Silent Lines, Real Risks: A 90-Day PSTN Migration Blueprint for UK SMEs in 2026
Photo: Adrian S Pye , CC BY-SA 2.0, via Wikimedia Commons
For many UK SMEs, the humble telephone line remains invisible infrastructure. It carries alarm signals, lift emergency calls, card terminal traffic, faxes and legacy voice services. As the public switched telephone network (PSTN) retirement moves closer, each of those dependencies becomes a risk that must be governed, not merely replaced. The task is not simply to order a digital alternative. It is to manage a transition with clear ownership, evidence and contingency. As of late 2026, a 90-day plan is a practical way to bring order to that work.
Why this belongs in the risk register
The PSTN retirement is a known change with unknown local consequences. Lines may appear on a telecoms bill, sit inside a facilities contract or be entirely unlisted. Some may support life-safety systems; others may serve a single fax machine that accounts for a small but regulated process. A governance-led approach assigns a senior owner, documents the estate, assesses business impact and tests the replacement before old services cease. It also links the migration to existing business continuity and supplier management arrangements. Without that discipline, an SME can discover a critical dependency only when it fails.
Days 1-15: Build a line and dependency inventory
Start with evidence. Pull recent telecoms bills, ask finance to identify payments to communications providers, and review provider portals. Do not limit the inventory to numbers used for voice. Walk the premises and include alarm lines, lift lines, payment terminals, fax machines, door entry systems, legacy PDQ devices and out-of-hours services. Record each line's number, location, purpose, business owner, supplier, contract end date, monthly cost and criticality. Mark any line whose purpose cannot be established as an open risk rather than cancelling it prematurely. Speak to facilities, security and retail managers; they often know about dependencies that never reach the IT team.
Days 16-30: Prioritise by consequence, not by cost
Rank each dependency by the consequence of failure. Life-safety systems such as lift emergency communications and fire alarm signalling should sit at the top. Next come revenue-critical services, including card terminals and customer contact lines, followed by regulatory or record-keeping functions and then convenience services. For each item, confirm whether the replacement service is compatible. Alarm signalling may need an IP or cellular path; lifts may require a specialist maintainer; card terminals may depend on stable broadband. Record interim mitigations, such as mobile fallback or a manual payment process, and update the risk register. High-risk items should be escalated to management with a named owner and target date.
Days 31-55: Ask providers the right questions
Provider conversations should be structured. Ask which services are being withdrawn and when; whether the existing number will be preserved; what happens to broadband if a line ceases; whether digital voice depends on mains power or broadband; how alarm and lift systems are supported; what lead times apply to site surveys and number porting; whether early termination charges apply; what service levels and out-of-hours support are included; and who coordinates third-party suppliers. Obtain answers in writing. Avoid assuming that one provider will manage every dependency. Appoint an internal coordinator to maintain the plan and chase outstanding actions.
Days 56-75: Plan downtime and operational continuity
Schedule cutover outside peak periods and notify staff, customers and key suppliers. Test before switchover where possible: call quality, alarm signalling, card transactions, lift emergency calls and any remaining fax requirements. Put fallback arrangements in place, such as mobiles, alternative connectivity or manual payment procedures. Update the business continuity plan and ensure customer-facing messages explain any temporary change. For life-safety systems, confirm the arrangements with the maintaining contractor and keep written evidence.
Days 76-90: Execute, verify and close
Migrate a low-risk line first to test the process, then move high-risk services with the relevant supplier on site or available remotely. Verify each service after cutover and document the new inventory. Train users on digital voice features and update contact lists. Close risk items where evidence supports closure, or record residual risk with an owner and review date. Hold a short post-migration review and schedule 30, 60 and 90-day checks. A 90-day plan does not remove every uncertainty, but it turns a hidden telecoms change into a managed business risk.
