JET Tightens HSM Rule for Iris and Vein Locks

On July 12, 2026, the Japan Electrical Safety & Environment Technology Laboratories (JET) updated its JET-002-2026 certification guidance for iris and vein biometric locks seeking the JET mark. The change shifts the compliance focus from software-based encryption provisions to a hardware-based requirement for biometric template key generation and storage, with immediate acceptance of new applications and only a 30-day transition window. For lock manufacturers, component suppliers, certification teams, and procurement-side stakeholders, this is worth close attention because it affects both product architecture and near-term certification readiness.

What the Updated JET Guidance Now Requires

According to the provided event summary, JET revised JET-002-2026 on July 12, 2026. The updated guidance requires that all iris and vein recognition locks applying for the JET mark use a FIPS 140-3 Level 3 certified hardware security module (HSM) for the generation and storage of biometric template encryption keys.

The same summary states that this requirement replaces the earlier software encryption clause under JIS X 5090:2022. New applications are being accepted from the effective date of the update, and the transition period is limited to 30 days.

Where the Operational Pressure Is Likely to Appear

Product makers facing certification-bound design changes

From an industry perspective, manufacturers of iris and vein biometric locks are the most directly affected group because the rule targets how biometric template encryption keys are generated and stored. The impact is likely to concentrate in product design, security architecture, certification preparation, and any application already being planned for the JET mark.

Component and subsystem sourcing under closer review

Analysis shows that procurement and supply-side teams may also feel pressure, since compliance now depends on the use of a FIPS 140-3 Level 3 certified HSM rather than a software-based approach. The practical concern is not only selecting a compliant security component, but also aligning sourcing, documentation, and delivery timing with a short transition window.

Certification and market-entry teams working against a short deadline

For certification service providers, compliance teams, and commercial teams responsible for market entry, the 30-day transition period may become the main operational issue. What deserves closer attention is whether current application plans, technical files, and product claims still match the updated guidance, especially for products already positioned for submission.

Buyers and downstream adopters watching qualification risk

Purchasing organizations and downstream adopters of biometric locking systems may not be the direct subject of the rule, but they could still be affected if certification timing, supply commitments, or approved product configurations change. Their focus is likely to be on whether suppliers can maintain planned qualification and delivery schedules under the revised requirement.

What Companies Should Track Now

Check the application timetable against the 30-day transition

Analysis shows that the immediate task is to compare active and planned JET applications with the new effective timeline. The short transition period means timing itself becomes a compliance issue, not just a technical one.

Review whether current key management design still qualifies

Companies involved in iris and vein biometric locks should examine whether existing biometric template key generation and storage designs rely on the software-based provision that has now been replaced. This is a practical distinction between prior compliance assumptions and the new certification condition.

Prepare supplier and documentation checks around the HSM requirement

What deserves closer attention is the supporting material behind any HSM-related claim. In practical terms, teams may need to verify supplier qualification status, technical documents, and certification-facing materials to avoid mismatches between product design and submission content.

Separate policy wording from deployment readiness

Observably, the update is a formal rule change, but business impact will depend on how quickly companies can translate that wording into product, sourcing, and certification actions. The issue is not only understanding the requirement, but also whether internal processes can support it within the stated timeframe.

Why This Reads as More Than a Minor Wording Update

Analysis shows that this development is better understood as a concrete compliance shift rather than a routine editorial revision. The replacement of a software encryption clause with a hardware-based requirement changes the likely threshold for acceptable implementation in the affected product category.

At the same time, it is more appropriate to understand this as a near-term regulatory and certification signal rather than a fully settled long-range industry outcome. The confirmed facts establish the new requirement and the short transition period, but the broader commercial and supply-chain effects still need to be observed through implementation and application activity.

How to Read the Change at This Stage

For the industry, the main significance of this update is its direct link between biometric lock certification and a specific hardware security standard for key generation and storage. The short transition period adds urgency, but the current record supports a measured conclusion: this is an immediate compliance change for affected JET-mark applications and a wider signal that biometric security implementation details are receiving closer scrutiny.

It is more appropriate to understand the news as both a short-term operational change and a longer-term indicator worth monitoring, especially for companies whose products, supply arrangements, or certification schedules depend on iris or vein biometric lock deployments in the JET context.

Basis of This Article and What Still Needs Verification

This article is based on the user-provided news title, event date, and event summary concerning the July 12, 2026 JET guidance update. For this type of development, relevant source categories typically include official notices, certification body publications, company disclosures, industry association materials, authoritative media reporting, and standard-related documents.

A specific official source link was not provided in the input, so the exact source document and any later clarifications still need ongoing verification. Observably, the next points to watch are whether JET issues additional explanatory language, whether implementation details are further clarified, and how the 30-day transition is reflected in actual application handling.