MOODY NEWS — September 4, 2026.

New development

Personal protective equipment: new standards and a reprieve for respiratory protection

EU · personal protective equipment and testing · adopted decision

On 4 September, Implementing Decision (EU) 2026/1971 was published and entered into force, updating the harmonised standards under Regulation 2016/425. References for protective gloves for hairdressers, rain clothing and eye and face protection have been added. The withdrawal of the old references to EN 12941 and EN 12942 for filtering respiratory devices is postponed from 8 October 2026 to 8 October 2027. Manufacturers, laboratories and notified bodies should check the specific edition, the scope of the tests and the technical files. The presumption of conformity applies only to the essential requirements covered; the decision does not exempt the full assessment of the product.

ATEX: updated reference for optical radiation equipment

EU · explosion-proof equipment · harmonized standard

Implementing Decision (EU) 2026/1967, published on 4 September, adds EN IEC 60079-28:2026 to the harmonised standards under Directive 2014/34/EU. The standard concerns the protection of equipment and systems using optical radiation in potentially explosive atmospheres. The new reference is effective from publication and the reference to EN 60079-28:2015 is withdrawn on 4 March 2028. Manufacturers, testing laboratories and notified bodies must plan a comparison of technical solutions, test methods and evidence of conformity. The transition does not automatically invalidate any existing certificate; the impact on the specific type of equipment and documentation should be agreed with the competent authority.

Bulgaria updates aeronautical data quality rules

Bulgaria · aviation and data management · promulgated regulation

In the State Gazette, issue 81 of 4 September, Regulation No. 15 of 25 August 2026 on aeronautical information services was promulgated, replacing the regulation of 2011. It regulates the work of the certified provider, the provision of data by airports and other entities and the quality and accuracy checks. In case of identified non-compliances, corrective actions and a register of measures taken are required. For critical data, immediate action is provided for via NOTAM. Airport operators and providers should review the exchange contracts, internal control procedures and AIRAC deadlines. The new national regulation is applied in conjunction with the European requirements under Regulation 2017/373.

Postal security: annual risk assessment and shipment control

Bulgaria · postal services and logistics · regulatory amendment

The amendment to Regulation No. 6 on postal security, published on 4 September, introduces more specific organisational and control requirements. Postal operators shall appoint a security officer, carry out at least an annual risk assessment of the entire logistics chain and organise random checks on consignments from automated stations. Video recordings shall be kept for 30 days and the applicable security requirements shall be published. Operators have 12 months from the entry into force to bring their activities into compliance. Updates to internal rules, responsibilities, evidence of checks and protection of personal data shall be planned.

New checks for the recognition of agricultural organizations and groups

Bulgaria · agriculture and administrative control · current amendment

The amendment to Regulation No. 12 of 2015 on the recognition of agricultural producer organizations and groups has been in effect since September 4. The act updates the applications, internal rules, evidence and control procedures. For recognized organizations, associations and interbranch organizations, an inspection is set once every three years; for groups, a separate procedure with administrative inspections, corrective measures and possible suspension or withdrawal of recognition is established. Existing applications are completed according to the previous procedure, and for certain groups in medicinal and essential oil crops there are special transitions. The affected organizations should verify the registrations of members, management documents and evidence of maintaining the recognized status.

EU introduces code for issuer-funded analyses

EU · financial services and independent valuation · adopted regulation

Delegated Regulation (EU) 2026/1092, published on 4 September, establishes a European code for investment research funded by issuers and enters into force on 7 September. Investment firms must have sufficient information to assess compliance before distributing under this designation. The code covers independence, conflicts of interest, contractual terms, disclosures and at least five years of record retention. The use of an independent external assessment is permitted, but the responsibility of the firm remains. The relevant providers and control functions should check conflict records, contracts, designation and evidence of review. This does not create a universal requirement for external certification of every analysis.

Banks receive a regulatory map between the business indicator and FINREP

EU · banking supervision and reporting · adopted technical standards

Implementing Regulation (EU) 2026/1166, published on 3 September, defines the correspondence between the components of the business indicator for operational risk and the specific cells of the FINREP reporting templates. It enters into force on 23 September 2026 and complements, but does not duplicate, the already reflected Regulation 2026/1167. For some items, separation or adjustment of the reported values is required, instead of mechanical transfer of the entire cell. Banks' reporting, risk and audit teams should verify the calculation logic, data sources and documentation of the adjustments. The practical objective is traceability from the financial statement to the regulatory indicator and control over incorrect inclusion of amounts.

Upcoming deadlines

T–7: Mandatory reporting under the Cyber Resilience Act begins on September 11

EU · digital products and cybersecurity · reminder T–7

Seven days remain until the application of Article 14 of Regulation (EU) 2024/2847. From 11 September 2026, manufacturers of covered products with digital elements must report actively exploited vulnerabilities and serious incidents affecting the security of the product. An early warning within 24 hours and a notification within 72 hours of becoming aware of them are foreseen. This is a reminder of an existing deadline, not a new act. Responsible persons, personal EU Login profiles with two-factor protection, the channel to the competent CSIRT and internal escalation should be checked. ENISA indicates a planned readiness of the common platform by 11 September; it is not assumed that it is already publicly available.

T–14: opinions on future algae standards

EU · food, algae and laboratories · consultation, T–14

The European Commission's consultation on a draft standardisation request for seaweed and seaweed products closes on 18 September 2026. Today's reminder is at threshold T–14; the draft is from 29 July and is not a newly published act. Five new standards and a revision of terminology are proposed, including on identification, geographical origin, quality and measurement or reduction of iodine. Producers, food businesses and laboratories can submit data on the applicability of the methods, traceability and the required testing capacity. This remains a draft for future work by CEN, and not already published standards or mandatory certification introduced.

Strategic Watch

EU-Switzerland: updated criteria for linked emission markets

EU — Switzerland · climate verification · active baseline

On 4 September, Decision No 1/2026 of the Joint Committee on the linking of the EU and Swiss emissions trading systems was published in the Official Journal. The decision was adopted and has been in force since 9 June 2026; today's publication does not constitute a new starting date. The essential criteria for stationary installations and aviation, including monitoring, reporting, verification and accreditation, have been updated. For operators and verifiers with cross-border commitments, this is a reason to check the applicable jurisdiction, regulatory versions and allocation of responsibilities. It should not be assumed that the same administrative procedure or scope automatically applies in both systems.

Guidelines on forced labor: what evidence will be assessed

EU · supply chains and social auditing · official guidelines

The Commission's guidelines on Regulation (EU) 2024/3015 on products produced with forced labour were published in the Official Journal of 3 September. They clarify investigations, traceability and the assessment of evidence before the general application of the ban from 14 December 2027. The guidelines do not constitute binding law in their own right and do not create a general new duty of due diligence. For manufacturers, importers and auditors, the context in which the evidence is collected is important: social audits of workers at risk or with restricted access are not considered reliable. The methods for assessing suppliers, access to workers and the verifiability of corrective actions should be reviewed.

FDA seeks proposals on quality and evidence for herbal medicines

USA · pharmacy and laboratory control · official consultation

The FDA is formally seeking comments on the development of drug products from plant materials, algae, and macroscopic fungi. The notice was published in the Federal Register on September 4, and the comment period is November 3, 2026. Issues include batch-to-batch consistency, quality standards, appropriate testing of complex mixtures, and possible updates to regulatory guidance. This is a consultation, not a new marketing authorization or adopted standard. Developers, manufacturers, and laboratories, including European entrants with U.S. market plans, may submit practical data on analytical methods, reproducibility, and quality control. Comments should distinguish drugs from dietary supplements.

FSA prepares conditions for first CBD food permits

United Kingdom · novel foods and testing · international strategic signal

A paper for the UK Food Standards Agency’s board of directors published on 3 September offers recommendations for the first three authorisations for high-purity CBD novel foods. Proposals for specifications, permitted uses and labelling, including THC controls, have been refined following consultation. Decisions are forthcoming and are the responsibility of ministers; the document does not in itself authorise sales. For manufacturers, importers and laboratories, the signal lies in future product specifications and evidence of consistency of production. The specific application and market should be checked: the procedures for England and Wales, Scotland and Northern Ireland should not be presented as one general authorisation already adopted.

ISO/IEC 17067 moved from final approval to publication

International · conformity assessment schemes · expected standard, radar update

The official ISO register now shows ISO/IEC 17067 at stage 60.00, a standard in the process of publication. The transition is dated 21 August 2026 and updates the final approval stage reported in MOODY NEWS on 19 August; it is not presented as a today's event. The second edition is intended to replace ISO/IEC 17067:2013 and is important for scheme owners, certification bodies and users of conformity assessment. Final publication has not yet been confirmed. A review of scheme rules and contractual references should be prepared after access to the published text, without prior announcement of a mandatory transition period.

Published by MG Global in partnership with ERPI.