Section 2 — Further provision about regulations under section 1

Extent: E+W+S+N.I.

This version in force from 2024-04-29

Snapshot: 2026-08-24

Reproduced from legislation.gov.uk (Crown Copyright, Open Government Licence v3.0). Amendments made after 2026-08-24 may not be reflected — always check the official text .

(1) A security requirement may relate to (among other things) all the relevant connectable products of—

(a) a relevant person, or

(b) a relevant person of a particular description.

(2) For the purposes of subsection (1), the relevant connectable products of a relevant person are—

(a) in the case of a person who is a manufacturer, any relevant connectable products in respect of which the person is a manufacturer;

(b) in the case of a person who is an importer, any relevant connectable products in respect of which the person is an importer;

(c) in the case of a person who is a distributor, any relevant connectable products in respect of which the person is a distributor.

(3) A security requirement may be described by reference to (among other things)—

(a) any software used for the purposes of, or in connection with, the operation of a relevant connectable product;

(b) any software used by a person in the course of, or in connection with, using a relevant connectable product;

and for these purposes it does not matter whether the software is installed on the product or whether the software or service is provided by a manufacturer of the product.

(4) A security requirement may (among other things) require a relevant person to do something in relation to a relevant connectable product, including in relation to times after a relevant connectable product has been made available in the United Kingdom.

(5) Regulations under section 1 are subject to the negative resolution procedure if the only provision they make under that section is provision—

(a) varying any description of—

(i) products to which a security requirement relates, or

(ii) software by reference to which a security requirement is described, or

(b) otherwise altering any term used in describing a security requirement without altering the effect of the security requirement or the extent to which it applies in any case.

(6) Except as provided by subsection (5), regulations under section 1 are subject to the affirmative resolution procedure.