Skip to content
REPORT (COM(2022)0454 – C90308/2022 – 2022/0272(COD))

On the proposal for a regulation of the European Parliament and of the Council on horizontal cybersecurity requirements for products with digital elements and amending Regulation (EU) 2019/1020

A-9-2023-0253

Committee on Industry, Research and Energy · Rapporteur: Nicola Danti

Official HTML ↗ PDF DOCX
✦ In shortFull textProcedure & committee votes
✦ In short · AI summary of this text, generated 26 Sept 2026

Written by a language model from the full text only; every figure comes from the text. The paragraph links open the paragraph a statement rests on — check the text itself before relying on it.

Parliament's amended version of the Commission proposal for a Cyber Resilience Act sets horizontal cybersecurity requirements for products with digital elements placed on the EU market. It lays down essential requirements for product properties and vulnerability handling, obligations for manufacturers, importers and distributors, and rules on market surveillance and enforcement. Critical products are split into class I and class II with stricter conformity assessment; highly critical products may need a European cybersecurity certificate. Manufacturers must report actively exploited vulnerabilities and significant incidents to ENISA, which forwards them to CSIRTs and market surveillance authorities. The text requests the Commission to increase ENISA's establishment plan by 9.0 additional full-time posts and corresponding appropriations.

Committee position. The committee proposes to adopt Parliament's position at first reading with amendments to the Commission proposal, including stricter rules for critical products, a support period set by manufacturers, reporting to ENISA, and additional resources for ENISA.

Key points

  1. The Regulation applies to products with digital elements that can have a direct or indirect data connection to a device or network.
  2. It does not apply to products covered by medical devices, in vitro diagnostic medical devices, vehicle type-approval or certified aviation rules, nor to national security or military products.
  3. Free and open-source software is covered only when made available on the market in the course of a commercial activity; individual developers are not subject to obligations.
  4. Products must meet essential requirements in Annex I Section 1 and manufacturers' processes must meet vulnerability handling requirements in Annex I Section 2.
  5. Critical products listed in Annex III are divided into class I and class II; class I requires third-party assessment if harmonised standards or certification are not applied, class II always requires a third party.
  6. Manufacturers must determine a support period, provide security updates, and inform users when the support period ends.
  7. Manufacturers must notify ENISA of actively exploited vulnerabilities within 24 hours (early warning), 72 hours (notification) and one month (final report).
  8. Manufacturers must notify ENISA of significant incidents within 24 hours, 72 hours and one month, and inform affected users.
  9. Member States must designate market surveillance authorities, ensure adequate resources, and cooperate with ENISA and data protection authorities.
  10. Administrative fines can reach up to 15 000 000 EUR or 2.5 % of worldwide annual turnover for breaches of essential requirements and Articles 10 and 11.
  11. The Regulation applies 36 months after entry into force, except reporting obligations under Article 11, which apply after 18 months.
  12. The Commission must issue guidelines for economic operators, including on scope, critical product classification, support periods and non-prosecution of security researchers.

Who is affected

  • Manufacturers of products with digital elements must design securely, handle vulnerabilities, and report incidents to ENISA.
  • Importers and distributors must verify CE marking, documentation and conformity before making products available.
  • Microenterprises and small and medium-sized enterprises receive reduced fees, financial support and exemptions from certain early warnings.
  • Market surveillance authorities in each Member State enforce the rules and may impose fines.
  • ENISA receives notifications, manages the European vulnerability database and prepares biennial reports.

Figures and deadlines

  • 9.0 additional full-time posts requested for ENISA.
  • Early warning within 24 hours of becoming aware of an actively exploited vulnerability.
  • Vulnerability notification within 72 hours of becoming aware.
  • Final report within one month after the vulnerability notification.
  • Administrative fines up to 15 000 000 EUR or 2.5 % of total worldwide annual turnover.
  • Administrative fines up to 10 000 000 EUR or 2 % of total worldwide annual turnover for other obligations.
  • Administrative fines up to 5 000 000 EUR or 1 % of total worldwide annual turnover for incorrect information.
  • Regulation applies 36 months after entry into force; Article 11 applies after 18 months.

Legal basis: Article 114 of the Treaty on the Functioning of the European Union.