Taiwan Expands BSMI Cybersecurity Requirements to Cameras, Routers, Displays and Smart TVs

Six Product Groups Now Need a Security Test

Under BSMI Announcement No. 11530018140, effective 2 October 2026, Taiwan now requires cybersecurity testing for network-connected cameras, routers, video recorders, displays and TVs, as well as all concealed cameras. A product counts as network-connected if it uses TCP/IP. The announcement also brings three product types into the regulated scope. Concealed cameras without storage must comply immediately, while cameras without storage and tiled video-wall displays follow on 1 July 2028. Manufacturers already holding certificates for affected products have until 30 June 2028 to reissue them against the new standards, or BSMI will revoke them.

Which Products Fall Under the New BSMI Cybersecurity Requirements

The announcement adds a cybersecurity test on top of the existing safety, EMC and RoHS marking checks. Products that are medical devices or telecommunications terminal equipment stay outside the scope, because other laws govern them. For everything else on the list below, the BSMI cybersecurity requirements apply from the announcement date.

Network Cameras and Concealed Cameras Lead the List

Digital video cameras with network connection now need a cybersecurity test, whether or not they store footage. Concealed cameras are covered too, with or without a network connection. BSMI defines a concealed camera as a miniature camera built into an everyday item such as a pen, button, pair of glasses, watch or USB drive, with a lens smaller than 2 cm by 2 cm.

Routers, Gateways and Smart Speakers Join In

Routers, bridges, switches, network hubs and gateways are now in scope. BSMI explicitly includes smart speakers and smart home assistants in this group. USB hubs and KVM switches remain under simple Declaration of Conformity and need no security test.

Video Recorders, Displays and Smart TVs Complete the Picture

On the audio-visual side, network-connected video recorders, displays and TVs must now pass a security standard. Displays and TVs without a network connection keep their current requirements.

Five Standard Routes to Demonstrate Compliance

BSMI does not force one standard on everyone. Manufacturers pick one option from a menu, and the menu depends on the product and on how it connects.

Wireless Products Choose From the Full Menu

A product with wireless connection, or with both wireless and wired, may use any option listed for its product group.

Wired-Only Products Cannot Use CNS 18031

The CNS 18031 route is reserved for products with a wireless interface. A camera that only connects by Ethernet, for example, must choose CNS 16190, CNS 62443-4-2, CNS 15408 or the CNS 16120 series. Cameras use CNS 16120-2 and CNS 16132-2, while video recorders use the -3 parts of the same series.

New Products Added to the Regulated Scope

Three product types are newly regulated, and BSMI already accepts applications for all of them.

Certificates issued before 1 July 2028 start their three-year validity on that date. Concealed cameras must also carry this Chinese warning on the packaging and in the manual: 「嚴禁用於他人非公開活動與身體隱私部位，違者自負刑事與民事責任」. It states that using the device on other people’s private activities or private body parts is prohibited and carries criminal and civil liability.

Stricter Certification Cybersecurity Schemes

Non-connected versions keep the lighter Declaration of Conformity to Type module. Router DoCs signed under the old rules become invalid on 1 July 2028. Unsold stock imported before then needs an RPC certificate or a batch inspection pass before it can be sold.

Existing Certificates and Test Reports

Reissue Certificates by 30 June 2028

Holders of certificates for connected cameras, concealed cameras, recorders, displays and TVs must apply for reissue with proof of compliance to a listed standard. The reissued certificate keeps its original expiry date and will show the standard and security level met. Certificates not reissued in time will be revoked.

Reuse Old Reports Through Difference Testing

If an existing IoT or surveillance security report came from a BSMI-recognised lab, that lab can run difference testing against the listed standard and Taiwan’s regional deviations. The updated report is accepted for Type Approval or RPC.

Transition Timeline for BSMI Cybersecurity Requirements

Key Takeaways

• Concealed camera importers have no grace period. Units without storage were regulated on the day the announcement was published. Shipments already in transit may be held at customs without a certificate.
• Router and smart speaker brands face the steepest climb. Moving from a Declaration of Conformity to full certification with a factory or quality system module adds cost, paperwork and time. Start planning type tests and factory readiness in 2027 at the latest.

Source: https://www.bsmi.gov.tw/wSite/public/Data/f1790932691717.pdf