An importer of a relevant connectable product must maintain a record of—
any investigations carried out by the importer (whether or not as a result of information received as mentioned in section 17(1)(a)) in relation to a compliance failure, or suspected compliance failure, by—
the importer, or
a manufacturer of the product;
any investigations of which the importer is aware that have been carried out by a manufacturer of the product in relation to a compliance failure, or suspected compliance failure, by the manufacturer.
A record of an investigation must contain the following information—
the outcome of the investigation;
where it was determined that there was a compliance failure, details of that compliance failure;
any steps taken by the importer or the manufacturer (as the case may be) to remedy the compliance failure and whether or not those steps were successful.
An importer is not to be regarded as having failed to comply with the duty imposed by subsection (1)(b) to maintain a record of an investigation carried out by a manufacturer if—
the record of the investigation does not contain all of the information required by subsection (2),
the missing information may only be obtained from the manufacturer, and
the importer has taken reasonable steps to obtain that information from the manufacturer.
A record of an investigation must be retained for a period of 10 years beginning with the day on which the record is made.
In this section "compliance failure", in relation to a product, means a failure to comply with a relevant security requirement relating to the product.