Sittings · Compare
What changed
PA_Legam
ORDINARY LEGISLATIVE procedure
SHORT JUSTIFICATION
Follow up to the European Parliament legislative resolution on the proposal for a regulation of the European Parliament and of the Council on horizontal cybersecurity requirements for products with digital elements and amending Regulation (EU) 2019/1020
As the former Rapporteur for opinion in the IMCO Committee on the NIS2 Directive, the Rapporteur sees the Cyber Resilience Act as a crucial and natural next step to improve the cybersecurity of the European Union. Being mindful that by definition cyber security will never be 100 per cent complete, the Rapporteur is of the opinion that it is important that everything within our power is done to decrease the number of weak links in our Union, and for this the Cyber Resilience Act is a welcomed next step. We need to increase the cybersecurity of the products with digital elements and other new products such as IoT devices that have become natural parts of the everyday lives of European consumers and businesses.
1. Rapporteur: Nicola DANTI (Renew / IT)
As the IMCO Committee is responsible for the functioning and implementation of the Single Market, including the Digital Single Market, and rules on consumer protection, the Rapporteur sought to introduce amendments that aim to improve the functioning of the internal market, while providing for a high level of consumer protection within the scope of the proposal, specifically with regard to cybersecurity requirements for products with digital elements.
2. Reference numbers: 2022/0272 (COD) / A9-0253/2023 / P9_TA(2024)0130
Furthermore, the Rapporteur believes that some aspects of the proposed Regulation require improvement to ensure legal clarity and coherence between the relevant provisions of the proposed Regulation and other pieces of legislation. This relates in particular to the NIS2 Directive, the recently adopted General Product Safety Regulation, the Artificial Intelligence Regulation, and the Machinery Regulation, as well as a number of relevant delegated and implementing acts. Therefore, the Rapporteur proposed amendments that aim to improve legal clarity and help to ensure coherent, effective and consistent interpretation and application of the mentioned legislations.
3. Date of adoption of the resolution: 12 March 2024
Moreover, as micro, small and medium sized enterprises are crucial economic players in the digital market, the Rapporteur introduced a number of amendments to simplify administrative procedures and limit the administrative burden on small businesses, without lowering the level of safety. Furthermore, the Rapporteur introduced amendments that ensure that micro-enterprises and SMEs, will be provided with specific guidance and advice in complying with the requirements in the Cyber Resilience Act.
4. Legal basis: Article 114 of the Treaty on the Functioning of the European Union
Finally, the Rapporteur has introduced amendments with the aim of ensuring more efficient communication with competent authorities (national market surveillance authorities, ENISA), as well as strengthening the provisions for the obligations and competences of relevant authorities with regards to complaints, inspections and joint activities. Further to this the some amendments by the Rapporteur focus on improving the cybersecurity requirements for components integrated into final products with digital elements, specifying the obligations of economic operators, such as manufacturers and authorised representatives.
5. Competent Parliamentary Committee: Committee on Industry, Research and Energy (ITRE)
The Rapporteur reiterates the position that the introduction of the Cyber Resilience Act is a timely and natural next step to tighten the net around cybersecurity threats in our Union. With the suggested amendments, the Rapporteur has sought to find the right balance between ensuring an increased level of cybersecurity to the benefit of European consumers with a proportionate burden on the business community. It is the ambition of the Rapporteur that cybersecurity will become a natural parameter of competition in the internal market. It is with this in mind, that the Rapporteur has sought to adjust the proposal.
6. Commission's position: accepts all amendments.
AMENDMENTS
The Committee on the Internal Market and Consumer Protection calls on the Committee on Industry, Research and Energy, as the committee responsible, to take into account the following amendments:
Amendment 1
Proposal for a regulation
Recital 15
Text proposed by the Commission
Amendment
(15) Delegated Regulation (EU) 2022/30 specifies that the essential requirements set out in Article 3(3), point (d) (network harm and misuse of network resources), point (e) (personal data and privacy) and point (f) (fraud) of Directive 2014/53/EU apply to certain radio equipment. [Commission implementation decision XXX/2022 on a standardisation request to the European Standardisation Organisations] lays down requirements for the development of specific standards further specifying how these three essential requirements should be addressed. The essential requirements laid down by this Regulation include all the elements of the essential requirements referred to in Article 3(3), points (d), (e) and (f) of Directive 2014/53/EU. Further, the essential requirements laid down in this Regulation are aligned with the objectives of the requirements for specific standards included in that standardisation request. Therefore, if the Commission repeals or amends Delegated Regulation (EU) 2022/30 with the consequence that it ceases to apply to certain products subject to this Regulation, the Commission and the European Standardisation Organisations should take into account the standardisation work carried out in the context of Commission Implementing Decision C(2022)5637 on a standardisation request for the RED Delegated Regulation 2022/30 in the preparation and development of harmonised standards to facilitate the implementation of this Regulation.
(15) Delegated Regulation (EU) 2022/30 specifies that the essential requirements set out in Article 3(3), point (d) (network harm and misuse of network resources), point (e) (personal data and privacy) and point (f) (fraud) of Directive 2014/53/EU apply to certain radio equipment. [Commission implementation decision XXX/2022 on a standardisation request to the European Standardisation Organisations] lays down requirements for the development of specific standards further specifying how these three essential requirements should be addressed. The essential requirements laid down by this Regulation include all the elements of the essential requirements referred to in Article 3(3), points (d), (e) and (f) of Directive 2014/53/EU. Further, the essential requirements laid down in this Regulation are aligned with the objectives of the requirements for specific standards included in that standardisation request. Therefore, when the Commission repeals the Delegated Regulation (EU) 2022/30 with the consequence that it ceases to apply to certain products subject to this Regulation, the Commission and the European Standardisation Organisations should take into account the standardisation work carried out in the context of Commission Implementing Decision C(2022)5637 on a standardisation request for the RED Delegated Regulation 2022/30 in the preparation and development of harmonised standards to facilitate the implementation of this Regulation.
Or. en
Amendment 2
Proposal for a regulation
Recital 56 a (new)
Text proposed by the Commission
Amendment
(56a) In order for economic operators that are SMEs and micro-businesses to be able to cope with the new obligations imposed by this Regulation, the Commission should provide them with guidelines and advice, for example, via a direct channel to connect to experts in case of questions, taking into account the need to simplify and limit the administrative burdens.
Or. en
Amendment 3
Proposal for a regulation
Article 1 – paragraph 1 – introductory part
Text proposed by the Commission
Amendment
This Regulation lays down:
The objective of this Regulation is to improve the functioning of the internal market while providing for a high level of consumer protection.
This Regulation lays down harmonised rules on:
Or. en
Amendment 4
Proposal for a regulation
Article 1 – paragraph 1 – point a
Text proposed by the Commission
Amendment
(a) rules for the placing on the market of products with digital elements to ensure the cybersecurity of such products;
(a) the placing on the market of products with digital elements to ensure the cybersecurity of such products;
Or. en
Amendment 5
Proposal for a regulation
Article 1 – paragraph 1 – point d
Text proposed by the Commission
Amendment
(d) rules on market surveillance and enforcement of the above-mentioned rules and requirements.
(d) market surveillance and enforcement of the above-mentioned rules and requirements.
Or. en
Amendment 6
Proposal for a regulation
Article 3 – paragraph 1 – point 18
Text proposed by the Commission
Amendment
(18) ‘manufacturer’ means any natural or legal person who develops or manufactures products with digital elements or has products with digital elements designed, developed or manufactured, and markets them under his or her name or trademark, whether for payment or free of charge;
(18) ‘manufacturer’ means any natural or legal person who develops or manufactures products with digital elements or has products with digital elements designed, developed or manufactured, and markets them under its name or trademark, whether for payment or free of charge;
Or. en
Amendment 7
Proposal for a regulation
Article 3 – paragraph 1 – point 19
Text proposed by the Commission
Amendment
(19) ‘authorised representative’ means any natural or legal person established within the Union who has received a written mandate from a manufacturer to act on his or her behalf in relation to specified tasks;
(19) ‘authorised representative’ means any natural or legal person established within the Union who has received a written mandate from a manufacturer to act on its behalf in relation to specified tasks with regard to the manufacturer's obligations;
Or. en
Amendment 8
Proposal for a regulation
Article 3 – paragraph 1 – point 26
Text proposed by the Commission
Amendment
(26) ‘reasonably foreseeable misuse’ means the use of a product with digital elements in a way that is not in accordance with its intended purpose, but which may result from reasonably foreseeable human behaviour or interaction with other systems;
deleted
Or. en
Justification
Motion to delete as this concept creates legal unclarity to the detriment of manufacturers and consumers alike.
Amendment 9
Proposal for a regulation
Article 3 – paragraph 1 – point 31
Text proposed by the Commission
Amendment
(31) ‘substantial modification’ means a change to the product with digital elements following its placing on the market, which affects the compliance of the product with digital elements with the essential requirements set out in Section 1 of Annex I or results in a modification to the intended use for which the product with digital elements has been assessed;
(31) ‘substantial modification’ means a change to the product with digital elements excluding security and maintenance updates following its placing on the market, which affects the compliance of the product with digital elements with the essential requirements set out in Section 1 of Annex I or results in a modification to the intended use for which the product with digital elements has been assessed;
Or. en
Amendment 10
Proposal for a regulation
Article 4 – paragraph 2
Text proposed by the Commission
Amendment
2. At trade fairs, exhibitions and demonstrations or similar events, Member States shall not prevent the presentation and use of a product with digital elements which does not comply with this Regulation.
2. At trade fairs, exhibitions and demonstrations or similar events, Member States shall not prevent the presentation and use of a product with digital elements which does not comply with this Regulation provided that the product with digital elements is used exclusively for presentation purposes within the course of the event and that a visible sign clearly indicates its non-compliance with this Regulation.
Or. en
Amendment 11
Proposal for a regulation
Article 4 – paragraph 3 a (new)
Text proposed by the Commission
Amendment
3a. This Regulation shall not prevent Member States from subjecting products with digital elements to additional measures when these specific products will be used for military, defence or national security purposes, and such measures are necessary and proportionate for achievement of those purposes.
Or. en
Amendment 12
Proposal for a regulation
Article 6 – paragraph 1
Text proposed by the Commission
Amendment
1. Products with digital elements that belong to a category which is listed in Annex III shall be considered critical products with digital elements. Products which have the core functionality of a category that is listed in Annex III to this Regulation shall be considered as falling into that category. Categories of critical products with digital elements shall be divided into class I and class II as set out in Annex III, reflecting the level of cybersecurity risk related to these products.
1. Products with digital elements that belong to a category which is listed in Annex III shall be considered critical products with digital elements. Only products which have the core functionality of a category that is listed in Annex III to this Regulation shall be considered as falling into that category. Categories of critical products with digital elements shall be divided into class I and class II as set out in Annex III, reflecting the level of cybersecurity risk related to these products. Integrating a component of higher class of criticality into a product of lower criticality does not change the level of criticality for the product the component is integrated into.
Or. en
Amendment 13
Proposal for a regulation
Article 9 – paragraph 1 a (new)
Text proposed by the Commission
Amendment
This Regulation is designed in such a way that all products covered by the essential requirements laid down in Article 3(3), points (d), (e) and (f) of Directive 2014/53/EU as described in the delegated regulation (EU) 2022/30 comply with this Regulation. To generate legal certainty the delegated regulation (EU) 2022/30 will be repealed when this Regulation comes into force.
Or. en
Amendment 14
Proposal for a regulation
Article 10 – paragraph 1
Text proposed by the Commission
Amendment
1. When placing a product with digital elements on the market, manufacturers shall ensure that it has been designed, developed and produced in accordance with the essential requirements set out in Section 1 of Annex I.
1. When placing a product with digital elements on the market, manufacturers shall ensure that it has been designed, developed and manufactured in accordance with the general safety requirements laid down in Article 5 of the Regulation on general product safety and with the essential requirements set out in Section 1 of Annex I.
Or. en
Amendment 15
Proposal for a regulation
Article 10 – paragraph 4
Text proposed by the Commission
Amendment
4. For the purposes of complying with the obligation laid down in paragraph 1, manufacturers shall exercise due diligence when integrating components sourced from third parties in products with digital elements. They shall ensure that such components do not compromise the security of the product with digital elements.
4. For the purposes of complying with the obligation laid down in paragraph 1, manufacturers shall exercise due diligence when integrating components sourced from third parties in products with digital elements. They shall ensure that such components do not compromise the security of the product with digital elements and that the appropriate conformity assessment procedure has been carried out by the components manufacturers.
Or. en
Amendment 16
Proposal for a regulation
Article 10 – paragraph 4 a (new)
Text proposed by the Commission
Amendment
4a. The components manufacturers shall provide the information and documentation necessary to comply with the requirements of this Regulation, when supplying such components to the manufacturer of finished products. This informations shall be provided free of charge.
Or. en
Amendment 17
Proposal for a regulation
Article 10 – paragraph 6 – subparagraph 1
Text proposed by the Commission
Amendment
When placing a product with digital elements on the market, and for the expected product lifetime or for a period of five years from the placing of the product on the market, whichever is shorter, manufacturers shall ensure that vulnerabilities of that product are handled effectively and in accordance with the essential requirements set out in Section 2 of Annex I.
When placing a product with digital elements on the market, and for the expected product lifetime or for a period of five years from the placing of the product on the market, whichever is longer, manufacturers shall ensure that vulnerabilities of that product are handled effectively and in accordance with the essential requirements set out in Section 2 of Annex I, provided that it is within the manufacturer's control.
Or. en
Amendment 18
Proposal for a regulation
Article 10 – paragraph 7 – subparagraph 3 a (new)
Text proposed by the Commission
Amendment
Where software updates are implemented, the manufacturer shall not be required to carry out another conformity assessment of the product with digital elements, unless the software update results in a substantial modification of the product with digital elements within the meaning of Article 3(31) of this Regulation.
Or. en
Amendment 19
Proposal for a regulation
Article 10 – paragraph 10
Text proposed by the Commission
Amendment
10. Manufacturers shall ensure that products with digital elements are accompanied by the information and instructions set out in Annex II, in an electronic or physical form. Such information and instructions shall be in a language which can be easily understood by users. They shall be clear, understandable, intelligible and legible. They shall allow for a secure installation, operation and use of the products with digital elements.
10. Manufacturers shall ensure that products with digital elements are accompanied by the safety information and instructions set out in Annex II, in an electronic or physical form. Such information and instructions shall be in a language which can be easily understood by users. They shall be clear, understandable, intelligible and legible. They shall allow for a secure installation, operation and use of the products with digital elements.
Or. en
Amendment 20
Proposal for a regulation
Article 10 – paragraph 12
Text proposed by the Commission
Amendment
12. From the placing on the market and for the expected product lifetime or for a period of five years after the placing on the market of a product with digital elements, whichever is shorter, manufacturers who know or have reason to believe that the product with digital elements or the processes put in place by the manufacturer are not in conformity with the essential requirements set out in Annex I shall immediately take the corrective measures necessary to bring that product with digital elements or the manufacturer’s processes into conformity, to withdraw or to recall the product, as appropriate.
12. From the placing on the market and for the expected product lifetime or for a period of five years after the placing on the market of a product with digital elements, whichever is longer, manufacturers who know or have reason to believe that the product with digital elements or the processes put in place by the manufacturer are not in conformity with the essential requirements set out in Annex I shall immediately take the corrective measures necessary to bring that product with digital elements or the manufacturer’s processes into conformity, to withdraw or to recall the product, as appropriate.
Or. en
Amendment 21
Proposal for a regulation
Article 11 – paragraph 1
Text proposed by the Commission
Amendment
1. The manufacturer shall, without undue delay and in any event within 24 hours of becoming aware of it, notify to ENISA any actively exploited vulnerability contained in the product with digital elements. The notification shall include details concerning that vulnerability and, where applicable, any corrective or mitigating measures taken. ENISA shall, without undue delay, unless for justified cybersecurity risk-related grounds, forward the notification to the CSIRT designated for the purposes of coordinated vulnerability disclosure in accordance with Article [Article X] of Directive [Directive XXX/XXXX (NIS2)] of Member States concerned upon receipt and inform the market surveillance authority about the notified vulnerability.
1. The manufacturer shall, without undue delay and in any event within 24 hours of becoming aware of it, notify ENISA, by means of an early warning, of any actively exploited vulnerability contained in the product with digital elements.
The manufacturer shall without undue delay and in any event within 72 hours of becoming aware of exploited vulnerability contained in the product with digital elements further notify ENISA more details on the exploited vulnerability. The notification shall include details concerning that vulnerability and, where applicable, any corrective or mitigating measures taken. ENISA shall, without undue delay, unless for justified cybersecurity risk-related grounds, forward the notification to the CSIRT designated for the purposes of coordinated vulnerability disclosure in accordance with Article [Article X] of Directive [Directive XXX/XXXX (NIS2)] of Member States concerned upon receipt and inform the market surveillance authority about the notified vulnerability.
Or. en
Amendment 22
Proposal for a regulation
Article 11 – paragraph 2 a (new)
Text proposed by the Commission
Amendment
2a. Economic operators that are also identified as essential entities or important entities under the NIS2 and who submit their incident notification pursuant to the NIS2 should be deemed compliant with the requirements in point 2 of this Article.
Or. en
Amendment 23
Proposal for a regulation
Article 11 – paragraph 4
Text proposed by the Commission
Amendment
4. The manufacturer shall inform, without undue delay and after becoming aware, the users of the product with digital elements about the incident and, where necessary, about corrective measures that the user can deploy to mitigate the impact of the incident.
4. The manufacturer shall inform, without undue delay and after becoming aware, the users of the product with digital elements about the significant incident and, where necessary, about corrective measures that the user can deploy to mitigate the impact of the significant incident.
Or. en
Amendment 24
Proposal for a regulation
Article 11 – paragraph 4 a (new)
Text proposed by the Commission
Amendment
4a. The obligations laid down in paragraphs 1, 2 and 4 will apply during the product lifetime. During the minimum product lifetime period the manufacturer will provide security updates for free, which will apply only to products with digital elements for which the manufacturer has drawn up an EU declaration of conformity, in accordance with Article 20 of this Regulation.
Or. en
Amendment 25
Proposal for a regulation
Article 11 – paragraph 5
Text proposed by the Commission
Amendment
5. The Commission may, by means of implementing acts, specify further the type of information, format and procedure of the notifications submitted pursuant to paragraphs 1 and 2. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 51(2).
5. The Commission may, by means of implementing acts, specify further the type of information, format and procedure of the notifications submitted pursuant to paragraphs 1 and 2. Those implementing acts shall be based on standard ISO/IEC 29157 and shall be adopted in accordance with the examination procedure referred to in Article 51(2).
Or. en
Amendment 26
Proposal for a regulation
Article 12 – paragraph 3 – introductory part
Text proposed by the Commission
Amendment
3. An authorised representative shall perform the tasks specified in the mandate received from the manufacturer. The mandate shall allow the authorised representative to do at least the following:
3. An authorised representative shall perform the tasks specified in the mandate received from the manufacturer. It shall provide a copy of the mandate to the market surveillance authorities upon request. The mandate shall allow the authorised representative to do at least the following:
Or. en
Amendment 27
Proposal for a regulation
Article 12 – paragraph 3 – point a a (new)
Text proposed by the Commission
Amendment
(aa) where the authorised representative has a reason to believe that a product with digital elements in question presents a cybersecurity risk, inform the manufacturer;
Or. en
Amendment 28
Proposal for a regulation
Article 12 – paragraph 3 – point b
Text proposed by the Commission
Amendment
(b) further to a reasoned request from a market surveillance authority, provide that authority with all the information and documentation necessary to demonstrate the conformity of the product with digital elements;
(b) further to a reasoned request from a market surveillance authority, provide that authority with all the information and documentation necessary to demonstrate the safety and the conformity of the product with digital elements in an official language which can be understood by that authority;
Or. en
Amendment 29
Proposal for a regulation
Article 12 – paragraph 3 – point c
Text proposed by the Commission
Amendment
(c) cooperate with the market surveillance authorities, at their request, on any action taken to eliminate the risks posed by a product with digital elements covered by the authorised representative's mandate.
(c) cooperate with the market surveillance authorities, at their request, on any action taken to effectively eliminate the risks posed by a product with digital elements covered by the authorised representative's mandate.
Or. en
Amendment 30
Proposal for a regulation
Article 13 – paragraph 2 – point c
Text proposed by the Commission
Amendment
(c) the product with digital elements bears the CE marking referred to in Article 22 and is accompanied by the information and instructions for use as set out in Annex II.
(c) the product with digital elements bears the CE marking referred to in Article 22 and is accompanied by the safety information and instructions for use as set out in Annex II.
Or. en
Amendment 31
Proposal for a regulation
Article 13 – paragraph 3
Text proposed by the Commission
Amendment
3. Where an importer considers or has reason to believe that a product with digital elements or the processes put in place by the manufacturer are not in conformity with the essential requirements set out in Annex I, the importer shall not place the product on the market until that product or the processes put in place by the manufacturer have been brought into conformity with the essential requirements set out in Annex I. Furthermore, where the product with digital elements presents a significant cybersecurity risk, the importer shall inform the manufacturer and the market surveillance authorities to that effect.
3. Where an importer considers or has reason to believe, on the basis of the information at their disposal, that a product with digital elements or the processes put in place by the manufacturer are not in conformity with the essential requirements set out in Annex I, the importer shall not place the product on the market until that product or the processes put in place by the manufacturer have been brought into conformity with the essential requirements set out in Annex I. Furthermore, where the product with digital elements presents a significant cybersecurity risk, the importer shall inform the manufacturer and the market surveillance authorities to that effect.
Or. en
Amendment 32
Proposal for a regulation
Article 13 – paragraph 4
Text proposed by the Commission
Amendment
4. Importers shall indicate their name, registered trade name or registered trademark, the postal address and the email address at which they can be contacted on the product with digital elements or, where that is not possible, on its packaging or in a document accompanying the product with digital elements. The contact details shall be in a language easily understood by users and market surveillance authorities.
4. Importers shall indicate their name, their registered trade name or registered trademark, the postal address and the email address at which they can be contacted on the product with digital elements or, where that is not possible, on its packaging or in a document accompanying the product with digital elements. The contact details shall be in a language easily understood by users and market surveillance authorities.
Or. en
Amendment 33
Proposal for a regulation
Article 16 – paragraph 1
Text proposed by the Commission
Amendment
A natural or legal person, other than the manufacturer, the importer or the distributor, that carries out a substantial modification of the product with digital elements shall be considered a manufacturer for the purposes of this Regulation.
A natural or legal person, other than the manufacturer, the importer or the distributor, that in the course of professional activity carries out a substantial modification of the product with digital elements shall be considered a manufacturer for the purposes of this Regulation.
Or. en
Amendment 34
Proposal for a regulation
Article 20 – paragraph 2
Text proposed by the Commission
Amendment
2. The EU declaration of conformity shall have the model structure set out in Annex IV and shall contain the elements specified in the relevant conformity assessment procedures set out in Annex VI. Such a declaration shall be continuously updated. It shall be made available in the language or languages required by the Member State in which the product with digital elements is placed on the market or made available.
2. The EU declaration of conformity shall have the model structure set out in Annex IV and shall contain the elements specified in the relevant conformity assessment procedures set out in Annex VI. Such a declaration shall be continuously updated. It shall be made available in a language which can easily be understood by the authorities of the Member State in which the product with digital elements is placed on the market or made available.
Or. en
Amendment 35
Proposal for a regulation
Article 23 – paragraph 2
Text proposed by the Commission
Amendment
2. The technical documentation shall be drawn up before the product with digital elements is placed on the market and shall be continuously updated, where appropriate, during the expected product lifetime or during a period of five years after the placing on the market of a product with digital elements, whichever is shorter.
2. The technical documentation shall be drawn up before the product with digital elements is placed on the market and shall be continuously updated, where appropriate, during the expected product lifetime or during a period of five years after the placing on the market of a product with digital elements, whichever is longer.
Or. en
Amendment 36
Proposal for a regulation
Article 23 – paragraph 5
Text proposed by the Commission
Amendment
5. The Commission is empowered to adopt delegated acts in accordance with Article 50 to supplement this Regulation by the elements to be included in the technical documentation set out in Annex V to take account of technological developments, as well as developments encountered in the implementation process of this Regulation.
5. The Commission is empowered to adopt delegated acts in accordance with Article 50 to supplement this Regulation by the elements to be included in the technical documentation set out in Annex V to take account of technological developments, as well as developments encountered in the implementation process of this Regulation. The Commission shall strive to minimise the administrative burden for micro, small and medium sized enterprises.
Or. en
Amendment 37
Proposal for a regulation
Article 24 – paragraph 5
Text proposed by the Commission
Amendment
5. Notified bodies shall take into account the specific interests and needs of small and medium sized enterprises (SMEs) when setting the fees for conformity assessment procedures and reduce those fees proportionately to their specific interests and needs.
5. Notified bodies shall take into account the specific interests and needs of micro, small and medium sized enterprises when setting the fees for conformity assessment procedures and reduce those fees proportionately to their specific interests and needs. The Commission shall take action to ensure appropriate financial support in the framework of existing Union programmes, particularly in order to ease the burden on micro, small and medium sized enterprises.
Or. en
Amendment 38
Proposal for a regulation
Article 29 – paragraph 7 a (new)
Text proposed by the Commission
Amendment
7 a. Member States and the Commission shall put in place appropriate measures to ensure sufficient availability of skilled professionals, in order to minimise bottlenecks in the activities of conformity assessment bodies.
Or. en
Amendment 39
Proposal for a regulation
Article 29 – paragraph 12
Text proposed by the Commission
Amendment
12. Conformity assessment bodies shall operate in accordance with a set of consistent, fair and reasonable terms and conditions, in particular taking into account the interests of SMEs in relation to fees.
12. Conformity assessment bodies shall operate in accordance with a set of consistent, fair and reasonable terms and conditions, in particular taking into account the interests of micro, small and medium sized enterprises in relation to fees.
Or. en
Amendment 40
Proposal for a regulation
Article 37 – paragraph 5
Text proposed by the Commission
Amendment
5. Where, in the course of the monitoring of conformity following the issuance of a certificate, a notified body finds that a product no longer complies with the requirements laid down in this Regulation, it shall require the manufacturer to take appropriate corrective measures and shall suspend or withdraw the certificate if necessary.
5. Where, in the course of the monitoring of conformity following the issuance of a certificate, a notified body finds that a product no longer complies with the requirements laid down in this Regulation, it shall require the manufacturer to take appropriate corrective measures and shall restrict, suspend or withdraw the certificate if necessary.
Or. en
Amendment 41
Proposal for a regulation
Article 41 – paragraph 8
Text proposed by the Commission
Amendment
8. Market surveillance authorities may provide guidance and advice to economic operators on the implementation of this Regulation, with the support of the Commission.
8. The Commission shall adopt guidelines and provide advice to economic operators, particularly those that qualify as SMEs, including micro-enterprises, on the implementation of this Regulation. In particular, the guidelines and the advice shall aim to simplify and limit the administrative burden, while ensuring the effective and consistent application in accordance with the general objective of ensuring product safety and consumer protection.
Or. en
Amendment 42
Proposal for a regulation
Article 41 – paragraph 8 a (new)
Text proposed by the Commission
Amendment
8a. Market surveillance authorities shall be equipped to receive complaints by consumers who identify inconsistencies in the application of this Regulation to relevant products.
Or. en
Amendment 43
Proposal for a regulation
Article 43 – paragraph 1 – subparagraph 2 a (new)
Text proposed by the Commission
Amendment
Before the above mentioned evaluation is conducted, if necessary, taking into account the significance of the cybersecurity risk, the market surveillance authority may require the relevant operator to immediately suspend or restrict the availability of the product on the market for the period of the above mentioned evaluation.
Or. en
Amendment 44
Proposal for a regulation
Article 45 – paragraph 1
Text proposed by the Commission
Amendment
1. Where the Commission has sufficient reasons to consider, including based on information provided by ENISA, that a product with digital elements that presents a significant cybersecurity risk is non-compliant with the requirements laid down in this Regulation, it may request the relevant market surveillance authorities to carry out an evaluation of compliance and follow the procedures referred to in Article 43.
1. Where the Commission has sufficient reasons to consider, including based on information provided by ENISA, that a product with digital elements that presents a significant cybersecurity risk is non-compliant with the requirements laid down in this Regulation, it shall request the relevant market surveillance authorities to carry out an evaluation of compliance and follow the procedures referred to in Article 43.
Or. en
Amendment 45
Proposal for a regulation
Article 45 – paragraph 2
Text proposed by the Commission
Amendment
2. In exceptional circumstances which justify an immediate intervention to preserve the good functioning of the internal market and where the Commission has sufficient reasons to consider that the product referred to in paragraph 1 remains non-compliant with the requirements laid down in this Regulation and no effective measures have been taken by the relevant market surveillance authorities, the Commission may request ENISA to carry out an evaluation of compliance. The Commission shall inform the relevant market surveillance authorities accordingly. The relevant economic operators shall cooperate as necessary with ENISA.
2. In circumstances which justify an immediate intervention to preserve the good functioning of the internal market and where the Commission has sufficient reasons to consider that the product referred to in paragraph 1 remains non-compliant with the requirements laid down in this Regulation and no effective measures have been taken by the relevant market surveillance authorities, the Commission shall request ENISA to carry out an evaluation of compliance. The Commission shall inform the relevant market surveillance authorities accordingly. The relevant economic operators shall cooperate as necessary with ENISA.
Or. en
Amendment 46
Proposal for a regulation
Article 48 – paragraph 1
Text proposed by the Commission
Amendment
1. Market surveillance authorities may agree with other relevant authorities to carry out joint activities aimed at ensuring cybersecurity and protection of consumers with respect to specific products with digital elements placed or made available on the market, in particular products that are often found to present cybersecurity risks.
1. Market surveillance authorities shall regularly carry out joint activities with other relevant authorities aimed at ensuring cybersecurity and protection of consumers with respect to specific products with digital elements placed or made available on the market, in particular products that are often found to present cybersecurity risks. Those activities shall include inspections on products acquired under a cover identity.
Or. en
Amendment 47
Proposal for a regulation
Article 48 – paragraph 2
Text proposed by the Commission
Amendment
2. The Commission or ENISA may propose joint activities for checking compliance with this Regulation to be conducted by market surveillance authorities based on indications or information of potential non-compliance across several Member States of products falling in the scope of this Regulation with the requirements laid down by the latter.
2. The Commission or ENISA shall propose joint activities for checking compliance with this Regulation to be conducted by market surveillance authorities based on indications or information of potential non-compliance across several Member States of products falling in the scope of this Regulation with the requirements laid down by the latter.
Or. en
Amendment 48
Proposal for a regulation
Article 49 – paragraph 1
Text proposed by the Commission
Amendment
1. Market surveillance authorities may decide to conduct simultaneous coordinated control actions (“sweeps”) of particular products with digital elements or categories thereof to check compliance with or to detect infringements to this Regulation.
1. Market surveillance authorities shall conduct simultaneous coordinated control actions (“sweeps”) of particular products with digital elements or categories thereof to check compliance with or to detect infringements to this Regulation.
Or. en
Amendment 49
Proposal for a regulation
Article 49 – paragraph 2
Text proposed by the Commission
Amendment
2. Unless otherwise agreed upon by the market surveillance authorities involved, sweeps shall be coordinated by the Commission. The coordinator of the sweep may, where appropriate, make the aggregated results publicly available.
2. Unless otherwise agreed upon by the market surveillance authorities involved, sweeps shall be coordinated by the Commission. The coordinator of the sweep shall, where appropriate, make the aggregated results publicly available.
Or. en
Amendment 50
Proposal for a regulation
Article 53 – paragraph 1
Text proposed by the Commission
Amendment
1. Member States shall lay down the rules on penalties applicable to infringements by economic operators of this Regulation and shall take all measures necessary to ensure that they are enforced. The penalties provided for shall be effective, proportionate and dissuasive.
1. Member States shall lay down the rules on penalties applicable to infringements by economic operators of this Regulation and shall take all measures necessary to ensure that they are enforced. The penalties provided for shall be effective, proportionate and dissuasive and shall take into account the specificities of micro, small and medium sized enterprises.
Or. en
Amendment 51
Proposal for a regulation
Article 53 – paragraph 6 – point b
Text proposed by the Commission
Amendment
(b) whether administrative fines have been already applied by other market surveillance authorities to the same operator for a similar infringement;
(b) whether administrative fines have been already applied by the same other market surveillance authorities to the same operator for a similar infringement;
Or. en
Amendment 52
Proposal for a regulation
Article 53 – paragraph 6 – point c a (new)
Text proposed by the Commission
Amendment
(ca) The subsequent behaviour of the operator following information or knowledge about the respective non-compliance.
Or. en
Amendment 53
Proposal for a regulation
Article 53 – paragraph 6 a (new)
Text proposed by the Commission
Amendment
The respective authority may be empowered to apply fines below the minimum threshold when all of the following is observed:
(a) the infringement is unintentional;
(b) the infringement did not and is unlikely to result in negative consequences;
(c) no administrative fines have previously been applied by the same of other market surveillance authorities to the same operator for a similar infringement during the previous three years;
(d) upon coming to know about the respective non-compliance the operator employed all the appropriate corrective measures as well as reasonably necessary measures to avoid or minimise potential negative consequences.
Or. en
Amendment 54
Proposal for a regulation
Article 57 – paragraph 2
Text proposed by the Commission
Amendment
It shall apply from [24 months after the date of entry into force of this Regulation]. However Article 11 shall apply from [12 months after the date of entry into force of this Regulation].
It shall apply from [40 months after the date of entry into force of this Regulation]. However, Chapter II, III, V and VII shall apply no earlier than [40 months after the date of entry into force of this Regulation] as far as products with digital elements are concerned. As far as products with critical elements are concerned, Chapter II, III, V and VII shall apply no earlier than [20 months after the date of publication of the harmonised standards developed under the standardisation requires for the purpose of this Regulation].
Or. en
Amendment 55
Proposal for a regulation
Article 57 – paragraph 2 a (new)
Text proposed by the Commission
Amendment
No later than 6 months after the date of entry into force of this Regulation, the Commission shall issue guidelines on how to apply the requirements in this Regulation to non-tangible products.
Or. en
Amendment 56
Proposal for a regulation
Annex II – paragraph 1 – point 5
Text proposed by the Commission
Amendment
5. any known or foreseeable circumstance, related to the use of the product with digital elements in accordance with its intended purpose or under conditions of reasonably foreseeable misuse, which may lead to significant cybersecurity risks;
deleted
Or. en
ANNEX: LIST OF ENTITIES OR PERSONS FROM WHOM THE RAPPORTEUR HAS RECEIVED INPUT
The following list is drawn up on a purely voluntary basis under the exclusive responsibility of the rapporteur. The rapporteur has received input from the following entities or persons in the preparation of the draft opinion:
Entity and/or person
Apple
BDI Federation of German Industries
BEUC
BSA The Software Alliance
Confederation of Danish Industries
Digital Europe
ETNO
Kaspersky
Microsoft
Samsung
TIC Council
Xiaomi