UK IoT Password Law: What Small Businesses Must Still Check | APX Digital

Since April 2024, selling a smart device with a guessable default password has been illegal in the UK. Every router, camera and NAS installed before that date still has the problem.

What the law actually says, what it doesn't cover, and the one-evening audit that closes the gap.

As of September 2026, the UK rules that govern default passwords on connectable devices are the Product Security and Telecommunications Infrastructure Act 2022 (PSTI) and the security requirements in the PSTI (Security Requirements for Relevant Connectable Products) Regulations 2023, which came into force on 29 April 2024. If you've heard these called "Making Digital Insecure rules from October 2025", that name and date don't match any live government source. We checked NCSC and GOV.UK this week before writing this. The verified regime is below.

What changed on 29 April 2024

The PSTI Act sets three baseline requirements on every "relevant connectable product" sold to UK consumers: anything that connects to the internet or to a local network, from smart doorbells and security cameras to smart plugs, TVs and baby monitors. Per the NCSC's guidance and the gov.uk regime page:

1. No universal default passwords. Manufacturers must not supply devices with easily guessable passwords that are shared across units. Each device gets its own, and it must be changeable.
2. A named point of contact for reporting security issues, so vulnerabilities actually reach someone who can fix them.
3. A published minimum support period. The manufacturer must state, with an end date, how long the device will receive security updates. When that period runs out, the device becomes easier to hack, and buyers know the date in advance.

This applies to anyone importing or retailing these products in the UK, not just overseas manufacturers. Non-compliance is a criminal offence, with fines of up to £10 million or 4% of qualifying worldwide revenue, whichever is higher.

What the law does not do for your business

Two honest limits, and they're the reason this still needs an owner:

• It's prospective. The rules bite on products made available from 29 April 2024 onward. The CCTV recorder installed in your office in 2021 with the password "admin" is out of scope, and it's still on your network.
• It targets consumer products. Desktops, laptops and non-cellular tablets are explicitly excluded, as are EV charge points, medical devices and smart meters. Plenty of the kit in small-business server cupboards (NAS boxes, pro CCTV, network printers) sits in a grey zone between "consumer smart device" and business equipment.

The law makes the next device you buy safer. It does nothing about the devices you already run. That's a you problem, or ours.

The one-evening audit

Walk your premises with this list. It takes an hour for a typical small office and it's the exact check we run on a first cyber engagement.

• [ ] Inventory everything that has an IP address and isn't a laptop. Router, Wi-Fi access points, NAS, CCTV recorders and cameras, network printers, smart doorbells, alarms, thermostats.
• [ ] Change every default password. Where the device still ships with a universal one (admin/admin, password on a sticker that's really a PIN), change it. NCSC's three random words approach beats "P@ssw0rd1!".
• [ ] Turn on two-step verification on any device or cloud app that supports it.
• [ ] Enable automatic updates, or calendar them monthly if the device is too old to offer auto-update.
• [ ] Find the support end date for each device. For anything bought after April 2024 it must be stated on the packaging or in the manufacturer's statement of compliance. Anything past end-of-support gets a replacement budget line, not a prayer.
• [ ] Check exposure. No admin interface, camera or NAS should answer to the open internet. If a port-forward exists from 2019 that nobody can explain, close it and see if anything screams.
• [ ] Separate the guest/kit network from the network your accounts and file server live on.

Where this overlaps your Microsoft 365

Password hygiene on IoT doesn't matter if your mail tenant still accepts legacy authentication or your scanner still relays through an open SMTP path, the same "default settings" problem at the other end of the building. We cover that separately in Why M365 default settings leave your mail doors open, and the financial case for doing any of this in The breach maths for a small business.

---

APX Digital runs device audits, hardening and monitoring for West Midlands SMEs. No price list: a five-person firm and a fifty-person one need different work.

Book a cyber review → apxdigital.io/cyber

Info@apxdigital.io · 07753 226214 · Birmingham / Coventry / West Midlands