Part 1: Product Security Chapter 1: Security requirements Section 6: Excepted products
This Section provides a power for the Secretary of State to specify in regulations connectable products to which Part 1 will not apply, but would otherwise be within the regulatory scope of this legislation. The Government intends to except products from the regulatory scope of this legislation where it would not be appropriate for them to be included, for instance, where inclusion would subject them to double regulation.
	Subsection (2) establishes that regulations may be made to specify rules for the excepted status of a "primary product" and a "secondary product" when they are incorporated into or attached to, or otherwise form part of, each other.
	Regulations made by the power in this Section are subject to the negative resolution procedure when varying a description of a product, or, specifying any description of a product which is covered by equivalent requirements relating to security. All other regulations made under the Section are subject to the affirmative resolution procedure.
Example exercise of power: Future exceptions for the purposes of avoiding dual regulation
Smart metering devices. The Government is not intending to except all smart metering products, but only those that are already subject to security requirements through Relevant Technical Specifications which must be met when subject to a Relevant Energy License Conditions as set out in the Gas Act 1986 (as amended) and the Electricity Act 1989 (as amended). The smart metering products the Government intends to except are covered by the Commercial Product Assurance (CPA) scheme.
Smart charge points. The Government regulates the security of certain smart charge points through the Electric Vehicles (Smart Charge Point Regulations) 2021.
Medical devices. The Government regulates these through the Medical Devices Regulations 2002. The Government consulted on the future regulation of medical devices in the United Kingdom in 2021, and committed to updating the UK regime to include cyber security as an essential requirement in its June 2022 response to that consultation.