Japan is strengthening the cybersecurity requirements for internet-connected terminal equipment. On 24 September 2026, Japan’s Ministry of Internal Affairs and Communications (MIC) promulgated Notification No. 346 of 2026, together with Ordinance No. 111 of 2026, amending the Terminal Equipment Regulations (Ministerial Ordinance No. 31 of 1985). The new requirements take effect on 1 April 2027.
The update revises the technical conditions (Article 34-10) that apply to IP-connected terminal equipment, adding mandatory software-update and interface-security measures for devices whose communication settings can be changed remotely over a network.
Background
Japan has regulated IoT terminal security since April 2020, when Article 34-10 of the Terminal Equipment Regulations introduced requirements such as access control, a forced change of default credentials, and firmware-update capability for directly connected terminal equipment. Notification No. 346 builds on that framework, adding and clarifying detailed technical conditions and expressly bringing terminal equipment with an internet-connection function within scope.
Which Devices Are Affected
The security requirements apply to IP telecommunications terminal equipment that can remotely change its communication settings over the network — in practice, routers and other IP-connected terminal devices that connect to carrier networks. These are devices that use IP and allow external network access to modify the equipment’s communication settings.
What the New Rules Require
From 1 April 2027, affected equipment must provide software-update and interface-security measures, including:
- A software update function — the ability to update the software that controls the device’s telecommunications functions, with mechanisms to verify that the latest software version is installed and to confirm software integrity before an update is executed.
- Interface and port management — specific security measures (or equivalent measures) for device interfaces, including managing or disabling unused physical or logical interfaces and non-essential ports.
- Stronger credential requirements — prohibiting easily guessable identification codes (weak or default credentials), reinforcing the existing credential-security obligations.
These measures supplement, rather than replace, the existing access-control and credential requirements already in force under Article 34-10.
Why This Matters
For manufacturers and importers of terminal equipment for the Japanese market, security is increasingly an access prerequisite alongside radio and telecom performance. Because the new conditions apply to new certifications from 1 April 2027, and because they involve device-level capabilities (update mechanisms, integrity verification, interface controls) that may need to be designed in, this is a change best addressed well ahead of the deadline rather than at the certification stage.
Registered Certification Bodies such as TELEC and JATE will assess conformity against the amended conditions, so manufacturers should confirm their products and documentation meet the new requirements in good time.
What Manufacturers Should Do Now
Businesses placing IP-connected terminal equipment on the Japanese market should:
- Identify which products are IP terminal equipment that connect to carrier networks and allow remote changes to communication settings.
- Review device software-update mechanisms, including integrity and version-verification capabilities, against the new requirements.
- Assess interface and port configurations and default-credential handling.
- Prepare technical documentation and plan certification to meet the amended conditions ahead of the 1 April 2027 implementation date.
To read the official documentation (Japanese only), refer to MIC Notification No. 346 of 2026 and the amended Terminal Equipment Regulations, available on MIC’s telecommunications portal.
How C-PRAV Can Support You
C-PRAV helps manufacturers and importers achieve global market access for radio, wireless, and telecom products, including certification for the Japanese market. Our cybersecurity and telecom specialists can assess your IP-connected terminal equipment against the updated MIC security requirements, evaluate your software-update and interface-security measures, and prepare and coordinate the technical documentation needed for conformity ahead of the 1 April 2027 deadline.
Have questions? We’re here to help.