What TAR 2026-31 changes in plain English
Ofcom's Telecoms Access Review 2026-31 sets the fixed-market regulatory approach for the next review period. In practical terms, it keeps pressure on fibre competition, wholesale access, pricing oversight, use of Openreach infrastructure, geographic market treatment, and legacy network migration.
That makes TAR commercially important for ISPs, altnets, wholesale buyers, and infrastructure users. It affects how networks are accessed, bought, migrated, and competed around. It is not, however, a new ISO 27001 requirement and it should not be presented as one.
Why access, pricing, and migration regulation still create evidence pressure
Regulatory change often creates compliance work indirectly. When more teams depend on shared infrastructure, wholesale relationships, migration programmes, and competitive tenders, more people ask the same practical questions: who owns this service, which suppliers matter, what changed, what risk was accepted, and where is the proof?
That is the evidence-pressure angle. Even when the regulation is about access and competition, the operating response still touches security governance, supplier assurance, resilience planning, change records, customer commitments, and management review.
Where this touches ISO 27001
ISO 27001 is useful here because it gives teams a management-system layer for turning commercial and network change into controlled decisions. The point is not to claim TAR mandates ISO 27001. The point is that a live ISMS should make the resulting operating decisions easier to prove.
For an ISP or altnet, TAR-related work can surface in supplier controls, asset and service dependency records, risk treatment choices, change control, incident-readiness evidence, access reviews, audit trails, and management-review inputs.
- Supplier assurance: who provides the service, what dependency exists, and when was it reviewed?
- Change control: what migration or access change happened, who approved it, and what evidence supports it?
- Risk treatment: what operational or security risk changed because of a new wholesale or infrastructure relationship?
- Incident readiness: how would the team show ownership and customer-impact assessment if the shared service failed?
- Management review: which TAR-driven changes need visibility at leadership level rather than staying in project notes?
Where this touches TSA and security duties
Telecoms Security Act work is not identical to ISO 27001 work, and TAR should not be overstated as creating a new security duty by itself. But telecoms operators already need defensible evidence around resilience, supplier accountability, documented security decisions, and operational controls.
The useful move is to keep TSA/security evidence and ISO 27001 evidence connected. If a fibre migration, access arrangement, or supplier dependency changes, the record should show ownership, security consideration, follow-up actions, and the person who approved the formal position.
A practical checklist for ISPs and altnets after TAR
The strongest post-TAR response is usually a simple evidence check rather than a new documentation programme. Start with one live service or supplier workflow and ask whether the evidence would stand up if a buyer, auditor, regulator, or board member asked for it tomorrow.
- List the affected services, access relationships, migrations, and infrastructure dependencies
- Assign an accountable owner for each material supplier or shared-service dependency
- Record the security and resilience assumptions behind each migration or access decision
- Link supplier evidence, change records, risk entries, incident notes, and management-review actions
- Keep customer-facing claims separate from internal working notes until a human owner approves them
- Review whether TSA and ISO 27001 evidence can be reused instead of duplicated across separate trackers
How AI-27001 fits without overclaiming
AI-27001 does not turn TAR into an ISO 27001 obligation, give legal advice, or approve telecoms compliance positions. It helps teams organise the work around the decision: draft the evidence pack, identify missing owners, connect supplier and change records, and keep the review trail visible.
Humans still approve formal compliance positions, customer statements, legal interpretations, and management decisions. The useful role for AI is to reduce the admin drag around evidence so the responsible people can review the facts faster.
Free review
Not ready to book? Get a practical evidence next step instead.
Pick the lower-friction option that fits where you are. We’ll use your page and campaign context to understand the request without adding tracking clutter to the visible URL.
Share your current TSA or ISO evidence process and we’ll compare it with a cleaner operating model.
Prefer to talk it through?
If TAR creates more supplier and migration evidence work, start with one workflow.
AI-27001 helps structure evidence, owners, review notes, and follow-up actions so humans can approve the formal compliance position. Book a short walkthrough or request a free evidence review for a telecoms workflow.