Taiwan / BSMI & NCC
BSMI amended its Instruction Guidances for Type Approval of Electrical and Electronic Products on 20 May 2026, with immediate effect -- the first restructuring of the technical file in nineteen years. It adds information security as a fourth documentation category alongside electrical safety, EMC and digital reception, requiring an SBOM, verification certificates for security-relevant chips, and a self-check form. BSMI has fixed 1 January 2028 as the compliance deadline for EV charging equipment, power conversion systems, solar PV inverters and stationary lithium energy storage devices. Taiwan's NCC, meanwhile, runs its own, distinct type-approval regime for wireless and IoT hardware.
Last updated 11 September 2026
BSMI amended its Instruction Guidances for Type Approval of Electrical and Electronic Products on 20 May 2026, with immediate effect -- described as the first restructuring of the technical file in nineteen years. The revision adds a fourth documentation category, information security, alongside the existing electrical safety, electromagnetic compatibility and digital reception function categories that applicants already compile manuals, specifications, photographs and circuit or block diagrams for. The revision also states certificate validity as three years in principle, rather than the flat three years the guidance previously set.
Source: The One Lab, "BSMI Type Approval: Revised Guidances for Electrical and Electronic Products"; GMA Labs, "Taiwan BSMI Type Approval Update: New Cybersecurity Files".
The information security category requires verification certificates or specification sheets for security-relevant components -- active chips, communication chips and communication modules -- along with functional block diagrams, an SBOM (software bill of materials), and a self-check form.
Source: GMA Labs, "Taiwan BSMI Type Approval Update: New Cybersecurity Files".
BSMI has fixed 1 January 2028 as the date by which EV charging equipment, power conversion systems, solar photovoltaic inverters and stationary lithium energy storage devices must include the new information security documentation in their Type Approval applications. The documentation category itself is part of the technical file structure now, but this specific deadline applies to that named set of energy-related product types -- other electrical and electronic products fall under the same restructured technical file without that fixed date attached yet.
BSMI Type Approval covers electrical safety, EMC, digital reception and now information security for electrical and electronic products generally. Taiwan's NCC (National Communications Commission) runs its own, separate type-approval regime for wireless and radio-equipped devices -- Wi-Fi, Bluetooth, cellular and other RF products. Most consumer IoT hardware needs both: a product combining electrical functions with radio functions typically requires a BSMI Type Approval and an NCC certification, run as two distinct applications against two different regulators. NCC's own Annex 7 Declaration Form was revised as part of its May 2025 update, adding a mandatory cybersecurity disclaimer and device-specific declarations covering labeling, software and documentation.
Source: MiCOM Labs, "Taiwan Type Approval: Guide for 2026".
Any electronics or IoT manufacturer exporting electrical or electronic products to Taiwan needs to account for the restructured four-category technical file, and manufacturers of EV charging equipment, power conversion systems, solar PV inverters or stationary lithium energy storage devices specifically need to plan for the 1 January 2028 information-security documentation deadline. Products with radio functionality still need NCC certification on top of BSMI Type Approval. Taiwan joins the other jurisdictions already covered here -- US, EU/UK, Brazil, Mexico, South Korea, Japan, India, Australia, Canada and China -- as an electronics-import market with an active, dated compliance requirement rather than a static baseline.
BSMI amended its Instruction Guidances for Type Approval of Electrical and Electronic Products on 20 May 2026, with immediate effect -- the first restructuring of the technical file in nineteen years. It adds a fourth documentation category, information security, alongside the existing electrical safety, electromagnetic compatibility and digital reception function categories. The revision also states certificate validity as three years in principle, rather than the flat three years the guidance previously set.
The information security category requires verification certificates or specification sheets for security-relevant components -- active chips, communication chips and communication modules -- along with functional block diagrams, an SBOM (software bill of materials), and a self-check form.
BSMI has fixed 1 January 2028 as the date by which EV charging equipment, power conversion systems, solar photovoltaic inverters and stationary lithium energy storage devices must include the new information security documentation in their Type Approval applications. The category applies to the technical file structure now, but this deadline is specific to that named set of energy-related product types.
No. BSMI Type Approval covers electrical safety, EMC, digital reception and now information security for electrical and electronic products generally. NCC (National Communications Commission) runs a separate type-approval regime for wireless and radio-equipped devices -- Wi-Fi, Bluetooth, cellular and other RF products -- which most consumer IoT hardware also needs alongside BSMI. A product with both electrical and radio functions typically needs both approvals, run as two separate applications.
Adding Taiwan to a market-access review means mapping a product's technical file against BSMI's restructured four-category structure, confirming whether the 1 January 2028 information-security deadline applies to it, and checking separately whether its radio functionality also needs NCC certification. We fold Taiwan's BSMI and NCC requirements into the same market-access review we run for the US, EU/UK and the other jurisdictions we cover, so it is one process per product, not a separate one to track per country.
Book a scoping call