Smart Thermostats and Connected Heating Controls: What the UK Product Security Rules Require of Manufacturers Since April 2024

A smart thermostat sits on the home network and controls the heating, so how it is secured matters as well as whether it works with the boiler. Since 29 April 2024 the law has set minimum security standards for such devices. This guide summarises GOV.UK’s guidance on the consumer connectable product security regime, the 2023 Regulations on legislation.gov.uk and the government’s announcement of the Bill. The rules cover the UK with the exceptions noted below. It is general information, not a security assessment of any product.

The law and the date it started

GOV.UK says the regime comprises Part 1 of the Product Security and Telecommunications Infrastructure Act 2022 and the Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023, and that businesses in the supply chain had to be compliant from 29 April 2024. Manufacturers, importers and distributors, including retailers, all have duties. The Office for Product Safety and Standards enforces the regime on behalf of the Department for Science, Innovation and Technology, taking a risk-based approach that is pragmatic and proportionate.

In the government’s announcement of the Bill, ministers said the law would put a firewall around everyday technology, listing thermostats among the examples, and that connectable products include items that can connect to multiple other devices without connecting directly to the internet, with smart light bulbs and smart thermostats named as examples. How controls work with a boiler is covered in the guide to smart thermostats and boilers.

What the rules do not cover

GOV.UK states that the regulations do not cover products made available for supply in Northern Ireland to which certain relevant legislation applies under the Windsor Framework, electric vehicle charge points, medical devices, smart meter products, and desktop, laptop and tablet computers without cellular capability, unless designed exclusively for children under 14. An amendment that took effect on 25 February 2025 also exempts certain categories of vehicle. Smart thermostats are not on the exemption list.

Requirement 1: passwords

Schedule 1 to the 2023 Regulations says passwords must be either unique per product or defined by the user. A password that is unique per product must not be based on incremental counters (such as “password1” and “password2”), on publicly available information, or on unique product identifiers such as serial numbers unless an accepted encryption or keyed hashing method is used, and must not be otherwise guessable in a way unacceptable as good industry practice. The government said when announcing the Bill that the aim was to end universal factory defaults such as “password” or “admin”.

Requirement 2: reporting security issues

Manufacturers must publish at least one point of contact for reporting security issues, and must publish when the reporter will receive an acknowledgment and status updates until the issue is resolved. The Regulations require this information to be accessible, clear and transparent, and made available without a prior request, in English, free of charge and without asking for the reporter’s personal information.

Requirement 3: how long security updates last

The defined support period, meaning the minimum length of time for which security updates will be provided, must be published, and a new period must be published as soon as practicable if it is extended. The Regulations say the information must be given without prior request, free of charge, in English and in a way a reader without technical knowledge can understand. Where a manufacturer publishes an invitation to purchase on its own website, the support period must be given equal prominence to the price and other key purchase information. The requirement is not met if the defined support period is shortened after publication. For a buyer, the practical point is that the length of time a thermostat will keep receiving security updates should be visible before purchase.

Statement of compliance and enforcement

Manufacturers must produce a statement of compliance that includes the information in Schedule 4 and ensure it accompanies the product, and importers and distributors must not make a product available unless it is accompanied by one. GOV.UK says the Act does not require a physical document, so a digital statement is possible, but it must ultimately accompany the product. Manufacturers and importers must retain copies, and there are further duties to investigate and act on compliance failures. When the Bill was introduced, the government said it would allow fines of up to £10 million or 4% of global revenue, and up to £20,000 a day for an ongoing contravention, with notices requiring compliance, recall or an end to sales.

FAQs

Who is responsible for compliance?

GOV.UK says manufacturers, importers and distributors, including retailers, all have duties under the regime, which OPSS enforces.

What should I look for before buying a smart thermostat?

A clearly published security update period, a published way to report security issues, and a statement of compliance, since each is now a legal requirement for relevant products.

Are smart meters covered?

No. GOV.UK lists smart meter products among those the regulations do not cover.

The bottom line

Since 29 April 2024 manufacturers of consumer connectable products, which government material says include smart thermostats, must avoid universal default or guessable passwords, publish how to report security issues, and publish a minimum security update period, and importers and retailers must not supply products without a statement of compliance. The rules sit alongside, rather than replace, questions of boiler compatibility and installation, and exclude Northern Ireland products covered by the Windsor Framework, smart meters and a few other categories. This is general information, not personalised advice.

Sources

This guide draws on the following primary sources, current as of 9 October 2026:

• Office for Product Safety and Standards, Regulations: consumer connectable product security, last updated 17 March 2025 (gov.uk)
• The Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023, Schedule 1 (legislation.gov.uk)
• The UK Product Security and Telecommunications Infrastructure (Product Security) regime (gov.uk)
• New cyber laws to protect people’s personal tech from hackers, November 2021 (gov.uk)

Related guides

Best Boiler Deals is an independent guide. We may earn a fee from some links; this never affects what we write. This article is general information, not regulated advice on any specific installation; always confirm the details with a Gas Safe registered engineer.