Chapter 2: Duties of relevant persons Section 10: Duty to investigate potential compliance failures
Subsection (2) sets out a requirement for manufacturers to take all reasonable steps to investigate whether there is a compliance failure in relation to a product if they are informed that there is, or may be, a compliance failure relating to a product and if they are aware or ought to be aware that the product is or will be a UK consumer connectable product as defined in Section 54.
Example: a third party identifies a compliance failure
A security researcher discovers a specific software bug which makes the product default to a basic password setting after updating and notifies the manufacturer. The manufacturer must then investigate to determine if this constitutes a compliance failure.
Example: a manufacture identifies a compliance failure
A manufacturer makes products available in the UK and several other countries as well. The manufacturer is aware of reports in another country that their product has a vulnerability which means they may not be complying with security requirements in relation to identical products made available to customers in the UK. They then have a duty to investigate if the products in the UK are impacted and if this constitutes a compliance failure.
	The obligation to investigate reports of compliance failures applies at any time after a product has been made available in the United Kingdom.