UL 1998 A1 Update: TLS 1.3 & Firmware Audit for V2G Devices

On April 27, 2026, UL Solutions published Supplement A1 to the third edition of UL 1998, introducing mandatory cybersecurity requirements for vehicle-to-grid (V2G) bidirectional charging equipment targeting the North American market. This update directly affects manufacturers and exporters of on-board chargers (OBC), EVSE controllers, and cloud interface modules — particularly those based in China supplying to U.S. and Canadian markets.

Event Overview

UL Solutions released Supplement A1 to UL 1998, Third Edition, on April 27, 2026. The supplement mandates that all V2G devices seeking UL 1998 certification must integrate a TLS 1.3 protocol stack compliant with FIPS 140-3 Level 2 in their communication modules. Effective June 1, 2026, applicants must submit a firmware security audit report issued by a UL-recognized laboratory. The requirement applies across device types: onboard chargers (OBC), EVSE (charging station) controllers, and cloud platform interfaces.

Industries Affected

Direct Exporters to North America

These companies face immediate compliance pressure, as UL 1998 certification is often contractually required for grid interconnection and utility incentive programs in the U.S. and Canada. Failure to meet the TLS 1.3 and firmware audit requirements may delay or block market entry after June 2026.

OEMs and Tier-1 Suppliers Integrating V2G Modules

OEMs embedding third-party V2G hardware or software into vehicles or charging infrastructure must now verify that supplied components meet the updated cryptographic and firmware assurance criteria. Integration timelines and validation workflows may extend due to added security testing scope.

Firmware Development and Security Testing Providers

Vendors offering firmware security assessment, cryptographic module integration, or FIPS 140-3 validation services are seeing increased demand. However, only UL-recognized laboratories may issue the required audit reports — limiting vendor options and potentially increasing lead times and costs.

What Enterprises and Practitioners Should Monitor and Do Now

Track official UL guidance on acceptable TLS 1.3 implementations

While the supplement mandates TLS 1.3 compliant with FIPS 140-3 Level 2, UL has not yet published detailed implementation notes or approved cryptographic libraries. Enterprises should monitor UL’s official communications and technical bulletins for clarifications before finalizing firmware architecture.

Verify laboratory recognition status ahead of submission deadlines

Not all labs performing firmware security audits are UL-recognized. Companies must confirm — before initiating audits — that their chosen lab appears on UL’s current list of recognized facilities for firmware security evaluation under UL 1998. Delays in lab qualification may impact June 1, 2026, submission readiness.

Assess impact on existing product certifications and legacy firmware

The supplement applies to new submissions effective June 1, 2026. However, UL may require re-evaluation of previously certified products if fielded firmware receives security-relevant updates. Manufacturers should review version control policies and update mechanisms to ensure future patches remain within the validated cryptographic and audit scope.

Editorial Perspective / Industry Observation

Observably, this update signals a structural shift — from functional safety emphasis toward embedded cybersecurity assurance in grid-interactive EV infrastructure. It is not merely a technical revision but a formalized expectation that V2G devices act as trusted network endpoints, not just power converters. Analysis shows that UL is aligning UL 1998 more closely with NIST SP 800-53 controls and ISO/IEC 27001-based development practices, though formal cross-referencing is not stated in the supplement. Current enforcement remains tied to voluntary certification; however, given growing utility and grid operator reliance on UL 1998 for interoperability approval, the requirement is functionally becoming a de facto market gate.

It is more appropriately understood as an early-stage regulatory signal than a fully matured compliance regime — one that reflects evolving risk assessments around bidirectional energy flow and remote firmware management, rather than an immediate, broadly enforceable mandate across all sales channels.

Conclusion
This update marks a defined escalation in cybersecurity expectations for V2G technology entering North America. Its significance lies less in novelty — TLS 1.3 adoption has been anticipated — and more in its codification within a widely referenced safety standard, coupled with a hard deadline for third-party firmware auditing. For affected stakeholders, the most rational interpretation is not alarm, but calibration: treat the requirement as a fixed milestone in product development and certification planning, not as a variable policy subject to near-term reversal.

Information Sources
Primary source: UL Solutions, UL 1998, Third Edition, Supplement A1, issued April 27, 2026.
Note: UL’s official implementation guidance, list of recognized laboratories for firmware security audit, and clarification on legacy product grandfathering remain pending and warrant ongoing monitoring.