On 4 November 2026 Japan's Ministry of Economy, Trade and Industry (METI) published a news release announcing that Japan-EU cooperation on comparing the JC-STAR scheme with the EU Cyber Resilience Act (CRA) is being stepped up. The release was issued jointly with the Information-technology Promotion Agency, Japan (IPA).
JC-STAR (in Japanese, the "security requirements conformity assessment and labelling scheme") is Japan's scheme for assessing and labelling the security of IoT products. The CRA is the EU law that imposes cybersecurity requirements on products with digital elements.
This page sets out what METI published.
Overview
| Item | Details |
|---|---|
| Date of release | 4 November 2026 |
| Issued by | METI (jointly with IPA) |
| Date of signing | Monday 26 October 2026 |
| Parties | Japan Business Council in Europe (JBCE) and the StandICT.eu secretariat |
| Document signed | Memorandum of understanding on Japan-EU cooperation on cybersecurity regulation and standardisation |
| Framework | CRA-JC-STAR Technical Working Group (TWG) |
| Next steps | METI and IPA, with JBCE, the StandICT.eu secretariat and European experts, to step up comparison and analysis of the two schemes and their security requirements |
What was signed
The release states that on 26 October 2026, in Brussels, Belgium, JBCE, which runs the TWG, and the EU-funded StandICT.eu secretariat signed a memorandum of understanding. The TWG is the framework for a technical comparison of JC-STAR and the CRA. The section of the release on the date of signing states that the signing took place online.
StandICT.eu is a digital technology standards project funded under the EU's Horizon Europe research and innovation framework. The release says the TWG is run by JBCE together with StandICT.eu and Cyberstand.EU.
Under the memorandum, JBCE and StandICT.eu are to:
- Support the comparison of the security requirements of JC-STAR and the CRA and the identification of similarities and differences
- Promote dialogue between European and Japanese experts by hosting meetings
- Support continued exchanges between the two sides
METI and IPA take part in the TWG, and Japanese and EU experts are to compare the two schemes while fully respecting the regulatory autonomy of each jurisdiction. The release says it expects the similarities and differences between the schemes to be clarified, creating an environment in which Japanese companies can respond efficiently to cybersecurity rules in Japan and abroad.
Free Tool Related to This Article
Contract Risk Checker
Try our free simulator related to this topic.
Try for free →Dates for the two schemes given in the release
| Scheme | Date stated in the release |
|---|---|
| METI policy on building a security conformity assessment scheme for IoT products | Published August 2024 |
| JC-STAR (operated by IPA) | In operation since March 2025 |
| Mutual recognition between JC-STAR and the UK PSTI regime | Began January 2026 |
| Mutual recognition between JC-STAR and Singapore's Cybersecurity Labelling Scheme (CLS) | Began June 2026 |
| Entry into force of the CRA (EU) | December 2024 |
| CRA vulnerability and incident reporting obligations | Applying from September 2026 |
| CRA main cybersecurity requirements for products with digital elements | Due to apply from December 2027 |
As background, the release notes that IoT products such as routers, network cameras and sensors have spread rapidly, while cyberattacks exploiting vulnerabilities in IoT products have also increased.
FREE CONSULTATION
Corporate Law: your first 30 minutes are free
- ・Handled by Yusuke Abe, admitted in Japan and New York
- ・Online (Zoom etc.) or at our office in Otemachi, Tokyo
- ・In English or Japanese
Workshops held so far
The release lists the following workshops on comparing and analysing JC-STAR and the CRA.
| Framework | Session | Date and format |
|---|---|---|
| INSTAR | 1st | 10 November 2025 (online) |
| INSTAR | 2nd | 27 January 2026 (Brussels, hybrid) |
| INSTAR | 3rd | 9 June 2026 (online) |
| StandICT.eu | 1st | 14 September 2026 (online) |
The release notes that INSTAR is an EU project on international digital standardisation cooperation, which has since been taken over by StandICT.eu.
Next steps
The release says Japan will continue building a system in which IoT products designed with security in mind from the outset become widespread, and will share information with relevant bodies with a view to cooperation with other countries that have similar schemes. It says this will help Japanese companies deal with international regulatory requirements more smoothly and raise the level of cybersecurity of IoT products worldwide.
METI and IPA also take part in the Global Cyber Labelling Initiative (GCLI), an international forum of countries interested in cybersecurity schemes for IoT products, according to the release.
Sources
- METI, news release on Japan-EU cooperation on comparing JC-STAR and the EU Cyber Resilience Act (4 November 2026, in Japanese) https://www.meti.go.jp/press/2026/11/20261104002.html
- IPA, JC-STAR page (in Japanese) https://www.ipa.go.jp/security/jc-star/index.html
This page is based on what the government published and on the wording of the relevant laws. If you need advice on a specific matter, please consult a lawyer.