On Tuesday 27 January 2026, EU and Japanese experts met in Brussels and online for the second edition of the INSTAR and CYBERSTAND.eu - Facilitating EU & Japan dialogue on Cybersecurity Standardisation efforts, organised under the Memorandum of Understanding (MoU) between INSTAR and Japan Business Council in Europe (JBCE), and hosted at the JBCE offices.
The event was co-organised by INSTAR and CYBERSTAND.eu, with the participation of representatives from the Ministry of Economy, Trade and Industry (METI), Information-technology Promotion Agency (IPA), the European Commission (DG CONNECT), ETSI TC CYBER-EUSR, and CEN-CENELEC JTC 13/WG9.
The workshop initiated a structured technical dialogue on the comparison between the EU Cyber Resilience Act (CRA) and Japan’s JC-STAR cybersecurity conformity assessment scheme.
This dialogue is important because the CRA will define mandatory cybersecurity requirements for products placed on the EU Single Market, while JC-STAR represents Japan’s national approach to product cybersecurity. Comparing the two frameworks can reduce market fragmentation, lower compliance costs for manufacturers, and strengthen global cyber resilience, especially for connected and IoT products.
During the workshop, the Japanese experts shared preliminary mapping results comparing JC-STAR requirements with CRA essential requirements, highlighting a high level of conceptual alignment but also structural differences, such as risk-based lifecycle obligations under the CRA versus tiered security levels under JC-STAR.
European experts from ETSI TC CYBER-EUSR and CEN-CENELEC JTC 13/WG9 stressed the need to extend future mapping from the CRA legal text to the harmonised standards currently being developed by ETSI and CEN-CENELEC, which will operationalise CRA requirements. The parties agreed to continue exploring synergies between their respective schemes.
