penalty may be imposed where OPSS is satisfied, on the balance of probabilities, that there has been a failure to comply with a duty listed in Chapter 2 of the Act.

5.3 OPSS is able to use a Monetary Penalty independently, or in combination with other enforcement actions explained in this guidance. This allows us to tailor the use of enforcement actions to the circumstances.

5.4 OPSS will take any failure to pay a Monetary Penalty seriously and can pursue the penalty as a debt in the relevant civil court.

5.5 OPSS is likely to impose a Monetary Penalty in where we consider this to be an appropriate response given the nature and seriousness of the non-compliance and the circumstances of the case. In particular, we are more likely to impose a penalty where we consider that this may serve to:

• tackle any financial gain or benefit from non-compliance
• change the behaviour of the user
• deter future non-compliance more widely

OPSS is likely to consider including a daily penalty where it has particular concerns about ongoing non-compliance.

5.6 Before imposing a Monetary Penalty, OPSS may require you to provide us with information to enable us to determine the appropriate amount of the financial penalty (see Penalty Amount).

5.7 Before imposing a Monetary Penalty, OPSS will issue you with a notice indicating our intention and setting out the grounds for the proposed penalty and the amount to be paid. Where we issue a Notice of Intent, you are entitled to make written representations to us in relation to the proposed Monetary Penalty. You must do this within 28 days beginning on the day on which the notice of our intention is given. This allows you to raise any concerns in relation to the imposition of proposed Monetary Penalty (including where it includes a fixed penalty element and a daily penalty element), or the amount(s).

5.8 Once the period for making representations has expired, OPSS will take account of any written representations and make a decision. Where we decide not to impose the proposed penalty we will notify you of our decision. Where we decide to vary or confirm the proposed penalty, we will serve a Monetary Penalty Notice, requiring payment of the penalty within a specified period. This will usually be 28 days but may be longer where we consider this appropriate. A separate period may be specified for payment of any daily penalty.

5.9 Where OPSS decides to impose a Monetary Penalty you are entitled to appeal to the First-tier Tribunal (see section 7). The appeal may relate to our decision to impose a penalty; the amount of the penalty; or the period for payment. We will set out your rights when we inform you of our decision.

5.10 A Monetary Penalty Notice may be revoked by OPSS or may be varied, although the variation may not make the notice more onerous. Where OPSS decides to revoke or vary a Monetary Penalty Notice, we will inform you in writing. Where OPSS decides to vary a Monetary Penalty you are entitled to appeal to the First-tier Tribunal (see section 7).

5.11 OPSS publishes details of any Monetary Penalty that we impose, in line with our Enforcement Policy. The published details may be updated to indicate whether the penalty, or element of the penalty, has been paid.

5.12 Financial penalties are payable to the Consolidated Fund and are not retained by OPSS.

Penalty amount

5.13 The Act specifies the maximum penalty that may be imposed in relation to non-compliance – the fixed penalty element – as the greater of

a) £10 million, or

b) 4% of the person’s qualifying worldwide revenue for the person’s most recent accounting period (subject to provisions outlined in sections 38(2) to 38(5) of the Act).

5.14 The Act specifies the maximum penalty that may be imposed in relation to non-compliance that continues beyond the penalty deadline – the daily penalty element – as £20,000 per day.

5.15 In line with its Enforcement Policy, OPSS will determine what level of penalty is appropriate, based on the facts of the individual case, using the information available to it. OPSS will consider any relevant factors, including in relation to the following matters:

a) potential or actual harm

b) culpability factors

c) turnover

d) prompt and full disclosure in relation to the non-compliance

e) any known practical or technical reasons for continuing non-compliance

f) any early action to remedy the non-compliance or its effects

g) any restorative or restitutional action taken

h) the compliance history of the person

i) the period of the non-compliance

j) a co-operative approach in dealing with OPSS

k) any evidence of general commitment to compliance and to acceptance of responsibility for non-compliance and its effects

l) any financial gain attributable to the non-compliance

5.16 Where OPSS has determined that it is appropriate to include a daily penalty in the Monetary Penalty Notice, the fixed penalty and daily penalty elements of the Monetary Penalty will be determined separately.

6) Forfeiture Order

6.1 A Forfeiture Order is a court order that may require non-compliant products to be delivered up to OPSS or another person; and may permit or require destruction or disposal of the products.

6.2 OPSS is able to apply to the appropriate court for a Forfeiture Order in respect of any products where it has reasonable grounds to believe that:

a) there is a compliance failure in relation to ‘forfeitable products’ (see 6.3), and

b) the products are, or will be, ‘UK consumer connectable products’, as defined in section 54 of the Act

6.3 ‘Forfeitable products’, as defined in section 42(1) of the Act, include relevant connectable products that:

• are in the possession or control of any manufacturer, importer or distributor of the products, or an authorised representative of the manufacturer, including any products that have been returned as a result of a compliance failure or suspected compliance failure
• have been returned, as a result of a compliance failure or suspected compliance failure, to a person specified in a Recall Notice, or to a person acting on behalf of a manufacturer, importer, distributor or authorised representative
• have been seized and detained by OPSS

6.4 OPSS is required to give notice of its application for a Forfeiture Order, and of the date and location of the court proceedings, to every identifiable person having an interest in the products, unless it is not reasonable in the circumstances to do so.

6.5 The appropriate court may:

a) Make an order for the forfeiture of any forfeitable products, and any other property that is not reasonably practicable to separate it from the products, or

b) Order the products to be returned to the owner or, in the case of seized products, the person from whom they were seized.

6.6 Where the court makes a Forfeiture Order, there is a right to appeal to the relevant court within 28 days of the date the Order was made. An appeal may be made by any party to the Forfeiture Order proceedings, or any other person entitled to the products.

6.7 Where the appropriate court decides not to make a Forfeiture Order or where it orders the return of the products, OPSS is entitled to appeal to the relevant court within 28 days of the decision.

6.8 Appeals against Forfeiture Order decisions are to be made to:

a) the Crown Court in England and Wales

b) the Sheriff Appeal Court in Scotland

c) a County Court in Northern Ireland

6.9 OPSS publishes details of any relevant Forfeiture Order, in line with our Enforcement Policy. The published details may be updated to indicate what action has been taken in respect of products subject to a Forfeiture Order.

7) Statutory rights to appeal to the First Tier Tribunal

7.1 You have a statutory right to appeal to the First-tier Tribunal (General Regulatory Chamber) in relation to the following:

a) a Compliance Notice (see section 2)]

b) a Stop Notice (see section 3)

c) a Recall Notice (see section 4)

d) a Monetary Penalty Notice (see section 5)

e) a decision not to award compensation in relation to a Stop Notice or Recall Notice, or a decision on the amount of compensation (see sections 3.14 and 4.12)

7.2 You must exercise your right to appeal within 28 days, beginning on:

a) the day the Notice was served, or varied, or

b) the day notice was given of our decision on a claim for compensation

7.3 Where you exercise your right to appeal in relation to a Compliance Notice, a Stop Notice, a Recall Notice, or a Monetary Penalty Notice, the notice is suspended until the outcome of the appeal is reached. Where you exercise your right to appeal in relation to the variation of a notice, the variation has no effect until the outcome of the appeal is reached, and the original notice remains in effect.

7.4 The Tribunal may, in relation to a Compliance Notice, a Stop Notice or a Recall Notice:

• confirm the notice
• vary the notice, or
• cancel the notice, or any part of it, and in this circumstance, may refer the matter back to OPSS with a direction to reconsider

7.5 The Tribunal may, in relation to a Monetary Penalty:

• confirm the penalty
• vary the amount of penalty or the period for payment, or
• cancel the penalty, and in this circumstance, may refer the matter back to OPSS with a direction to reconsider

7.6 To exercise your right to appeal, use the Notice of Appeal (General Regulatory Chamber) (Form T98).

Access form T98 and guidance on completing it.

Read further information on the General Regulatory Chamber.

8) Footnotes

1: References in this guidance to legislation should be taken to refer, where applicable, to that legislation as amended.