Sign in

UL 2900

ANSI/CAN/UL 2900 — Software Cybersecurity for Network-Connectable Products — UL Standards & Engagement

Also known as: UL 2900-1, UL 2900-2-1, UL 2900-2-2, UL 2900-2-3, ANSI/CAN/UL 2900

Official site Official change log Subscribe to UL 2900 (RSS)

This is a paid standard. We publish the fact of a change, its version and date, and a link to the publisher — the text itself is not reproduced.

Current version
ANSI/CAN/UL 2900-1, Edition 2 (revised June 29, 2026)
Published 29 June 2026. source
Status
In force
Next deadline
None announced
Who must comply
Network-connectable products that are to be evaluated and tested for vulnerabilities, software weaknesses and malware. source
How it is assessed
Products are evaluated and tested against the standard; FDA recognizes the 2017 first editions of UL 2900-1 and 2900-2-1 as consensus standards for medical devices. source
Written by
Published by UL Standards & Engagement as ANSI/CAN/UL 2900-1, approved by ANSI and by the Standards Council of Canada (SCC). source
Enforced by
Sold as a paid standard. For medical devices FDA recognizes it, while noting that conformance may not satisfy every Section 524B cybersecurity requirement. source
Last change
None recorded yet

The US and Canadian standard for the security of network-connectable products: Part 1 sets general requirements for vendor vulnerability management, software weakness testing and security controls in product architecture, and the 2900-2 parts adapt it to specific product types such as healthcare systems. The FDA recognises parts of the series as consensus standards for medical device cybersecurity.

Recent changes

No changes recorded yet — we are watching, and nothing has been published.

Key dates

No upcoming dates
  1. Revision of ANSI/CAN/UL 2900-1 Edition 2 published, with ANSI and SCC approval
  2. UL 2900-1 Edition 2 published
  3. FDA recognizes UL 2900-2-1 (healthcare and wellness systems) as a consensus standard
  4. FDA recognizes UL 2900-1 First Edition 2017 as a consensus standard

Version history

  1. ANSI/CAN/UL 2900-1, Edition 2 (revised June 29, 2026) RevisionCurrent

    Revision of Edition 2 incorporating inclusive language and changes to clauses 3.22 and 3.28; ANSI and SCC approved on the same date. source

  2. UL 2900-1, Edition 2 Major version

    Second edition of Part 1, General Requirements; it replaced Edition 1, now archived. source

  3. —
    UL 2900-1, Edition 1 Major version

    First edition of Part 1, General Requirements, now archived. source

Who it applies to

Makers of network-connectable products, with Part 2 standards for specific sectors such as healthcare and wellness systems and security and life safety signaling systems.

What Part 1 covers
Requirements for the software developer's risk management process, methods for testing a product for vulnerabilities, software weaknesses and malware, and requirements for security risk controls in the product's architecture and design. source
Out of scope
Part 1 contains no requirements on functional testing of a product, and none on the hardware contained in a product. source
Healthcare (Part 2-1)
UL 2900-2-1 applies to testing network-connected components of healthcare systems, including medical devices and accessories, medical device data systems, in vitro diagnostic devices, health IT and wellness devices. source
Life safety (Part 2-3)
UL 2900-2-3 sets particular requirements for security and life safety signaling systems and references UL 2900-1. source
Other UL standards
UL 2900-1 is referenced by other UL standards, including UL 1699 (arc-fault circuit-interrupters) and UL 338 (vehicle theft deterrent equipment). source

How compliance is assessed

Products are evaluated and tested against the standard; FDA recognizes the 2017 first editions of UL 2900-1 and 2900-2-1 as consensus standards for medical devices.

Product testing
The standard describes methods by which a product shall be evaluated and tested for vulnerabilities, software weaknesses and malware. source
FDA recognition, Part 1
FDA recognizes UL ANSI 2900-1 First Edition 2017 as a complete consensus standard (recognition number 13-96). source
FDA recognition, Part 2-1
FDA recognizes UL ANSI 2900-2-1 First Edition 2017 as a complete standard (recognition number 13-104). source
Limit of recognition
FDA notes that conformance may not satisfy all cybersecurity requirements of Section 524B of the FD&C Act or its premarket cybersecurity guidance (issued February 2026). source

Enforcement and penalties

Sold as a paid standard. For medical devices FDA recognizes it, while noting that conformance may not satisfy every Section 524B cybersecurity requirement.

FDA context
FDA lists the UL 2900-1 recognition under FD&C Act Section 524B, Ensuring Cybersecurity of Devices. source
Purchase
The standard is sold through the UL Standards & Engagement shop, in English and French. source

Documents

  1. Standard UL 2900-1 Edition 2 (UL shop entry; paid standard)
  2. Guidance FDA recognized consensus standard 13-96: UL 2900-1
  3. Guidance FDA recognized consensus standard 13-104: UL 2900-2-1

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to UL 2900 (RSS)