IACS UR E26/E27 for Newbuilds: What Owners Must Demand From Yards in 2026

If you are taking delivery of a ship contracted after mid-2024, cyber resilience is no longer a nice-to-have you can negotiate away in the final yard meeting. It is a condition of class, and the paperwork that proves it has to exist before the ship enters service. The gap most owners discover too late is that these requirements sit across three parties — yard, systems integrator, and equipment suppliers — and unless the contract nails down who delivers what, you inherit the shortfall.

What actually changed, and when did it take effect?#

IACS published two Unified Requirements — UR E26 "Cyber Resilience of Ships" and UR E27 "Cyber Resilience of On-Board Systems and Equipment." Both originally applied to new ships from 1 January 2024. After industry feedback, IACS revised them. Given that the original requirements had not yet entered into force, IACS decided to apply only the revised requirements from 1 July 2024. To avoid confusion, the original versions, along with their previous application date of 1 January 2024, were withdrawn.

The scope split matters. UR E26 applies to ships as a whole, while UR E27 applies to on-board systems and equipment. Crucially, when a UR comes into force it becomes a condition of class, and a vessel that doesn't comply won't get its class certificate. That is the lever. A yard cannot deliver, and you should not accept, a ship that fails class on cyber grounds.

These URs translate a general IMO obligation into engineering terms. IMO Resolution MSC.428(98) requires cyber risks to be addressed in company safety management systems no later than the first annual verification of the company's Document of Compliance after 1 January 2021. E26 and E27 give class societies something concrete to survey against.

Which deliverables must the yard and integrator produce?#

E26 organises around five functions — Identify, Protect, Detect, Respond and Recover, with activities and deliverables defined for each, factoring in the vessel lifecycle and the stakeholders involved. The UR recognises the different roles of the suppliers, integrators, owners and class society.

Demonstrating compliance is document-driven across the vessel lifecycle. Demonstrating compliance with E26 requires submission of documents relating to three stages: in design and construction the systems integrator submits a zones and conduit diagram, a vessel asset inventory, and a cyber-security design description; at commissioning the systems integrator submits a ship cyber-resilience test procedure; and in operation the ship owner submits a ship cyber-security and resilience programme.

Put plainly, under UR E26 the shipbuilder is responsible for creating the Zones and Conduit Diagram, Vessel Asset Inventory, Ship Cyber Resilience Test Procedure and Cyber Security Design Description, and during operation the shipowner is responsible for maintaining the Ship Cyber Security and Resilience Programme. The asset inventory is not a token spreadsheet. It must be a documented list of all computer-based systems and networks essential to safe and secure operation — PMS, ECDIS, propulsion controls, fire detection, cargo management — including manufacturer, model, firmware version and network connectivity.

What must you demand from equipment suppliers under E27?#

E27 is where owners get burned, because the type-approval certificate is narrower than people assume. Type-approval under UR E27 covers the equipment as supplied — firmware version, network interface, security baseline at month zero. After that, the system is integrated, patched and changed, and those changes fall under E26 and your SMS.

Technically, E27 is based on and incorporates elements of IEC 62443, covering 30 security capabilities required by all computer-based systems and 11 additional capabilities for systems that share an interface with untrusted networks. For procurement, the practical test is documentation. Compliant equipment comes with documented update processes, vulnerability disclosure channels, and end-of-life timelines — and for a post-July 2024 newbuild you should be asking vendors for their E27 compliance documentation. Suppliers who cannot demonstrate this are already being screened out. E27 compliance is increasingly written into procurement contracts, and a supplier who can't show a vulnerability disclosure policy and update mechanism risks being excluded from bids.

When do surveys start biting, and what gets checked?#

This is now live, not theoretical. The first cohort of E26/E27 newbuilds entered service through 2024 and 2025, and by mid-2026 their first cyber-relevant surveys are starting. If you manage any newbuild contracted from mid-2024 onwards, your first cyber-relevant in-service survey is imminent.

Compliance is ongoing, not a delivery-day box tick. Compliance with UR E26 and E27 is audited annually, and at the first annual survey the shipowner presents records or documented evidence demonstrating implementation of the Ship Cyber Security and Resilience Programme. That evidence covers practical operational hygiene — anti-malware maintained and updated, procedures for portable and removable devices followed, access control policies followed, and physical safeguards maintained. The ship cyber resilience test procedure is required again at the vessel's special survey.

What should Gulf owners put in the newbuild contract now?#

For owners ordering from yards in Korea, China, Japan or building at Gulf facilities, the leverage is the contract. Once the ship is on the water, closing gaps is a retrofit at your cost.

One caution on sourcing: IACS categorised applicability into mandatory and non-mandatory depending on vessel type and size, so confirm exactly how the requirements bite for your specific hull. The scope of applicability was categorised as mandatory and non-mandatory compliance depending on vessel types and sizes. Verify the precise scope and any notation options with your chosen class society and flag state before you finalise the specification.

The pattern to avoid is treating cyber as a class formality the yard handles quietly. The deliverables are specific, the survey regime is annual, and the owner carries the operational programme for the life of the ship. Get the split of responsibility written down before signature, verify the documents against the as-built ship, and walk into the first annual survey with evidence rather than assurances.

If you are scoping a newbuild specification or reviewing what a yard has actually delivered against E26/E27, book a consultation with Solas Security to pressure-test your deliverables and survey readiness.