In-force UK statute; commenced 1 October 2022; codifies Telecoms Security Requirements; enforced by Ofcom with penalties up to 10% turnover or £100k per day; Tier 1 deadline 31 March 2024; Tier 2 31 March 2025; full Code 31 March 2028.