Legislative Train Schedule
European Parliament
Please fill in this field to search

Horizontal cybersecurity requirements for products with digital elements

In “A Europe Fit for the Digital Age”

PDF version

On 15 September 2022 the Commission presented a legislative proposal for the EU Cyber Resilience Act (CRA), which introduces mandatory cybersecurity requirements for products with digital elements. The proposal covers a broad range of devices - it would include all products that are connected either directly or indirectly to another device or network, including hardware, software and ancillary services and would impose obligations on manufacturers, importers, and distributors of these products to provide duty of care across their whole life cycle.

The proposal aims to ensure better protection for consumers through increasing the responsibility of manufacturers by obliging them to provide security support and software updates to address identified vulnerabilities, and providing them with information about cybersecurity of products they buy and use. The act would provide a single set of rules for cybersecurity for companies in the EU. It would decrease the number of cybersecurity incidents and increase the transparency and trust of consumers in products with digital elements and guarantee better protection of their data and privacy.

The proposed measures define:

  • rules for placing on the market of products with digital elements through a process of conformity assessment (self-assessment or third party conformity assessment, depending on the category of the product) to demonstrate fulfilment of specific cybersecurity requirements, resulting in attribution of a CE marking;
  • requirement for the design, development and production of such products and obligations of economic operators, as well as processes put in place and reporting obligations for manufactures to ensure cybersecurity throughout the life cycle of such products, as well as obligation of economic operators in these processes;
  • rules on market surveillance and enforcement, which would be performed through appointed market surveillance authorities.

The European Economic and Social Committee (EESC) adopted their opinion on the CRA on 14 December 2022.

In the Parliament, the file has been assigned to the Committee on Industry, Research and Energy (ITRE) and Nicola Danti (Renew, Italy) has been appointed as rapporteur. The Committees on Internal Market and Consumer Protection (IMCO) and on Civil Liberties, Justice and Home Affairs (LIBE) have been asked for their opinions. IMCO has exclusive competences on articles 7 and 9 and shared competences on articles 4, 8, 21, 22 and 25-40, and LIBE has shared competence on article 41(5). LIBE committee decided not to give an opinion.

The report was adopted by the ITRE Committee with 61 votes to 1, with 10 abstentions on 19 July 2023. Committee amendments to the Commission proposal include inter-alia:

  • Regarding the scope, the report confirms the Commission's proposal to include all products with digital elements. It underlines however the importance to ensure that developers of open source software are excluded from the scope if they are not receiving any financial returns for their projects. The report expands the list of critical products under class I, to include as well home automation systems and products that enhance private security, such as cameras and smart locks.
  • The report proposes flexible duration for the expected product lifetime, which should be  clearly stated, and obligation that manufacturers provide automatic security updates and to differentiate between security and functionality updates where feasible.
  • Reporting should align with the directive on the security of network and information systems (NIS2) to simplify the obligations for manufacturers, and make mandatory only reporting of significant incidents and actively exploited vulnerabilities, in a multi-step approach (24 hours, 72 hours, 1 month). The European Union Agency for Cybersecurity (ENISA) should become the one-stop entity for reporting, and should receive reinforcement to be able to fulfil additional tasks set-out in the regulation.  
  • The report proposes to prolong the date from which the regulation applies to 40 months. In this respect, micro, small and medium enterprises should receive sufficient support to ensure their compliance. Harmonised standards, common specifications or European cybersecurity certification schemes should be in place for six months before the conformity assessment procedure applies. The Commission should provide guidelines with more details on the implementation.
  • The report emphasizes the importance of cybersecurity professionals and proposes upskilling and reskilling of workers to ensure their availability.
  • To promote international trade, Mutual Recognition Agreements (MRAs) with third countries should be concluded to ensure the same level of protection as that provided by the CRA. As regards the monitoring of non-technical risk factors, ENISA and market surveillance authorities should perform the necessary checks on vendors which might present a higher risk profile.

In Council, Member States’ representatives (Coreper) reached a common position on 19 July 2023, allowing the Council to enter in negotiations with the European Parliament. Council notably removed the notion of "critical" from products with digital elements  and deleted a substantial number of the products listed in the Annex III. Council introduced three categories of products, critical for essential entities as defined by the NIS2, that would fall under mandatory European cybersecurity certification by means of a delegated act. The Council moved the reporting of cybersecurity incidents and actively exploitable vulnerabilities from ENISA to the national Computer Security Incident Response Teams (CSIRTs) in a two-step process of an initial notification after 24 hours and a second one after 72 hours. Council proposes to postpone the application of the regulation to 36 months.

Parliament confirmed committee decision to enter into interinstitutional negotiations on 13 September 2023.

References:

Further reading:

Author: Polona Car, Members' Research Service, legislative-train@europarl.europa.eu

As of 20/09/2023.