On the proposal for a regulation of the European Parliament and of the Council on Horizontal cybersecurity requirements for products with digital elements and amending Regulation (EU) 2019/1020
IMCO-AD-742490
Committee on the Internal Market and Consumer Protection · Rapporteur: Morten Løkkegaard
Written by a language model from the full text only; every figure comes from the text. The paragraph links open the paragraph a statement rests on — check the text itself before relying on it.
The Committee on the Internal Market and Consumer Protection gives its opinion on the proposed regulation on horizontal cybersecurity requirements for products with digital elements. It proposes amendments to improve the internal market and consumer protection, align the text with other EU laws, and reduce the burden on small businesses.¶¶¶ The amendments add rules on free and open-source software, partly completed products, reporting deadlines for exploited vulnerabilities and incidents, and conformity assessment. They also set a 36-month application date and create an EU declaration of incorporation.¶¶¶
Committee position. The committee proposes amendments to improve the internal market and consumer protection, align the regulation with other EU laws, reduce administrative burden on small businesses, and strengthen communication with authorities and cybersecurity requirements.¶¶¶
Key points
- The regulation should not apply to internal networks of a product that are completely isolated from external data connection, or to spare parts meant only to replace defective parts.¶¶¶
- Free and open-source software is excluded unless provided in the course of commercial activity, such as charging for a product, monetising a platform, using personal data, or charging for technical support.¶¶
- Microenterprises and individual developers must make best efforts to comply for 6 months from placing software on the market, except for highly critical products.¶¶
- Manufacturers must notify ENISA of actively exploited vulnerabilities within 48 hours and of significant incidents within 24 hours, with more details within 72 hours.¶¶¶
- ENISA must publish and maintain a database of known exploited vulnerabilities, and manufacturers must monitor it and report vulnerabilities found in their products.¶
- Manufacturers must provide security updates separately from functionality updates, with clear information and an opt-out mechanism, and publicly communicate the expected product lifetime.¶¶
- Small and micro enterprises may use the class I conformity assessment procedure for critical products, and notified bodies must reduce fees for them.¶¶¶
- The Commission must provide guidelines and advice to SMEs and micro-enterprises on implementing the regulation, and may establish a European regulatory sandbox.¶¶¶
- Market surveillance authorities must regularly carry out joint activities, including inspections under cover identity, and simultaneous coordinated control actions (sweeps).¶¶¶
- The regulation applies 36 months after entry into force, with earlier application for products with critical elements once harmonised standards are published.¶¶
- A new EU declaration of incorporation is required for partly completed products with digital elements, and they must not bear the CE marking under this regulation.¶¶¶
- The Commission may adopt common specifications for essential requirements when harmonised standards are not available, and must aim for maximum alignment with international standards.¶¶¶
Who is affected
- Manufacturers of products with digital elements, who must meet essential requirements, handle vulnerabilities, and report incidents to ENISA.¶¶¶
- Micro, small and medium-sized enterprises, which get simplified procedures, reduced fees, and specific guidance.¶¶¶
- Importers and distributors, who must verify compliance and inform authorities of risks.¶¶¶
- Market surveillance authorities, which must cooperate with ENISA and conduct joint activities and sweeps.¶¶¶
- Developers of free and open-source software, who are outside the regulation unless they engage in commercial activity.¶¶
Figures and deadlines
- 6 months from placing software on the market for microenterprises to make best efforts to comply.¶¶
- 48 hours to notify ENISA of an actively exploited vulnerability.¶¶
- 24 hours to notify ENISA of a significant incident, with more details within 72 hours.¶¶
- 36 months from entry into force for the regulation to apply.¶¶
- Five years from placing on the market for vulnerability handling and corrective measures, whichever is longer than expected product lifetime.¶¶
- 10 years for importers to keep documents proving fulfilment of requirements.¶
- First biennial technical report by ENISA within 24 months after reporting obligations start applying.¶
- Three-year renewable term for experts in the technical advice group.¶