New UK Product Security and Telecommunications Infrastructure (PSTI) Law

Information published under Product Security and Telecommunications Infrastructure Act 2022 (PSTI) , effective from 29 April, 2024.

Xiaomi is committed to complying with the regulatory framework applicable in every jurisdiction where we offer products or services and continuously monitors potential obligations to ensure a high standard of compliance.

In this respect, we carry out an exhaustive review of all products covered by PSTI and confirm that we will not release internet or network-connectable products unless they meet the following three requirements stipulated in PSTI:

• Products cannot use a universal default password or one that is easy to determine.

• Manufacturers must provide a public point of contact to report security vulnerabilities in products.

• Manufacturers must publish the minimum amount of time a product will receive security updates.

The length of software security update support for in-scope Xiaomi products can be found here: https://trust.mi.com/misrc and the public point of contact for reporting security vulnerabilities could be found here: https://trust.mi.com/misrc/response.

Moreover, from 29 April, 2024, all relevant products supplied to end-users in the UK must also be accompanied by a Statement of Compliance confirming that the product fully complies with the above requirements.

Please see below for an example Statement of Compliance that will accompany in-scope Xiaomi products approved for sale in the UK. The Statement of Compliance for in-scope Xiaomi smartphones and accessoires can be found here: https://www.mi.com/global/certification/compliance/ and for Xiaomi smart home and life style products, the link is https://www.mi.com/global/service/support/declaration.html