The change event will work but I would still use the control's BeforeUpdate event. Only when he tabs out of a control do we know when he is done with the typing. Cancelling the BeforeUpdate event will prevent the user from leaving the control if it contains an invalid value.
The difference is that the code in the Change event runs for every keystroke but the code for the BeforeUpdate event runs only once. Also, with the code in the Change event, you can prevent typing any character after 28 have been entered rather than allowing the extra keystrokes and not complaining until the user says he is finished with data entry in the control.
Technically
@gemma-the-husky 's suggested code could exist in either event and both would achieve the desired result. But due to my former life in the mainframe world, I abhor the idea of running any code 29 times when running it once will suffice.
For purposes of validation, I would NEVER, EVER use an event that does not provide the Cancel option. You can display as many messages as you want but using an event without the Cancel option never actually stops the data from being saved.