Global Alliance Register
GAR TIC Red Bulletin
The October 2026 edition reviews consequential regulatory, standards, market-access and TIC developments from September 2026.
Executive brief
Six developments requiring management attention
The month’s message is implementation: reporting deadlines, management-system transition, emissions evidence and product documentation need defined responsibilities and auditable records.
Reporting basis: This bulletin covers developments announced, adopted, published or entering application between 1 and 30 September 2026. Later dates identify preparation or transition milestones. Published standards, guidance, adopted acts and draft projects are distinguished by status.
When action is needed: Share your assessment requirements with Global Alliance Register to clarify applicability, evidence gaps and the appropriate testing, inspection, certification or conformity-assessment route.
CRA reporting clocks are running
Manufacturers of covered digital products must operate 24/72-hour reporting workflows following the start of CRA reporting on 11 September.
ISO 9001:2026 is published
The 16 September publication opens a defined transition, with existing certified organizations required to complete it by 30 September 2029.
Carbon-neutrality claims need a clear hierarchy
ISO 14068:2026 prioritizes emissions reductions and enhanced removals before offsetting the remaining carbon footprint.
CBAM assurance infrastructure moves into practice
Verifier accreditation and Registry registration are progressing; businesses need verification-ready 2026 records before the first declaration in 2027.
Food loss and waste gains a management-system framework
ISO 20001:2026 provides a measurable system for prevention and minimization of food loss and waste across the supply chain.
Device classification and export controls need attention
The updated IVD classification guidance is available. The EU dual-use update is adopted but awaits scrutiny and Official Journal publication.
Priority developments
Verified changes and practical implications
The following developments carry the clearest near-term implications for testing, inspection, certification, conformity assessment and market access.
Manufacturers must be ready to report exploited vulnerabilities and severe security incidents.
From 11 September 2026, manufacturers covered by the EU Cyber Resilience Act must report actively exploited vulnerabilities and severe incidents affecting the security of products with digital elements. Reporting is made through the CRA Single Reporting Platform.
Final reports: for actively exploited vulnerabilities, no later than 14 days after a corrective or mitigating measure becomes available. For severe incidents, generally within one month after the 72-hour notification. Notifications must be made without undue delay and within the applicable maximum time limit.
Why it matters for customers
Who is affected: manufacturers of connected equipment, industrial control products, IoT devices, software-enabled machinery, communications products, digital components and other covered products placed on the EU market. Product-specific exclusions and the organization’s supply-chain role must be assessed.
Why it matters: product engineering, regulatory compliance, cybersecurity, legal, incident-response and market-access teams need a coordinated process capable of meeting the clock from the moment the manufacturer becomes aware.
Practical action
- Confirm product scope and establish CRA escalation criteria.
- Assign responsibility for the Single Reporting Platform and integrate vulnerability monitoring with regulatory reporting.
- Test the 24/72-hour workflow across product, security and compliance functions.
- Ensure suppliers can rapidly provide technical evidence for incidents involving third-party components.
The Commission’s implementation guidance also addresses remote data-processing solutions, substantial modification, support periods, risk assessment and free/open-source software.
Primary sources: European Commission — CRA reporting obligations · EU Cyber Resilience Act — Regulation (EU) 2024/2847 · European Commission — CRA implementation guidance
ISO 9001:2026 — transition begins
ISO published the sixth edition of ISO 9001, Quality management systems — Requirements, on 16 September 2026. It replaces ISO 9001:2015 and retains the familiar Harmonized Structure.
Why it matters for customers
The revision reinforces leadership, quality culture and ethical behaviour; quality-policy alignment with strategic direction; the distinction between risks and opportunities; personnel awareness; and explanatory guidance in Annex A.
Transition milestones:- 31 March 2027: accreditation bodies ready to assess the new edition.
- 30 June 2027: accredited certification bodies submit transition declarations and supporting information.
- 30 September 2027: accreditation-body transition decisions completed.
- 31 March 2028: new and initial accredited certifications issued only to ISO 9001:2026.
- 30 September 2029: existing certified organizations complete transition.
Practical action
Conduct a clause-by-clause gap analysis, review leadership and quality-culture evidence, and agree transition activities with the certification body. Build updates into surveillance or recertification planning rather than waiting for the final year.
Primary sources: ISO — ISO 9001:2026 · ISO — Publication announcement, 16 September 2026 · ISO/TC 176 — ISO 9001:2026 transition milestones
ISO 14068:2026 — carbon-neutrality framework
Published in September, ISO 14068:2026, Climate change management — Carbon neutrality, replaces ISO 14068-1:2023. It covers claims for organizations and products, including goods, services, buildings and events.
Why it matters for customers
Its hierarchy prioritizes direct and indirect greenhouse-gas reductions and enhanced removals within the value chain. Offsetting addresses the remaining footprint after those actions. It is a reference for carbon neutrality; it does not establish net-zero requirements.
Who is affected: businesses making carbon-neutrality claims, manufacturers, infrastructure and property operators, event organizers, sustainability teams and supply-chain organizations.
Practical action
Review inventories, boundaries, reduction pathways, removals, offsets and claim evidence against the new edition. Declarations relying primarily on offset purchases deserve particular scrutiny.
Primary sources: ISO — ISO 14068:2026 carbon neutrality
CBAM verification moves into operation
EU national accreditation bodies accredit independent CBAM verifiers. Non-EU installation operators calculate embedded emissions; verifiers examine monitoring methods, calculations and supporting records. Importers can use verified actual emissions or applicable default values.
Why it matters for customers
Verifier Registry registration is permitted from 1 September 2026 and must be requested within two months of accreditation. The Commission’s current accreditation status update is dated 29 September. First verification reports are expected through the Registry from January 2027.
The first annual declaration and corresponding certificate surrender for 2026 imports are due 30 September 2027. Affected supply chains include iron and steel, aluminium, cement, fertilizers, hydrogen and electricity; the applicable scope and exemptions must be checked.
Practical action
Build traceable monitoring procedures, emission-factor controls, production records and retained source data now. Importers should decide where verified actual emissions will be used and confirm suppliers can support verification.
Primary sources: European Commission — CBAM verification and accreditation · European Commission — CBAM implementation updates · EU — CBAM amendment, Regulation (EU) 2025/2083
ISO 20001:2026 — food loss and waste
ISO published ISO 20001:2026 on 29 September. The management-system standard supports prevention and minimization of food loss and waste throughout the supply chain.
Why it matters for customers
It provides a structure for measuring, monitoring, documenting and reporting losses, managing improvement and collaborating with stakeholders. Its scope includes farms, processors, packers, logistics providers, distributors, retailers and food-service businesses of different sizes.
Why it matters: commitments to reduce food waste need measurable baselines, defensible data and documented operational controls.
Practical action
Map material loss and waste points, define measurement boundaries and baselines, assess data quality and consider integration with existing food-safety, environmental or sustainability systems.
Primary sources: ISO — ISO 20001:2026 food loss and waste
IVD classification — MDCG 2020-16 Rev.5
On 9 September 2026, the European Commission published Revision 5 of the guidance on classification rules for in-vitro diagnostic medical devices under Regulation (EU) 2017/746.
Why it matters for customers
Classification determines the conformity-assessment pathway and the level of notified-body involvement. The update is guidance supporting interpretation of the IVDR.
Who is affected: IVD manufacturers, authorized representatives, importers, distributors, laboratories and conformity-assessment support organizations.
Practical action
Review classification rationales against Revision 5, particularly where interpretation is required. Trace any changed assumptions through technical documentation, conformity-assessment plans and notified-body arrangements.
Primary sources: European Commission — MDCG 2020-16 Rev.5
EU dual-use control list — annual update
On 14 September 2026, the Commission adopted the delegated act updating Annex I of Regulation (EU) 2021/821. It incorporates multilateral export-control decisions and agreed uniform controls.
Why it matters for customers
Affected technologies include semiconductor manufacturing and testing equipment, advanced computing, specialized materials and certain aerospace and industrial technologies.
Status: adoption is followed by the usual two-month Council/Parliament scrutiny period and Official Journal publication. The September announcement should not be treated as evidence that the revised list already applies.
Practical action
Rescreen specifications and classifications against the adopted changes, identify potential licence impacts, and monitor Official Journal publication and entry into force before applying the new legal list.
Primary sources: European Commission — 2026 dual-use control list update
Sector impact radar
Sector impact radar
The selected September developments are assessed across GAR’s 16 market segments. These sector implications and recommended actions apply the cited developments to relevant operations; they do not imply a new sector-specific rule in every industry.
Aerospace
The adopted EU dual-use update is relevant to advanced electronics, specialized materials and certain aerospace technologies. Connected ground equipment and separately marketed digital components may also raise CRA questions. Product-specific legislation and exclusions need to be assessed.
- Rescreen controlled technical parameters and technology transfers against the adopted dual-use changes.
- Confirm whether each digital product is in CRA scope before assigning reporting responsibilities.
- Preserve supplier, test and configuration records supporting technical and export-control decisions.
Primary sources: European Commission — 2026 dual-use control list update · European Commission — CRA reporting obligations
↑ Back to industry indexAgriculture & Food
ISO 20001:2026 introduces a structured approach to preventing and minimizing food loss and waste across agricultural production, processing, distribution and food service. Carbon-neutrality claims also need transparent evidence and a credible reduction pathway.
- Map significant food-loss and waste points and establish measurement boundaries and baselines.
- Assign controls, data ownership and improvement targets across suppliers and logistics partners.
- Review carbon-neutrality claims against ISO 14068:2026 and integrate records with existing management systems.
Primary sources: ISO — ISO 20001:2026 food loss and waste · ISO — ISO 14068:2026 carbon neutrality
↑ Back to industry indexAutomotive
ISO 17748-3:2026 addresses data exchange for EV-based demand-response charging services. It has practical implications for the interfaces between vehicles, charging infrastructure, mobile devices and smart-city platforms. CRA coverage must be determined for each relevant product rather than assumed for every vehicle system.
- Review EV charging interface specifications and demand-response data-processing requirements.
- Clarify cybersecurity escalation and supplier evidence requirements for covered digital components.
- Keep software versions, integration tests and change-control records traceable.
Primary sources: ISO — ISO 17748-3:2026 EV demand-response data exchange · European Commission — CRA reporting obligations
↑ Back to industry indexConstruction & Infrastructure
ISO 9001:2026 transition planning is relevant to contractors, engineering organizations and infrastructure supply chains. ISO 14068:2026 covers carbon-neutrality claims for buildings and other products; connected building equipment may require a CRA scope assessment.
- Include leadership, quality culture and risk/opportunity updates in project quality-system reviews.
- Define boundaries and evidence supporting building or project carbon-neutrality claims.
- Connect supplier declarations, inspection and test records, commissioning results and digital-product compliance evidence.
Primary sources: ISO — ISO 9001:2026 · ISO — ISO 14068:2026 carbon neutrality · European Commission — CRA reporting obligations
↑ Back to industry indexConsumer Products & Retail
UK September enforcement cases demonstrate that conformity markings need supporting declarations, test evidence and technical documentation. Retailers making carbon-neutrality claims should also review substantiation; food retailers can assess the new ISO 20001 framework.
- Verify product safety evidence and complete technical records before import or marketplace listing.
- Maintain traceability between product models, batteries, chargers, test reports and declarations.
- Review environmental marketing claims and establish measurable controls for food waste where relevant.
Primary sources: UK OPSS — PORIYA electric scooter safety report · UK OPSS — URLIFE T2 electric bike safety report · ISO — ISO 14068:2026 carbon neutrality · ISO — ISO 20001:2026 food loss and waste
↑ Back to industry indexPower, Energy & Utilities
The IEC 62109-1 FDIS revision covers safety of photovoltaic power-conversion equipment, including battery and AC interfaces. ISO 17748-3 adds a reference for EV/grid demand-response data exchange. Both are relevant to supplier specifications, integration and assurance planning.
- Review prospective converter design and safety-test implications before freezing specifications.
- Monitor final IEC publication and relevant regulatory adoption; distinguish draft requirements from mandatory duties.
- Assess data exchange, cybersecurity responsibilities and integration evidence for connected EV/grid services.
Primary sources: IEC — IEC 62109-1:2026 pre-release / FDIS · ISO — ISO 17748-3:2026 EV demand-response data exchange · European Commission — CRA reporting obligations
↑ Back to industry indexFinance & Insurance
September’s quality, carbon-neutrality and CBAM developments affect the technical evidence used in lending, investment and insurance assessments. The sector implication is stronger scrutiny of source data, transition plans and claims supporting project or counterparty decisions.
- Request traceable emissions and verification-readiness evidence from relevant financed producers.
- Assess the technical basis and reduction pathway behind carbon-neutrality commitments.
- Include quality-management transition and digital-product risk controls in relevant due-diligence reviews.
Primary sources: European Commission — CBAM verification and accreditation · ISO — ISO 14068:2026 carbon neutrality · ISO — ISO 9001:2026
↑ Back to industry indexGovernment & Public Bodies
Public buyers can use the month’s developments to clarify evidence requirements for digital equipment, infrastructure, carbon claims and food-service contracts. Acceptance criteria should reflect applicable law and the actual status of published standards and drafts.
- Require documented CRA responsibilities where procured products fall within scope.
- Define measurable quality, environmental and food-waste acceptance criteria for relevant contracts.
- Check the competence, independence and scope of third-party assurance providers.
Primary sources: European Commission — CRA reporting obligations · ISO — ISO 14068:2026 carbon neutrality · ISO — ISO 20001:2026 food loss and waste
↑ Back to industry indexHealthcare & Pharmaceuticals
MDCG 2020-16 Rev.5 is the direct September development for in-vitro diagnostic device classification. Digital health products need a separate jurisdiction and product-scope assessment; cybersecurity requirements should not be assigned without checking sector-specific exclusions.
- Reassess IVD classification rationales against the revised guidance.
- Trace changed assumptions through technical documentation and notified-body arrangements.
- Assess digital-product and AI assurance requirements against the relevant device legislation and actual use case.
Primary sources: European Commission — MDCG 2020-16 Rev.5 · EU Cyber Resilience Act — Regulation (EU) 2024/2847 · ISO — ISO/IEC AWI 26582, under development
↑ Back to industry indexIndustrial Manufacturing
Manufacturers face a combined agenda: ISO 9001 transition, CRA reporting for covered products, CBAM emissions evidence for affected goods, and review of adopted dual-use changes. Controlled technical and supplier records support each workstream.
- Build a coordinated compliance matrix covering product, destination, role and applicable dates.
- Integrate quality-system updates with supplier qualification, test evidence and change control.
- Prepare verified-emissions records and rescreen export classifications where applicable.
Primary sources: ISO — ISO 9001:2026 · European Commission — CRA reporting obligations · European Commission — CBAM verification and accreditation · European Commission — 2026 dual-use control list update
↑ Back to industry indexInternational Trade
CBAM verification readiness and the adopted EU dual-use update directly affect relevant cross-border supply chains. UK enforcement examples reinforce the need for defensible conformity files before shipment. Legal applicability depends on the product and trade role.
- Identify CBAM goods, exemptions, declarant responsibilities and supplier verification capability.
- Track Official Journal publication and entry into force of the adopted export-control update.
- Check declarations, technical files, test reports and importer traceability before dispatch.
Primary sources: European Commission — CBAM verification and accreditation · European Commission — 2026 dual-use control list update · UK OPSS — PORIYA electric scooter safety report · UK OPSS — URLIFE T2 electric bike safety report
↑ Back to industry indexMarine
IMO’s September ammonia seminar and alternative-fuel spill-preparedness forum highlighted technical and emergency-response capability needs. These are sector-development signals, not new mandatory rules introduced by the events.
- Assess ammonia and other alternative-fuel hazards in bunkering, onboard use and maintenance.
- Review inspection competence, fuel-system interfaces and emergency-response assumptions.
- Define testing, commissioning and spill-response evidence for each fuel project.
Primary sources: IMO — Ammonia as marine fuel technical seminar · IMO — Alternative-fuel spill preparedness forum
↑ Back to industry indexOil, Gas & Chemicals
Carbon-neutrality substantiation and supplier evidence are relevant to operators and chemical producers. CBAM applies to specific goods, including fertilizers and hydrogen, rather than the entire oil-and-gas sector. Covered connected equipment may bring CRA reporting responsibilities for manufacturers.
- Check CBAM product scope and maintain traceable production and emissions data for affected goods.
- Review carbon-neutrality inventories, reduction pathways and offsetting evidence.
- Clarify responsibilities for covered industrial digital products and supplier incident evidence.
Primary sources: European Commission — CBAM verification and accreditation · ISO — ISO 14068:2026 carbon neutrality · European Commission — CRA reporting obligations
↑ Back to industry indexTelecommunications & Digital
CRA reporting is the immediate issue for manufacturers of covered network equipment, software and digital components. ISO/IEC AWI 26582 signals future AI functional-correctness assurance but remains a development project.
- Operate tested 24/72-hour reporting and escalation procedures.
- Control vulnerability handling, supplier notifications, updates and supporting product records.
- Track AI standardization without presenting draft projects as published compliance requirements.
Primary sources: European Commission — CRA reporting obligations · ISO — ISO/IEC AWI 26582, under development
↑ Back to industry indexTourism & Hospitality
ISO 20001:2026 is relevant to hotel kitchens, catering and other food-service operations. ISO 14068:2026 covers carbon-neutrality claims for services, buildings and events, making measurement boundaries and substantiation material to hospitality marketing.
- Establish food-waste baselines across purchasing, storage, preparation and service.
- Review hotel, event and service carbon-neutrality claims against a documented reduction hierarchy.
- Assess relevant connected building and guest equipment for product-specific cybersecurity implications.
Primary sources: ISO — ISO 20001:2026 food loss and waste · ISO — ISO 14068:2026 carbon neutrality · European Commission — CRA reporting obligations
↑ Back to industry indexTransport & Logistics
ISO 17748-3 supports the data-exchange framework for EV demand-response charging. Logistics providers serving food supply chains can assess ISO 20001, while product conformity and emissions records remain important at shipment and handover interfaces.
- Review charging-system interoperability and controlled data exchange for relevant EV operations.
- Measure food losses during storage and distribution and coordinate improvement with customers.
- Preserve shipment, product and source-data traceability supporting conformity and emissions evidence.
Primary sources: ISO — ISO 17748-3:2026 EV demand-response data exchange · ISO — ISO 20001:2026 food loss and waste · European Commission — CBAM verification and accreditation
↑ Back to industry indexTrending TIC services
Five assurance services gaining relevance
GAR’s assessment of September’s developments points to rising demand for the following assurance services.
Cybersecurity conformity & CRA readiness
Vulnerability-management assessment, cybersecurity testing, technical-file review and incident-reporting readiness.
ISO 9001 transition assessment
Gap analyses and management-system updates ahead of certification-body transition activity.
GHG & carbon-claim assurance
Inventory and claim-evidence review, reduction-pathway assessment and CBAM verification readiness.
Supply-chain data assurance
Traceable emissions, sustainability, product and digital compliance records backed by verifiable source data.
Emerging AI assurance
Functional-correctness assessment and quality, risk and evidence controls for AI systems.
On 29 September, ISO/IEC approved the work item ISO/IEC AWI 26582 on conformity assessment of AI-system functional correctness. It remains under development and is not a published compliance standard. GAR interprets it as a signal of future independent AI-assurance activity.
Primary sources: ISO — ISO/IEC AWI 26582, under development
Customer priorities
Eight actions arising from September developments
Use October to convert the developments into controlled compliance actions:
1. Digital-product manufacturers
test CRA escalation immediately; reporting obligations already apply.
2. ISO 9001-certified organizations
obtain the 2026 edition, complete a gap analysis and plan transition with your certification body.
3. Organizations making carbon-neutrality claims
review inventories, the reduction hierarchy, offsets and substantiation against ISO 14068:2026.
4. CBAM importers and non-EU producers
maintain verification-ready 2026 emissions records rather than reconstructing them in 2027.
5. IVD manufacturers
reassess classification rationales against MDCG 2020-16 Rev.5.
6. Technology and industrial-equipment exporters
review the adopted dual-use changes and track their legal application date.
7. Food-sector organizations
assess ISO 20001:2026 as a framework for measurable loss and waste controls.
8. Importers and online sellers
verify declarations, test reports, technical files, markings and traceability before shipment.
30–90 day watchlist
What to monitor over the next 30–90 days
ISO 9001 transition implementation
Monitor instructions from your certification and accreditation bodies; translate the gap review into responsibilities, evidence updates and an agreed timetable.
Primary sources: ISO/TC 176 — ISO 9001:2026 transition milestones
IEC 62109-1 FDIS ballot closes
Monitor the voting outcome, final publication and subsequent regulatory adoption. The pre-release draft is not the final standard.
Primary sources: IEC — IEC 62109-1:2026 pre-release / FDIS
CRA product-specific standards
The standardization programme targets important and critical product-category deliverables around 30 October. Check actual publication and Official Journal citation separately.
Primary sources: European Commission — CRA standardization work programme
AI conformity assessment
Track ISO/IEC AWI 26582 and the EU AI standardization programme. EN 18286:2026 has been adopted; Official Journal citation remains a separate Commission step.
Primary sources: ISO — ISO/IEC AWI 26582, under development · European Commission — AI standards and tools
CBAM verification
Monitor accredited verifier information and organize assurance work ahead of Registry reports in January 2027 and the first declaration and surrender deadline on 30 September 2027.
Primary sources: European Commission — CBAM verification and accreditation · EU — CBAM amendment, Regulation (EU) 2025/2083
Environmental claims
Strengthen claim-governance and substantiation processes. The Commission’s 30 September EMAS session addressed the Empowering Consumers Directive and environmental communication.
Primary sources: European Commission — EMAS and environmental claims, 30 September
Authoritative sources
Original issuing organizations and reference documents
Source links lead to the original issuing organizations. Status and dates are assessed as at 1 October 2026.
- European Commission — CRA reporting obligations
- EU Cyber Resilience Act — Regulation (EU) 2024/2847
- European Commission — CRA implementation guidance
- ISO — ISO 9001:2026
- ISO — Publication announcement, 16 September 2026
- ISO/TC 176 — ISO 9001:2026 transition milestones
- ISO — ISO 14068:2026 carbon neutrality
- European Commission — CBAM verification and accreditation
- European Commission — CBAM implementation updates
- EU — CBAM amendment, Regulation (EU) 2025/2083
- ISO — ISO 20001:2026 food loss and waste
- European Commission — MDCG 2020-16 Rev.5
- European Commission — 2026 dual-use control list update
- ISO — ISO/IEC AWI 26582, under development
- IEC — IEC 62109-1:2026 pre-release / FDIS
- ISO — ISO 17748-3:2026 EV demand-response data exchange
- IMO — Ammonia as marine fuel technical seminar
- IMO — Alternative-fuel spill preparedness forum
- UK OPSS — PORIYA electric scooter safety report
- UK OPSS — URLIFE T2 electric bike safety report
- European Commission — CRA standardization work programme
- European Commission — AI standards and tools
- European Commission — EMAS and environmental claims, 30 September
GAR support
Turn regulatory change into a practical assurance plan.
GAR supports organizations through conformity-assessment planning, technical compliance reviews, inspection and testing coordination, management-system assessment, supplier and supply-chain assurance, market-access support, technical due diligence, ESG and sustainability assurance, and regulatory advisory services.
Support for these developments can include ISO 9001 transition gap assessments, CRA readiness reviews, technical-documentation assessment, supplier conformity verification, carbon and environmental-claim assurance preparation, CBAM data and verification-readiness reviews, and market-access compliance assessments.
The appropriate route depends on the product, jurisdiction, applicable legislation, standards and supply-chain role. Early assessment helps identify design and documentation gaps before certification, shipment or market-surveillance intervention.
Share your assessment requirements
Global Alliance Register can assess applicability and coordinate the appropriate regulatory review, testing, inspection, certification or conformity-assessment route through qualified and authorized resources.
Contact Global Alliance Register