Transportation

Kiosk standard update poses big airport challenges

Airports, airlines and technology suppliers are entering a critical stage in the transition to the latest Common Use Self Service standard, a move that promises stronger security and greater flexibility but could also require substantial investments in software, testing and hardware.

Image: Adobe stock

July 28, 2026 by Richard Slawsky — Editor, Connect Media

Summarize with

Common Use Self Service, or CUSS, allows multiple airlines to offer passenger services through shared kiosks instead of installing separate machines for each carrier.

The International Air Transport Association's current specification is CUSS 2.3.2. IATA's migration plan calls for the industry to leave CUSS 1.x platforms and applications by the end of 2026, replacing aging technology with a more secure and adaptable foundation.

For kiosk operators, however, the shift involves more than a routine software update, and at least one technology provider expects the transition to continue well into 2027.

A new technology foundation

CUSS 1.x was developed for fixed, Windows-based kiosks running locally installed applications. Some of its underlying technologies are now unsupported or costly to maintain.

CUSS 2 uses modern web technologies, including OpenAPI, OAuth 2.0, HTML5, JSON, WebSocket and TLS protocols newer than version 1.2. It eliminates dependencies on technologies such as Common Object Request Broker Architecture, Java and browser plug-ins that were common when earlier versions of CUSS were created.

The newer standard incorporates security-by-design principles and supports current payment security, privacy and data-protection requirements across kiosks, bag drops, tablets, phones and other touchpoints.

CUSS 2 applications can be responsive rather than permanently installed on one kiosk type, allowing them to operate across different devices, screen sizes and locations.

Michael Irons, head of sales and business development at Elevation AI, said in a Zoom interview that unsupported airport technology makes the security issue especially pressing.

Elevation AI's team participated in the IATA CUSS Task Force and contributed to specifications, APIs and testing environments. The company describes co-Founder William Kapke as a key architect of CUSS 2.x.

"Cybersecurity keeps me up at night" is a common concern among airport officials, Irons said. "Most of those airports are running very vulnerable software across their platforms and networks because there is so much more of a threat landscape with unsupported and outdated technology."

The migration clock is running

IATA's migration roadmap divides the transition into four milestones.

Airlines and airports were advised to begin planning, testing and updating applications. By the end of the second quarter of 2026, vendors were expected to offer CUSS 2 platforms for testing and certification.

By the end of the third quarter, airports may begin requiring CUSS 2 platforms and applications. The period allows participants to stress-test systems, coordinate certification and resolve performance problems.

The roadmap calls for CUSS 1 operations and support to end in 2026 and for new kiosks to support CUSS 2 natively. Airports may remove applications from carriers that have not completed the transition.

The schedule is industry guidance, with enforcement depending on airports, contracts, platform providers and airline readiness. Late movers could face limited testing and certification capacity.

Irons expects the conversion to extend beyond the target date because the schedule is not being enforced by a single industry authority.

"Do I think that will happen? Never," Irons said of a complete move away from CUSS 1 by the end of 2026. "It will go on into 2027."

Compatibility creates a major challenge

CUSS 2 is a substantially different architecture, so CUSS 1 applications do not operate natively on CUSS 2 platforms. The reverse is also true.

Suppliers expect CUSS 1 and CUSS 2 to coexist temporarily. Dual-platform and bridge technologies can allow legacy airline applications to operate alongside CUSS 2 software on existing kiosks.

Such arrangements are temporary bridges established among participating airports, airlines and vendors.

The compatibility layer is intended to let airports and airlines move on different schedules. Irons said an industry wide conversion in which every participant changes platforms simultaneously is unrealistic.

"The airline industry has tried to do a big-bang approach," Irons said. "However, that is not going to happen. That is not going to help the industry."

Airlines must determine whether to adapt or rebuild applications, test departure-control connections and peripherals, and recertify the updated software.

CUSS 2 supports multiple screen orientations and aspect ratios, but developers remain responsible for ensuring interfaces and accessibility features display correctly.

For airports, the challenge is coordinating airlines that may be at different points in the migration. A large hub might have dozens of carriers using the same kiosk estate, each with its own development schedule, departure control system and technology partners.

Costs extend beyond the kiosk

The cost of CUSS 2 will vary considerably by airport and airline. The largest expenses may not involve the visible kiosk enclosure.

Airlines could face costs for application development, integration, security reviews, testing and certification. Airports may need new platform licenses, operating-system upgrades, computing components and professional services. They also must account for deployment labor, project management, testing facilities and contingency plans to protect passenger processing during the conversion.

Kiosk and platform vendors will have to support customers running two generations of technology during the transition. They may also need to update device interfaces, drivers and management software while providing enough engineering capacity to complete customer testing and certification.

Those near-term expenses are balanced against expected long-term savings. IATA says common-use standards reduce costs by allowing one airline application to operate across standardized vendor platforms. Modern web development tools should also make applications easier to update and reduce dependence on specialized legacy development skills.

Irons said airports and airlines will face different cost pressures during the transition.

"From an airport's perspective, if they're looking at replacing their hardware, obviously that's the biggest cost if they're looking at replacing 10- to 15-year-old kiosks," he said. "From an airline's perspective, it's about having their application certified on a CUSS 2 environment."

What happens to older kiosks?

CUSS 2 does not necessarily make every existing kiosk obsolete. Whether a machine can be retained depends on its age, processing capacity, operating system and peripheral devices.

Some airports may be able to preserve the enclosure, display, printer, scanner and other components while replacing the internal computer or updating the operating system and device drivers. Modular kiosks are likely to be better candidates for this approach because individual components can be upgraded without replacing the entire terminal.

The age of a kiosk alone does not determine whether it can remain in service. Irons said Elevation AI recently deployed an application on kiosks that were about 12 or 13 years old and supports Frontier Airlines applications on NCR kiosks approaching 20 years old. Aging printers, passport readers, barcode readers and computers may still require replacement.

"We're doing as much as we can from a software perspective to help them, but there's only so far that we can go with that," Irons said.

Older machines may present more difficult choices. Kiosks that depend on unsupported processors, operating systems, payment readers or proprietary drivers may be too costly or risky to retrofit. IATA has warned that common-use systems should not operate on end-of-life Windows platforms because unsupported software creates security, compatibility and compliance risks.

Windows 10 Home and Pro support ended in October 2025, although certain Windows 10 Enterprise and Internet of Things Long-Term Servicing Channel editions remain supported for several more years. Airports must evaluate the specific edition running on each kiosk rather than treating every Windows 10 machine identically.

A hardware audit should identify which kiosks can be upgraded, which require new computing or payment components and which should be replaced. Airports also should avoid purchasing new equipment that merely supports CUSS 2 through an intermediary compatibility layer. IATA's roadmap calls for new deployments to support the standard natively.

Planning for the final changeover

The approaching transition will test coordination across the airport technology ecosystem. Airlines cannot certify applications without access to vendor platforms. Airports cannot retire CUSS 1 until participating airlines are ready, and vendors must manage testing demand while supporting live operations.

Certification could become one of the principal constraints. Until testing is more closely aligned through IATA, Irons said airlines developing CUSS 2 applications may have to work separately with individual platform suppliers.

"There will be some challenges in terms of the availability of certification slots," Irons said, particularly as more airports begin requiring the new standard.

The most effective migration plans will treat CUSS 2 as a coordinated operational program rather than an isolated information technology upgrade. Airports should maintain an inventory of kiosk hardware and airline applications, establish deadlines with each carrier and confirm that vendors have reserved adequate testing and certification capacity.

CUSS 2 offers the industry a path away from aging software and toward more secure, flexible and device-independent passenger processing. Reaching that goal, however, will depend on decisions being made now about budgets, compatibility and the future of thousands of existing airport kiosks.

About Richard Slawsky

In addition to writing, Slawsky serves as an adjunct professor of Communication at the University of Louisville and other local colleges. He holds both a Bachelor’s and a Master’s degree in Communication from the University of Louisville and is a member of Mensa and the National Communication Association.

Connect with Richard: