Six Product Groups Now Need a Security Test
Under BSMI Announcement No. 11530018140, effective 2 October 2026, Taiwan now requires cybersecurity testing for network-connected cameras, routers, video recorders, displays and TVs, as well as all concealed cameras. A product counts as network-connected if it uses TCP/IP. The announcement also brings three product types into the regulated scope. Concealed cameras without storage must comply immediately, while cameras without storage and tiled video-wall displays follow on 1 July 2028. Manufacturers already holding certificates for affected products have until 30 June 2028 to reissue them against the new standards, or BSMI will revoke them.
Which Products Fall Under the New BSMI Cybersecurity Requirements
The announcement adds a cybersecurity test on top of the existing safety, EMC and RoHS marking checks. Products that are medical devices or telecommunications terminal equipment stay outside the scope, because other laws govern them. For everything else on the list below, the BSMI cybersecurity requirements apply from the announcement date.
Network Cameras and Concealed Cameras Lead the List
Digital video cameras with network connection now need a cybersecurity test, whether or not they store footage. Concealed cameras are covered too, with or without a network connection. BSMI defines a concealed camera as a miniature camera built into an everyday item such as a pen, button, pair of glasses, watch or USB drive, with a lens smaller than 2 cm by 2 cm.
Routers, Gateways and Smart Speakers Join In
Routers, bridges, switches, network hubs and gateways are now in scope. BSMI explicitly includes smart speakers and smart home assistants in this group. USB hubs and KVM switches remain under simple Declaration of Conformity and need no security test.
Video Recorders, Displays and Smart TVs Complete the Picture
On the audio-visual side, network-connected video recorders, displays and TVs must now pass a security standard. Displays and TVs without a network connection keep their current requirements.
Five Standard Routes to Demonstrate Compliance
BSMI does not force one standard on everyone. Manufacturers pick one option from a menu, and the menu depends on the product and on how it connects.
| Option | Standard (edition year) | Cameras and recorders | Routers, displays, TVs |
|---|---|---|---|
| IoT baseline | CNS 16190 (2023) | Yes | Yes |
| Radio equipment security | CNS 18031-1 and -2 (2025) | Wireless only | Wireless only |
| Industrial component security | CNS 62443-4-2 (2022) | Yes | Yes |
| Common Criteria | CNS 15408 parts 1 to 3 (2004) or parts 1 to 5 (2021) | Yes | Yes |
| Video surveillance series | CNS 16120 and CNS 16132 series | Yes | Not offered |
Wireless Products Choose From the Full Menu
A product with wireless connection, or with both wireless and wired, may use any option listed for its product group.
Wired-Only Products Cannot Use CNS 18031
The CNS 18031 route is reserved for products with a wireless interface. A camera that only connects by Ethernet, for example, must choose CNS 16190, CNS 62443-4-2, CNS 15408 or the CNS 16120 series. Cameras use CNS 16120-2 and CNS 16132-2, while video recorders use the -3 parts of the same series.
New Products Added to the Regulated Scope
Three product types are newly regulated, and BSMI already accepts applications for all of them.
| Product | Regulated from |
|---|---|
| Concealed cameras without storage | 2 October 2026 |
| Digital cameras and video cameras without storage | 1 July 2028 |
| Tiled video-wall displays | 1 July 2028 |
Certificates issued before 1 July 2028 start their three-year validity on that date. Concealed cameras must also carry this Chinese warning on the packaging and in the manual: 「嚴禁用於他人非公開活動與身體隱私部位，違者自負刑事與民事責任」. It states that using the device on other people’s private activities or private body parts is prohibited and carries criminal and civil liability.
Stricter Certification Cybersecurity Schemes
| Product group | New scheme | Applies from |
|---|---|---|
| Network-connected cameras, recorders, displays and TVs | TABI, or RPC with a type test plus a quality system or factory inspection module | 2 October 2026 |
| Routers, switches, gateways and smart speakers | TABI, or RPC with a type test plus a quality system or factory inspection module (replaces Declaration of Conformity) | 1 July 2028 |
Non-connected versions keep the lighter Declaration of Conformity to Type module. Router DoCs signed under the old rules become invalid on 1 July 2028. Unsold stock imported before then needs an RPC certificate or a batch inspection pass before it can be sold.
Existing Certificates and Test Reports
Reissue Certificates by 30 June 2028
Holders of certificates for connected cameras, concealed cameras, recorders, displays and TVs must apply for reissue with proof of compliance to a listed standard. The reissued certificate keeps its original expiry date and will show the standard and security level met. Certificates not reissued in time will be revoked.
Reuse Old Reports Through Difference Testing
If an existing IoT or surveillance security report came from a BSMI-recognised lab, that lab can run difference testing against the listed standard and Taiwan’s regional deviations. The updated report is accepted for Type Approval or RPC.
Transition Timeline for BSMI Cybersecurity Requirements
| Date | What happens |
|---|---|
| 2 October 2026 | New standards apply. Concealed cameras without storage are regulated. BSMI accepts applications for all new products. |
| 30 June 2028 | Deadline to reissue existing certificates. Certificates issued under the old rules expire. |
| 1 July 2028 | Old standards and schemes end. Cameras without storage and tiled displays are regulated. Router DoCs become invalid. Import control C02 starts for several HS codes. |
Key Takeaways
- Concealed camera importers have no grace period. Units without storage were regulated on the day the announcement was published. Shipments already in transit may be held at customs without a certificate.
- Router and smart speaker brands face the steepest climb. Moving from a Declaration of Conformity to full certification with a factory or quality system module adds cost, paperwork and time. Start planning type tests and factory readiness in 2027 at the latest.
Source: https://www.bsmi.gov.tw/wSite/public/Data/f1790932691717.pdf