Taiwan / BSMI & NCC
Taiwan's BSMI added a cybersecurity documentation category on 20th May 2026
- BSMI amended its Instruction Guidances for Type Approval on 20th May 2026, with immediate effect — the first restructuring of the technical file in nineteen years.
- Information security is now a fourth documentation category alongside electrical safety, EMC and digital reception, requiring an SBOM, verification certificates for security-relevant chips, and a self-check form.
- BSMI has fixed 1st January 2028 as the compliance deadline for EV charging equipment, power conversion systems, solar PV inverters and stationary lithium energy storage devices.
- Taiwan's NCC runs its own, distinct type-approval regime for wireless and IoT hardware.
Last updated 11th September 2026 · By Vas Parshin and Anabel Amar
What changed on 20th May 2026
BSMI amended its Instruction Guidances for Type Approval of Electrical and Electronic Products on 20th May 2026, with immediate effect -- described as the first restructuring of the technical file in nineteen years. The revision adds a fourth documentation category, information security, alongside the existing electrical safety, electromagnetic compatibility and digital reception function categories that applicants already compile manuals, specifications, photographs and circuit or block diagrams for. The revision also states certificate validity as three years in principle, rather than the flat three years the guidance previously set.
The new information security documentation category
The information security category requires verification certificates or specification sheets for security-relevant components -- active chips, communication chips and communication modules -- along with functional block diagrams, an SBOM (software bill of materials), and a self-check form.
Which products face the 1st January 2028 deadline
BSMI has fixed 1st January 2028 as the date by which EV charging equipment, power conversion systems, solar photovoltaic inverters and stationary lithium energy storage devices must include the new information security documentation in their Type Approval applications. The documentation category itself is part of the technical file structure now, but this specific deadline applies to that named set of energy-related product types -- other electrical and electronic products fall under the same restructured technical file without that fixed date attached yet.
NCC: a separate regime for wireless and IoT devices
BSMI Type Approval covers electrical safety, EMC, digital reception and now information security for electrical and electronic products generally. Taiwan's NCC (National Communications Commission) runs its own, separate type-approval regime for wireless and radio-equipped devices -- Wi-Fi, Bluetooth, cellular and other RF products. Most consumer IoT hardware needs both: a product combining electrical functions with radio functions typically requires a BSMI Type Approval and an NCC certification, run as two distinct applications against two different regulators.
Who this actually lands on
Any electronics or IoT manufacturer exporting electrical or electronic products to Taiwan needs to account for the restructured four-category technical file, and manufacturers of EV charging equipment, power conversion systems, solar PV inverters or stationary lithium energy storage devices specifically need to plan for the 1st January 2028 information-security documentation deadline. Products with radio functionality still need NCC certification on top of BSMI Type Approval. Taiwan joins the other jurisdictions already covered here -- US, EU/UK, Brazil, Mexico, South Korea, Japan, India, Australia, Canada and China -- as an electronics-import market with an active, dated compliance requirement rather than a static baseline.
Questions
What changed with Taiwan's BSMI Type Approval rules in 2026?
BSMI amended its Instruction Guidances for Type Approval of Electrical and Electronic Products on 20th May 2026, with immediate effect -- the first restructuring of the technical file in nineteen years. It adds a fourth documentation category, information security, alongside the existing electrical safety, electromagnetic compatibility and digital reception function categories. The revision also states certificate validity as three years in principle, rather than the flat three years the guidance previously set.
What does the new information security documentation category require?
The information security category requires verification certificates or specification sheets for security-relevant components -- active chips, communication chips and communication modules -- along with functional block diagrams, an SBOM (software bill of materials), and a self-check form.
Which products have to comply by 1st January 2028?
BSMI has fixed 1st January 2028 as the date by which EV charging equipment, power conversion systems, solar photovoltaic inverters and stationary lithium energy storage devices must include the new information security documentation in their Type Approval applications. The category applies to the technical file structure now, but this deadline is specific to that named set of energy-related product types.
Is this the same as NCC certification for wireless and IoT devices?
No. BSMI Type Approval covers electrical safety, EMC, digital reception and now information security for electrical and electronic products generally. NCC (National Communications Commission) runs a separate type-approval regime for wireless and radio-equipped devices -- Wi-Fi, Bluetooth, cellular and other RF products -- which most consumer IoT hardware also needs alongside BSMI. A product with both electrical and radio functions typically needs both approvals, run as two separate applications.
Where we fit
Adding Taiwan to a market-access review means mapping a product's technical file against BSMI's restructured four-category structure, confirming whether the 1st January 2028 information-security deadline applies to it, and checking separately whether its radio functionality also needs NCC certification. We fold Taiwan's BSMI and NCC requirements into the same market-access review we run for the US, EU/UK and the other jurisdictions we cover, so it is one process per product, not a separate one to track per country.
Contact us