Chapter 2: Duties of relevant persons Section 9: Statements of compliance
This sets out that a manufacturer may not make a consumer connectable product available in the United Kingdom unless it is accompanied by (a) a statement of compliance; or (b) a summary of the statement of compliance.
	Subsection (2)(b) defines a "summary statement of compliance" as a summary of the statement of compliance that is in such a form, and contains such information, as specified in regulations made by the Secretary of State.
	Subsection (3) defines a statement of compliance, in relation to a product, as a document that meets the following conditions. A statement of compliance must state that, in the opinion of the manufacturer, the manufacturer has complied with the applicable security requirements . The statement must be prepared by or on behalf of the manufacturer, and be in a form, or contain any information, specified in regulations made by the Secretary of State.
	Subsection (4) defines "applicable security requirements" as any relevant security requirements relating to a product to which the manufacturer is subject, except requirements that apply only after the product has been made available in the United Kingdom, or requirements that apply only when the manufacturer is making the product available to customers in the United Kingdom.
	Subsection (5) covers cases where a product has more than one manufacturer. In such cases, each manufacturer may prepare a separate statement of compliance, or a single statement of compliance can be prepared jointly by or on behalf of all manufacturers. The statement of compliance must contain all necessary information for the duty to be discharged.
	Subsection (6) provides a power for the Secretary of State to set out in regulations further details around statements of compliance, which may include provisions requiring the manufacturer to take certain specified steps to determine compliance with the security requirements for the preparation of the statement of compliance, as well as provisions around the retention, publishing and making available of the document. The exercise of this power will be subject to the negative resolution procedure.
	Subsection (7) provides a power for the Secretary of State to state that a manufacturer has complied with the statement of compliance duty when certain conditions are met.
Examples of potential use of statement of compliance regulation-making powers
The Secretary of State may set out in regulations the minimum time that records of compliance statements must be kept, and the steps a manufacturer must take to assure compliance.
The Secretary of State may also establish in regulations that a statement of compliance or a summary version of it are not required if a product is accompanied by documentation which confirms that the manufacturer has complied with another specified cyber security regime that the Secretary of State recognises as equivalent to this regime.