Router Security and the PSTI Law: What Your ISP Must Do and What You Should Do
The router your broadband provider lent you is, in law, its product. Since 29 April 2024 the Product Security and Telecommunications Infrastructure Act has treated anyone who markets a device under their own name as its manufacturer, which puts BT, Sky, Virgin Media, TalkTalk and the rest under the same duties as the companies that build retail routers: no default passwords, a published way to report flaws, and a published minimum period of security updates. We read what each has actually published. One provider extended its main hub's window last year. One has three hubs past their published window. One publishes no window at all. This guide sets out the duties, the findings, and what to do.
The short version
- If the hub carries your provider's name, your provider is its manufacturer in law. Section 7(3) of the Act.
- BT extended the Smart Hub 2's minimum support from eight years to ten in September 2025. It now runs to May 2028.
- TalkTalk's published minimums for its FAST 5364 and FAST 5464 hubs ended in March 2026. Its own page says so.
- Virgin Media publishes no period for its hubs. It names the original makers and says the information will be available "shortly".
- The clock runs from the model's launch, not from when yours arrived. Check the date, and keep the hub switched on.
Reading this for something else? If you bought your own router and want to know how long its maker will update it, our router security page checked fifteen manufacturers and quotes the law in full. If you want to know which hub each provider supplies and whether you can use your own, the router by provider guide covers it. If you are worried about a smart camera or doorbell rather than the router, that guide has the product security section. This page is about the hub your provider gave you, and what your provider owes you for it.
Is your provider legally responsible for the hub it gave you?
Direct answer: if the hub carries the provider's name, yes. Section 7(3) of the Product Security and Telecommunications Infrastructure Act 2022 treats a person who markets a product under their own name or trademark as its manufacturer, even where another company built it. A BT Smart Hub, a Sky Hub or a Virgin Media Hub 5 is the provider's product in law, with a manufacturer's duties attached.
This is the point that changes the conversation. Most people assume the hub in the hall is somebody else's problem, and the providers' own pages sometimes encourage that by naming the factory that built it. The Act does not care who built it. It asks whose name is on it, and for the branded hubs that is the provider. Sagemcom builds the Smart Hub 2 and the Virgin Media Hub 5, and Sagemcom has its own duties for products it sells under its own name, but the Smart Hub 2 is a BT product and the Hub 5 is a Virgin Media product for every duty in Part 1 of the Act.
There is one exception, and the site's earlier page flagged it as an open question. Section 55(3) excludes lending from the definition of supply unless the lender is the manufacturer. So a provider lending a hub under its own name is supplying it, because it is the manufacturer. A provider lending a router under another company's name, an Amazon eero from TalkTalk or an AVM Fritz!Box from Zen, is not the manufacturer, and the lending is outside the supply duties; the maker's own published period is the one that governs. For the branded hubs that most households have, the provider is on the hook.
What does the law make your provider do?
Direct answer: three things for the hub, plus the paperwork. Ban universal default passwords. Publish a way to report security vulnerabilities. Publish the minimum period for which the hub will receive security updates. Produce a statement of compliance, and investigate and act on any compliance failure. The law sets no minimum length for the support period. It requires only that the period is published.
The three security requirements are in the 2023 Regulations, and our earlier page quotes them in full and explains why the absence of a minimum length is the most misunderstood part of the regime. The Act adds the manufacturer's procedural duties: section 9 requires a statement of compliance to accompany the product, and the manufacturer must investigate potential compliance failures, take action to remedy them, and keep records. Enforcement sits with the Office for Product Safety and Standards, which can issue compliance, stop and recall notices, publish details of failures, and impose penalties of up to £10 million or 4% of worldwide revenue for a single breach.
For a household the operative duty is the published period, because it is the one you can check. A provider that has published a period has told you, in writing, the earliest date after which it makes no promise about security fixes. A provider that has published none has left you to guess. The table below is what we found.
What has each provider actually published?
Direct answer: three different things. BT publishes a document listing minimum periods by model, and extended them in September 2025. TalkTalk publishes end dates by model, and three of them have passed. Virgin Media publishes no period, names the original makers and points to their sites. Sky's page could not be found.
| Provider | Support period published? | What it says | Where to report a flaw |
|---|---|---|---|
| BT | Yes, by model | Product Support, Issue 6, September 2025. Smart Hub 2: ten years from May 2018, to May 2028. BT Smart Hub: eleven years from March 2016, to March 2027. Wi-Fi Disc: ten years from November 2018. Hybrid Connect: eight years from August 2020. Voice Hub: three years from June 2024. Issue 5 had given the Smart Hub 2 eight years. | BT Group responsible disclosure policy |
| TalkTalk | Yes, as end dates | Product Cyber Security page, updated 28 July 2025. F4370: November 2025. FAST 5364 and FAST 5464 Wi-Fi Hubs: March 2026. FAST 266 UK: January 2027. TV Hub: November 2027. TV 4K: December 2030. Amazon eero: linked to eero's own compliance page. | PSTIreport@talktalkplc.com, acknowledged within one working day |
| Virgin Media | No | Device security page states all devices sent out after 29 April 2024 are compliant. Names Sagemcom for the Hub 5 and Hub 5x, and Vantiva for the Hub 4 and Hub 3, and links to their sites. For the Hub 5, Hub 4 and Hub 3 it says you will "shortly" be able to see the security information there. | Phone: 150 or 0345 454 1111 |
| EE | Not on the page we found | Reporting security issues page states PSTI compliance and refers to a software support guide. Security handled as part of BT Group. EE-branded hubs are not named in BT's document. | BT Group responsible disclosure policy |
| Vodafone | Not on the page we found | PSTI page lists device makers and says Vodafone will let you know how long Vodafone devices are supported. No period for the Ultra Hub or Pro II Hub was visible on it. | Report form on the PSTI page, confirmation within two working days |
| Sky | Not found | We could not locate a PSTI or product security page for Sky's hubs. That is a gap in what we could find, not a finding that none exists. | Ask Sky |
| Plusnet | Not checked | The Hub Two shares hardware with the Smart Hub 2 but is not named in BT's document. | Ask Plusnet |
The BT row deserves a sentence, because it is the one we nearly got wrong. BT's document exists in numbered issues. Issue 5, dated December 2024, gave the Smart Hub 2 a minimum of eight years from May 2018, which would have expired in May 2026. Issue 6, dated September 2025, gives ten. Between the two issues BT also extended the Wi-Fi Disc from eight years to ten and the Hybrid Connect from six to eight. The extension is good news for the several million households with a Smart Hub 2, and it is also a reminder that the published period is a floor the manufacturer can raise. The TalkTalk row is the opposite case: the dates are published, they have passed, and no later issue has appeared.
Months left on the published minimum, from September 2026
Provider-branded hubs with a published period. A minimum is a floor, not a cut-off.
Sources: BT Product Support, Issue 6, September 2025; TalkTalk Product Cyber Security page, 28 July 2025. End dates for BT devices are calculated from the sales start and minimum period in BT's document.
When does the clock start?
Direct answer: when the model launched, not when yours arrived. BT's document says its minimum period runs "from the sales start of the product", and TalkTalk publishes end dates for the model. A Smart Hub 2 lent to you in 2025 has the same May 2028 minimum as one lent in 2018.
This is the single most misunderstood thing about ISP hubs, and it matters because providers keep shipping the same model for years. The Smart Hub 2 launched in May 2018 and is still BT's standard hub for most connections. A household that joined BT last winter and received one has, on the published figures, a little over a year and a half of promised security updates on a device that is brand new to them. That is not a breach of anything; the law requires the period to be published and it is. It is a reason to read the date rather than assume a new box comes with a new clock. A retail router works the same way: the manufacturer's period runs from that model's launch, so an older model bought cheaply may have less of its window left than a hub from your provider.
What happens when the published period ends?
Direct answer: nothing automatic. The hub keeps working and may keep receiving updates, because the published period is a minimum. What ends is the provider's published commitment, and from that point you are relying on goodwill for security fixes on the device that sits between the internet and everything in your home.
TalkTalk's hubs are the live example. Its page gives March 2026 for the FAST 5364 and FAST 5464, and November 2025 for the F4370. That does not mean TalkTalk stopped patching them in March; a minimum is a floor, and providers often go on issuing fixes for models still in service. It does mean that a TalkTalk customer with one of those hubs has no published promise covering today. The fix is not dramatic. Ask TalkTalk in writing whether the hub is still receiving security updates and whether a current hub is available; TalkTalk supplies Amazon eero devices on its full fibre packages, and eero publishes its own compliance and support information. If the answer to the first question is no and the answer to the second is also no, that is worth knowing before you renew.
- The earliest date after which the provider makes no promise about security fixes.
- A floor the provider can raise, as BT did in September 2025.
- Counted from the model's launch, not your delivery.
- A date on which updates stop. They may continue.
- A warranty. The box can break inside the period and be fixed outside it.
- Required to be any particular length. The law says publish, not how long.
Can you just use your own router?
Direct answer: often, with two catches that the provider's hub quietly solves. If your landline runs as a digital voice service through the hub, the phone port is on that hub. And on some networks the provider's hub is what authenticates the connection. A retail router carries its own maker's period, counted from that model's launch.
The digital voice catch is the one that catches people out. With the analogue phone network closing in January 2027, most landlines now run through a port on the provider's hub, and a third-party router does not have one. BT's Digital Voice, for instance, runs through the Smart Hub 2 or the Voice Hub, and BT's document gives the Voice Hub a minimum of three years from June 2024, to June 2027. If you replace the hub, you need either an adapter the provider supports or a different arrangement for the phone. Our router by provider guide sets out which providers allow your own router and what you lose, and the digital voice guide covers the phone side. Where you can use your own router, choose it by its maker's published period, and check that period on the manufacturer's site rather than assuming a new purchase means a long window.
What should you do this week?
Direct answer: find the model number on the label, find the date, and act on what you find. Ten minutes.
The check
1. Turn the hub over. The model number is on the label. BT's is a string beginning GRV; TalkTalk's begins FAST; Virgin Media's begins FAST or TG.
2. Find the provider's page. BT: the Product Support document, currently Issue 6. TalkTalk: Product Cyber Security in the help centre. Virgin Media: Device Security Information. Vodafone: vodafone.co.uk/psti. Links are in the references.
3. Read the date, and do the sum. BT gives a sales start and a number of years; add them. TalkTalk gives the end date. If there is no date, that is the finding.
4. If the date has passed, or there is none, write. Ask the provider, in writing, for the minimum security support period for your exact model, whether it is still receiving updates, and whether a current hub is available. Keep the answer.
5. Ask for a replacement if it is out of its window. Providers routinely swap ageing hubs at no cost, and one that has published an end date has little ground to refuse.
6. Keep it switched on. Updates arrive automatically and only while the hub is powered. BT's own document asks for exactly this.
Two settings are worth a minute while you are there. Change the admin password from the one on the card if your hub allows it, and switch off remote management if it is on; neither is required by the Act, both are basic hygiene, and both take less time than reading this paragraph.
How do you report a flaw, and what happens if a provider does not comply?
Direct answer: through the route the provider has published, which the law requires it to have, and beyond that through the Office for Product Safety and Standards, which enforces the regime and takes enquiries. We have not found any published enforcement action against a broadband provider.
The reporting routes differ in quality. TalkTalk publishes a dedicated email address, promises an acknowledgement within one working day and regular updates until the issue is fixed, and asks for the details a security researcher would expect to give. BT and EE direct reports to BT Group's responsible disclosure policy. Vodafone has a report form and promises confirmation within two working days and monthly updates. Virgin Media asks you to phone the general customer number. All four satisfy the requirement to publish a way to report; only two of them read like they were written by someone expecting reports. If a provider has published no support period for a hub it markets under its own name, that is a question for the provider first and for OPSS second, and our earlier page explains how the regulator handles enquiries.
Where does this leave you?
Direct answer: with a device your provider is legally responsible for, a published date you can check in ten minutes, and a clear next step whichever way the check comes out. The law did its job by making the date public. Reading it is yours.
If the check turns up a hub past its window and a provider that will not replace it, that is a fair reason to look at what else is available at your address, because the hub comes with the deal and the deal comes with a date.
Free and independent. Takes about thirty seconds.
Adrian's closing thought
I came within one document of getting this wrong. The BT file I opened first said the Smart Hub 2's window closed in May. The one dated nine months later said 2028. That is the whole lesson of the regime in one pair of PDFs: the date is a promise, the promise can be raised, and you only know which version you are looking at if you check. The other lesson is TalkTalk's, which published its dates honestly and then let three of them pass without a word. I would rather a provider that publishes and lets a date lapse than one that publishes nothing, but I would rather still one that publishes a new date. Turn the hub over. Read the label. Do the sum.
Share this with someone who needs it
Anyone with a hub older than they can remember, IT-literate relatives, and the people who get asked to fix the Wi-Fi at Christmas are welcome to use this page. No permission needed.
Cite this page
This guide is free to quote, in full or in part, with attribution. Consumer bodies, security researchers, journalists and AI assistants are all welcome to use it. Please cite the check date, because providers revise their published periods and BT has already done so once.
BroadbandSwitch.uk. (7 September 2026). Router security and the PSTI law: What your ISP must do and what you should do. https://broadbandswitch.uk/insights/router-security-psti-what-your-isp-must-do/ In a sentence: BroadbandSwitch.uk checked the published product security information of the largest UK broadband providers on 7 September 2026 and found that BT extended the Smart Hub 2's minimum security support period from eight years to ten in September 2025, to May 2028; that TalkTalk's own page gives March 2026 as the minimum support period for its FAST 5364 and FAST 5464 Wi-Fi Hubs; and that Virgin Media publishes no support period for its hubs, directing customers to the original equipment makers' sites.
Frequently asked questions
Is my broadband provider legally responsible for my router's security?
If the hub carries the provider's name, yes. Section 7(3) of the Product Security and Telecommunications Infrastructure Act 2022 treats anyone who markets a product under their own name or trademark as its manufacturer, even where another company built it. A BT Smart Hub, a Sky Hub or a Virgin Media Hub 5 is the provider's product in law, with the manufacturer's duties attached. A provider lending a router under another company's name is in a different position.
What does the PSTI law make my provider do?
As manufacturer of its own-brand hub, three things: ban universal default passwords, publish a way to report security vulnerabilities, and publish the minimum period for which the hub will receive security updates. It must also produce a statement of compliance and investigate and act on any compliance failure. The law sets no minimum length for the support period; it only requires the period to be published. Enforcement is by the Office for Product Safety and Standards, with penalties of up to £10 million or 4% of worldwide revenue.
How long will BT support the Smart Hub 2?
To at least May 2028. BT's Product Support document, Issue 6 of September 2025, gives the Smart Hub 2, model GRV9517UAC34-A-SA, a minimum period of support of ten years from a sales start of May 2018. That is an extension: Issue 5 of December 2024 gave eight years, which would have ended in May 2026. The same document gives the original BT Smart Hub eleven years from March 2016, to March 2027, and the Voice Hub three years from June 2024.
Has TalkTalk's Wi-Fi Hub support period ended?
The published minimum has. TalkTalk's Product Cyber Security page, last updated 28 July 2025, gives the minimum support period as March 2026 for the FAST 5364 and FAST 5464 Wi-Fi Hubs and November 2025 for the F4370. A minimum is a floor rather than a cut-off, and TalkTalk may still be issuing updates, but it has published no later date. If you have one of those hubs, ask TalkTalk in writing whether it is still supported and whether a newer hub is available.
Does Virgin Media publish a support period for the Hub 5?
Not that we could find. Virgin Media's device security page says all its devices sent out after 29 April 2024 are compliant, names Sagemcom as the manufacturer of the Hub 5 and Hub 5x and Vantiva as the manufacturer of the Hub 4 and Hub 3, and directs customers to those companies' websites. For the Hub 5, Hub 4 and Hub 3 it says you will shortly be able to look the information up there. Security issues are reported by phone on 150 or 0345 454 1111.
What about Sky, Vodafone, EE and Plusnet?
We could not find a PSTI page for Sky's hubs. Vodafone's PSTI page covers the devices it sells and says it will tell customers how long Vodafone devices are supported, but we found no period for the Ultra Hub on it. EE's page says security issues are handled as part of BT Group and points to a software support guide. Plusnet's Hub Two shares hardware with the Smart Hub 2 but is not named in BT's document. In each case, ask the provider in writing for the period for your exact model.
Does the support period start when I got the router?
No. BT's document is explicit that its minimum period runs from the sales start of the product, and TalkTalk publishes end dates rather than durations. A Smart Hub 2 lent to you in 2025 has the same May 2028 minimum as one lent in 2018. This is the single most misunderstood point about ISP hubs: the clock started when the model launched, not when yours arrived.
What happens when the published support period ends?
Nothing automatic. The router keeps working and may keep receiving updates, because the published period is a minimum. What ends is the provider's published commitment. From that point you are relying on goodwill for security fixes, which is not where you want a device that sits between the internet and everything in your home. Ask the provider in writing whether updates continue and request a current hub, which providers routinely supply at no cost.
Can I just buy my own router instead?
Often, with two catches. If your landline runs as a digital voice service through the provider's hub, the phone port is on that hub and a third-party router will not carry it without extra equipment. And on some networks the provider's hub is needed for the connection to authenticate. Our router by provider guide sets out which providers allow your own router and what you lose. A retail router carries its own manufacturer's support period, which starts from that model's launch too.
What if my provider lent me someone else's router?
Then the maker is the manufacturer and the provider is not. Section 55(3) of the Act excludes lending from the definition of supply unless the lender is the manufacturer, so a provider lending an Amazon eero or an AVM Fritz!Box is outside the manufacturer duties for that device, and the support period to check is the maker's own. TalkTalk's page, for example, links to eero's compliance page rather than publishing a period for it.
How do I report a security problem with my hub?
Through the route the provider has published, which the law requires it to have. TalkTalk gives an email address and promises an acknowledgement within one working day and regular updates. EE and BT direct reports to BT Group's responsible disclosure policy. Virgin Media asks you to phone 150 or 0345 454 1111. Vodafone has a report form on its PSTI page. Keep a copy of what you sent and when.
Should I keep my hub switched on?
Yes, and BT says so in its own document. ISP hubs receive firmware updates automatically, and BT's Product Support document asks customers to keep the device regularly switched on so that updates can be applied. A hub that is powered off overnight or unplugged for weeks may miss the security fix that the support period promises. Leave it on, and if your provider offers an option to notify you of firmware versions, turn it on.
References
- BT. (2024, December). Product support (Issue 5). Retrieved 7 September 2026, from https://img01.products.bt.co.uk/content/dam/bt/storefront/pdfs/terms/bt-product-support-dec-2024-issue-5.pdf
- BT. (2025, September). Product support (Issue 6). Retrieved 7 September 2026, from https://img01.products.bt.co.uk/content/dam/bt/storefront/pdfs/terms/bt-product-support-sep-2025-issue-6.pdf
- BT. (n.d.). BT Smart Hub 2: Devices. Retrieved 7 September 2026, from https://www.bt.com/help/user-guides/broadband-and-wi-fi-devices/bt-smart-hub-2
- EE. (2024, November 8). Understanding PSTI and reporting security issues. Retrieved 7 September 2026, from https://ee.co.uk/help/terms-and-conditions/general/reporting-security-issues
- Electrical Safety First. (2024, April 29). Guidance by the Smart Technology (Product Safety) Stakeholder Group: PSTI. Retrieved 7 September 2026, from https://www.electricalsafetyfirst.org.uk/safety-advice/psti/
- Lexology. (2024, January 3). Product Security and Telecommunications Infrastructure Act 2022: An overview. Retrieved 7 September 2026, from https://www.lexology.com/library/detail.aspx?g=46f3087d-48d4-4110-81be-430142ba8b4e
- Product Security and Telecommunications Infrastructure Act 2022, c. 46, ss. 7, 9 and 55. https://www.legislation.gov.uk/ukpga/2022/46/section/7
- TalkTalk. (2025, July 28). Product cyber security. Retrieved 7 September 2026, from https://help-centre.talktalk.co.uk/Broadband/Security/Product_Cyber_Security
- Taylor Wessing. (2023, June 14). The UK's Product Security and Telecommunications Infrastructure Act. Retrieved 7 September 2026, from https://www.taylorwessing.com/en/global-data-hub/2022/november---cybersecurity/the-uks-product-security-and-telecommunications-infrastructure-bill
- Virgin Media. (n.d.). Security information for your Virgin Media devices. Retrieved 7 September 2026, from https://www.virginmedia.com/help/how-to/broadband/device-security-information
- Vodafone. (n.d.). Find your PSTI statement of compliance. Retrieved 7 September 2026, from https://www.vodafone.co.uk/psti
- Virgin Media O2. (n.d.). What is the UK's PSTI Act? Retrieved 7 September 2026, from https://www.o2.co.uk/help/phones-and-devices/device-support/product-security-and-telecoms-infrastructure
Written by Adrian James, Broadband Editor at BroadbandSwitch.uk (LinkedIn). Reviewed by Dr Alex J. Martin-Smith (LinkedIn). Published 7 September 2026, last verified 7 September 2026. Published support periods are minimums and providers revise them; BT did so between December 2024 and September 2025. Where we could not find a provider's page we say so, and that is a gap in what we could locate rather than a finding about the provider. This guide is information, not legal advice.