Windows Drivers Could Be Rejected Under Microsoft’s Tougher 2027 Rules

Windows driver certification will get stricter in March 2027, when Microsoft starts requiring additional security documentation before it signs submitted drivers. Vendors will need to provide both an SBOM and a VEX statement for affected Windows releases.

Microsoft says drivers that lack either document, or include files that fail validation, will not receive a signature.

Microsoft will require SBOM and VEX files for Windows drivers

Microsoft is changing its Windows Hardware Compatibility Program requirements starting in March 2027.

Under the new Windows driver certification requirements, every affected driver submission must include a valid Software Bill of Materials and Vulnerability Exploitability Exchange statement.

An SBOM lists the software components and dependencies included in a driver. A VEX statement provides information about known vulnerabilities associated with those components and whether they actually affect the submitted software.

If Microsoft cannot validate either file, it will reject the submission instead of signing the driver.

Windows 11 25H2 and 26H1 drivers are affected

The requirements will apply to drivers submitted for Windows 11 version 25H2 and Windows 11 version 26H1.

Microsoft will also enforce them for Windows Server 2025 and later releases.

Both HLK-certified drivers and drivers submitted through attestation signing fall under the new rules.

Drivers targeting older Windows versions remain exempt. Microsoft will also exempt submissions completed before the requirements take effect in March 2027.

Microsoft links the requirements to the EU Cyber Resilience Act

Microsoft says the certification changes will help it comply with requirements stemming from the EU Cyber Resilience Act.

The additional files give Microsoft and hardware vendors more information about the components included in drivers and any vulnerabilities associated with them.

VEX data can also distinguish between a component that contains a known vulnerability and a driver that can actually exploit or reach the vulnerable code.

A new Windows Driver Kit arrives in December

Microsoft plans to release an updated Windows Driver Kit in December 2026 to help vendors prepare.

The WDK will include tools for generating the required SBOM and VEX files, while Microsoft plans to publish supporting documentation around the same time.

Hardware vendors can use third-party tools instead, but Microsoft requires the resulting files to comply with the SPDX 3.0 format.

Each driver needs separate security documentation

Microsoft recommends that hardware vendors start preparing before the March 2027 deadline.

Each submitted driver should have its own SBOM and VEX files. Vendors should not combine information covering multiple drivers into a single SBOM or VEX artifact.

The change means driver developers will need to add software component and vulnerability documentation directly to their Windows certification workflows if they plan to support newer Windows releases.

Microsoft is making other Windows management and security changes as well. The company recently shared a workaround for Outlook and Teams launch issues affecting ARM64 systems, while Windows Autopatch will let administrators pause problematic updates in the future.

Microsoft also plans to start enabling Memory Integrity automatically on eligible Windows 11 devices.