Date Stamped: Finding a Smart Device's Real Support Horizon Before You Buy

Most technology purchases carry an implicit promise: the product will keep working, and keep being safe, for a reasonable period. In the UK, that promise is increasingly written down — but not always in the same place, and not always at all. For anyone buying a phone, router, smart speaker, doorbell or television in 2026, the security-update deadline is now a specification worth comparing alongside battery life and screen size. The difficulty is that the information is inconsistent. Some manufacturers publish a precise end date; others describe a period in years; others say nothing beyond a vague commitment to “regular updates”. That inconsistency matters, because the end of security support is the point at which a connected device begins to age out of safe use.

What the UK now requires — and what it does not

Since April 2024, the UK’s Product Security and Telecommunications Infrastructure (PSTI) regime has required manufacturers of consumer connectable products to meet baseline security requirements. Among them is an obligation to publish a statement of the minimum period for which the product will receive security updates. The underlying legislation, the PSTI Act 2022, was designed to make the connected home less opaque. In practice, the requirement has improved disclosure without standardising it. A manufacturer may state “five years from date of purchase”, “security updates until 31 December 2031”, or “a minimum of three years from first sale”. Each is compliant in substance; each demands a different calculation from the buyer.

The regime also does not cover every device in the home. Desktop computers, tablets and phones fall outside its scope, although some manufacturers publish support windows for them voluntarily. Nor does it compel a particular length of support. A three-year window and a seven-year window can both satisfy the rules, provided the commitment is clear. The buyer’s task is therefore not to assume that regulation guarantees longevity, but to use the disclosure as a starting point for comparison.

Where the deadline is usually hidden

For phones, the clearest statements tend to appear in the specifications section of a manufacturer’s website, often under “security” or “software support”. Samsung, Google and Apple have become more explicit in recent years, publishing both guaranteed Android or iOS version updates and separate security-patch commitments. Mid-range and budget handsets are more variable: a retailer listing may mention “two major updates” without saying when the security patches stop. That distinction is important. A phone can receive a new interface while still missing critical security fixes, and a phone can receive patches long after its last feature update.

Routers and doorbells present a different problem. These products are often sold through broadband providers or large retailers, and the support statement may sit in a PDF datasheet rather than on the product page. Smart speakers and displays frequently rely on a companion app and a cloud service; the published support period may refer only to the hardware, leaving the cloud service’s lifespan unstated. For televisions, the relevant deadline may apply to the operating system rather than the panel, and manufacturers sometimes distinguish between “software updates” and “security updates” without explaining the difference.

A useful habit is to search the manufacturer’s support site for the exact model number plus “security update period” or “end of support”. If the only result is a marketing page, that absence is itself information.

When silence is the answer

A missing support statement should not be treated as neutral. Under the PSTI regime, manufacturers are expected to publish a minimum period, so a completely absent disclosure is either an oversight or a signal that the product is not intended for long-term connected use. Neither is reassuring. Buyers should be wary of phrases such as “lifetime updates”, which rarely define whose lifetime is meant, and “regular security patches”, which commits to a rhythm but not a duration.

Retailers can help, but they are not obliged to repeat the manufacturer’s statement in full. An online listing that omits the support period may still link to a compliant manufacturer page. The practical approach is to check both, and to keep a record of what was published at the time of purchase. That record has value beyond the immediate decision: if a device stops receiving updates earlier than stated, it becomes evidence in any later conversation about remedies.

What happens when the clock stops

When security support ends, a device does not usually stop working overnight. Instead, it stops receiving fixes for newly discovered vulnerabilities. For a router, that is a serious concern: an unpatched router sits between the home network and the internet. For a doorbell or camera, the risk is unauthorised access to video and audio. For a phone, the risk is more diffuse but still real, particularly where banking apps and identity checks depend on a current operating system.

The secondary effects can arrive sooner than the security ones. Companion apps may be withdrawn from app stores, cloud features may be switched off, and integrations with other platforms may cease. A smart speaker that once controlled heating may become a Bluetooth speaker; a doorbell may lose its remote viewing feature. These are not failures of the hardware so much as the retirement of the service layer that made the hardware useful.

A short checklist for UK buyers

Before paying, establish four things. First, the stated minimum security-update period, in years or as an end date. Second, whether that period applies from purchase, from first sale, or from the model’s launch. Third, whether feature updates and security updates end at the same time. Fourth, whether the product depends on a cloud service whose own lifespan is separate from the hardware commitment. If any of these cannot be answered, treat the product as having an unknown support horizon and price it accordingly.

It is also worth checking the retailer’s returns policy and the manufacturer’s warranty separately. A two-year warranty does not imply two years of security updates, and a five-year update commitment does not imply a five-year warranty. The two clocks run independently.

The expectation is shifting

UK consumer expectations are moving. The PSTI regime has made support periods a legitimate pre-purchase question, and consumer groups have begun to compare them in the same way they compare energy ratings. The Consumer Rights Act 2015 already requires goods to be of satisfactory quality and durable, and the Digital Markets, Competition and Consumers Act 2024 gives regulators stronger tools over misleading commercial practices. Neither creates a universal right to indefinite updates, but together they make it harder to sell a connected device while implying a longevity that the manufacturer has not committed to.

For buyers, the lesson is straightforward. The update clock is now part of the product. A device with a published, credible support window is a different proposition from one that stays silent. Reading the date before purchase is a small habit with a long reach.