Taiwan BSMI Cybersecurity: Mandatory for AV & Network IoT
Taiwan BSMI Cybersecurity Testing Becomes Mandatory for Network Cameras, Recorders, Displays, TVs and Routers
On 2 October 2026, Taiwan's Ministry of Economic Affairs, through the Bureau of Standards, Metrology and Inspection (BSMI), published Announcement No. 11530018140, finalizing amendments to the mandatory inspection rules for selected information technology and audio-visual products. The amendment adds a cybersecurity test to the existing safety (CNS 15598-1), EMC (CNS 15936) and RoHS marking (CNS 15663) requirements for network-connected devices, upgrades the conformity assessment schemes for several product groups, and brings new product types into the regulated scope.
The rules took effect on the date of announcement, with a transition period that closes on 30 June 2028. From 1 July 2028, legacy standards and schemes cease to apply.
At a Glance
Topic | Summary |
Products affected | Network-connected digital video cameras, concealed cameras, video recorders, displays (including tiled video walls), televisions, routers, bridges, switches, network hubs and gateways (including smart speakers and smart home assistants) |
What is new | Mandatory cybersecurity testing against one of five accepted CNS standard routes |
"Network-connected" | Any product that connects to a network using the Internet Protocol (TCP/IP) |
Excluded | Medical devices (Medical Devices Act), telecommunications terminal equipment (Telecommunications Management Act), and products holding a vehicle safety inspection report issued under the Ministry of Transportation |
Reissue deadline | 30 June 2028 for existing certificates of affected products |
End of legacy rules | 1 July 2028 |
Background: From Draft to Final Rule
BSMI first presented the plan at a public briefing in July 2025, framing it as part of Taiwan's alignment with international IoT security trends, including the EU and UK approaches to connected-product security. A formal draft was pre-announced on 28 October 2025 (No. 11430016840), originally targeting 1 January 2028 for full implementation.
The final announcement of 2 October 2026 keeps the overall structure of the draft but moves the end of the transition to 1 July 2028, giving industry roughly 21 months to adapt certificates, test reports and production controls.
Products Covered by the Taiwan BSMI Cybersecurity Requirements
The amendment distinguishes between connected and non-connected versions of the same product. Only network-connected versions (and all concealed cameras, regardless of connectivity) require the new cybersecurity test.
Product | Cybersecurity test required? | Status |
Digital cameras and non-connected digital video cameras | No | Already regulated; versions without storage newly regulated from 1 July 2028 |
Network-connected digital video cameras (with or without storage) | Yes | Versions with storage already regulated; versions without storage newly regulated from 1 July 2028 |
Concealed cameras (with or without network connection, with or without storage) | Yes | Versions without storage regulated immediately from 2 October 2026 |
Routers, bridges, switches, network hubs, gateways (incl. smart speakers and smart home assistants) | Yes | Moves from Declaration of Conformity to certification from 1 July 2028 |
Other ADP units (incl. USB hubs and KVM switches) | No | Remain under Declaration of Conformity |
Video players and non-connected video recorders | No | Unchanged |
Network-connected video recorders | Yes | Already regulated; new standard applies |
Displays, non-connected (incl. tiled displays) | No | Tiled displays newly regulated from 1 July 2028 |
Network-connected displays (incl. tiled displays) | Yes | Tiled displays newly regulated from 1 July 2028 |
Televisions, non-connected | No | Unchanged |
Network-connected televisions | Yes | Already regulated; new standard applies |
Concealed camera definition. BSMI defines a concealed camera as a miniature camera (or module) built into, or designed to be built into, an everyday or electrical item such as a pen, button, pair of glasses, watch or USB flash drive, with a lens smaller than 2 cm × 2 cm. These products must also display a prominent Chinese-language warning on the packaging and in the user manual, stating that use on other people's non-public activities or private body parts is strictly prohibited and that violators bear criminal and civil liability.
Accepted Taiwan BSMI Cybersecurity Standards
Manufacturers select one standard route. Available routes depend on the product group and on whether the product has a wireless interface. The CNS 18031 route is only available for products with wireless (or wireless plus wired) connectivity.
Standard route | Cameras and concealed cameras | Video recorders | Routers, gateways, displays, TVs |
Video surveillance series: CNS 16120-1 (2022) + CNS 16132-1 (2022), with Part 2 for cameras / Part 3 for recorders | ✔ | ✔ | — |
IoT baseline: CNS 16190 (2023) | ✔ | ✔ | ✔ |
Radio equipment security: CNS 18031-1 and CNS 18031-2 (2025) | Wireless only | Wireless only | Wireless only |
Industrial component security: CNS 62443-4-2 (2022) | ✔ | ✔ | ✔ |
Common Criteria: CNS 15408 Parts 1–3 (2004) or Parts 1–5 (2021) | ✔ | ✔ | ✔ |
Certification Impact Summary
Product group | Previous scheme | New scheme | Applies from |
Network-connected cameras, concealed cameras, video recorders, displays and TVs | Type Approval Batch Inspection (TABI), or Registration of Product Certification (RPC) with type test + declaration of conformity to type | TABI, or RPC with type test plus full quality management system, production process quality management system, or factory inspection module | 2 October 2026 (legacy scheme ends 1 July 2028) |
Routers, bridges, switches, hubs, gateways, smart speakers | Declaration of Conformity (DoC) | TABI, or RPC with type test plus full QMS, production QMS or factory inspection module | 1 July 2028 |
Newly regulated: concealed cameras without storage | Not regulated | TABI or RPC (as above) | 2 October 2026 |
Newly regulated: cameras without storage, tiled displays | Not regulated | TABI or RPC (per connected / non-connected status) | 1 July 2028 |
Non-connected versions of the listed products | TABI or RPC (type test + conformity to type) | Unchanged | — |
Additional certification rules
Certificate reissue: holders of existing certificates for connected cameras, concealed cameras, recorders, displays and TVs must apply for reissue with evidence of compliance with a listed standard by 30 June 2028. The reissued certificate keeps its original expiry date and will record the standard and information-security level met.
Revocation: certificates not reissued in time will be revoked under Article 42(9) of the Commodity Inspection Act or Article 16(1) of the Type Approval Regulations. A revoked RPC holder may reapply using the original type test report as a conformity document.
Applications under old rules: new certificates or extensions granted under the old standards before 30 June 2028 are valid only until 30 June 2028.
New-rule certificates: certificates issued under the new requirements are valid for three years from issue. For newly regulated products and routers, certificates issued before 30 June 2028 start their three-year validity on 1 July 2028.
Router DoCs: DoCs signed under the old rules lose validity on 1 July 2028. Units imported before that date but not yet placed on the market must obtain an RPC certificate or pass batch inspection before sale.
Existing test reports: reports already issued against national, government-announced surveillance or IoT security standards by a BSMI-designated laboratory can be updated through difference testing (including Taiwan regional deviations) at the original lab and used for TABI or RPC applications.
Import controls: concealed cameras are subject to import control code C02 now; selected camera HS codes (8525.xx.10 series) and routers (8517.62.00.90.6B) move to C02 from 1 July 2028.
Review time: BSMI reviews RPC or Type Approval applications within 14 working days, plus 7 working days when sample testing is required.
What This Means for Manufacturers
Cybersecurity becomes a market access gate, not an option. For connected AV and network products, a valid safety and EMC report is no longer enough to sell in Taiwan. Products must demonstrate compliance with a recognized security standard, and the certificate itself will display the security level achieved.
Network equipment faces the biggest change. Routers, switches, gateways and smart speakers move from self-declaration to third-party certification with a quality system or factory inspection module. This brings new costs, factory audit preparation, and longer lead times, and existing DoCs will simply stop being valid on 1 July 2028.
Concealed camera importers have no transition. Concealed cameras without storage became regulated on announcement day. Shipments without certification and the mandatory warning label risk being held at customs.
Global security work can be reused. Because the accepted routes align with ETSI EN 303 645, EN 18031, IEC 62443-4-2 and Common Criteria, manufacturers already preparing for the EU Cyber Resilience Act or RED delegated act requirements can build a single evidence base and close Taiwan-specific gaps through difference testing.
Connectivity design drives the testing route. Wired-only products cannot use CNS 18031, so product teams should confirm the final interface configuration before choosing a standard and a laboratory.
Taiwan BSMI Cybersecurity Timeline and Required Actions
Implementation timeline
Date | Milestone |
23 July 2025 | BSMI public briefing on the draft amendment |
28 October 2025 | Draft amendment pre-announced (No. 11430016840) |
2 October 2026 | Final announcement (No. 11530018140) in force. New standards and schemes apply to connected cameras, concealed cameras, recorders, displays and TVs. Concealed cameras without storage regulated. BSMI begins accepting applications for routers and all newly listed products |
30 June 2028 | Deadline to reissue existing certificates. Old-rule certificates and extensions expire. Last day router DoCs remain valid |
1 July 2028 | Legacy standards and schemes end. Cameras without storage and tiled displays regulated. Routers, gateways and smart speakers require TABI or RPC certification. C02 import control extended to additional HS codes |
Required actions
Map your portfolio. Identify every product sold in Taiwan that falls into the listed categories and confirm whether it uses TCP/IP connectivity, wireless interfaces and internal storage.
Select a standard route. Choose the CNS standard best aligned with your existing security evidence (CNS 16190, CNS 18031, CNS 62443-4-2, CNS 15408 or the CNS 16120/16132 series).
Run a gap assessment. Review existing ETSI EN 303 645, EN 18031, IEC 62443 or surveillance security reports and ask a BSMI-designated laboratory whether difference testing is possible.
Prepare quality system evidence. For RPC, decide between the full QMS, production QMS or factory inspection module and prepare the factory or certificate documentation accordingly.
Reissue existing certificates. Submit reissue applications for connected cameras, concealed cameras, recorders, displays and TVs well before 30 June 2028 to avoid revocation.
Replace router and gateway DoCs. Plan type testing and factory readiness during 2027 so certificates are in hand before 1 July 2028, and review inventory imported under DoC.
Update labeling. Confirm the RoHS "contains" declaration and commodity inspection mark, and add the mandatory warning for concealed cameras on packaging and manuals.
Brief importers and distributors. Communicate the new C02 import controls and deadlines to local agents and importers of record to prevent customs delays.
Conclusion
Taiwan's final amendment marks a decisive shift: cybersecurity is now part of the mandatory certification baseline for connected consumer AV and network devices. With the 30 June 2028 reissue deadline and the 1 July 2028 switch-over fixed, manufacturers should start standard selection, gap analysis and quality-system preparation now, especially for network equipment moving from self-declaration to full certification.
