Skip to content
DRAFT OPINION (COM(2022)0454 – C90308/2022 – 2022/0272(COD))

On the proposal for a regulation of the European Parliament and of the Council on Horizontal cybersecurity requirements for products with digital elements and amending Regulation (EU) 2019/1020

IMCO-PA-742490

Committee on the Internal Market and Consumer Protection · Rapporteur: Morten Løkkegaard

Official HTML ↗ PDF DOCX
✦ In shortFull text
✦ In short · AI summary of this text, generated 29 Sept 2026

Written by a language model from the full text only; every figure comes from the text. The paragraph links open the paragraph a statement rests on — check the text itself before relying on it.

The draft opinion concerns the proposed regulation on horizontal cybersecurity requirements for products with digital elements. The rapporteur proposes amendments to improve the internal market and consumer protection, legal clarity with other laws, and to reduce administrative burdens on small businesses. The amendments require manufacturers to handle vulnerabilities for the longer of the expected product lifetime or five years, notify ENISA of exploited vulnerabilities within 24 hours, and provide free security updates during the minimum product lifetime. They also strengthen market surveillance by making joint activities and sweeps mandatory, allowing fines below the minimum threshold under conditions, and requiring the Commission to issue guidelines for SMEs and non-tangible products.

Committee position. The rapporteur proposes amendments to the Commission proposal to improve the internal market and consumer protection, ensure legal clarity with other legislation, reduce administrative burdens on SMEs, and strengthen market surveillance and enforcement.

Key points

  1. The rapporteur proposes amendments to improve the internal market and consumer protection, ensure legal clarity with other legislation, and reduce administrative burdens on micro, small and medium-sized enterprises.
  2. The amendments require the Commission to provide guidelines and advice to SMEs and micro-businesses, including a direct channel to experts, to help them meet the new obligations.
  3. The definition of 'reasonably foreseeable misuse' is deleted because it creates legal unclarity for manufacturers and consumers.
  4. The definition of 'substantial modification' excludes security and maintenance updates, and manufacturers are not required to carry out another conformity assessment for software updates unless they result in a substantial modification.
  5. Member States may subject products with digital elements to additional measures for military, defence or national security purposes if necessary and proportionate.
  6. Manufacturers must handle vulnerabilities for the longer of the expected product lifetime or five years from placing on the market, and must take corrective measures for the same period.
  7. Manufacturers must notify ENISA of any actively exploited vulnerability within 24 hours, and provide further details within 72 hours; economic operators that are essential or important entities under NIS2 and notify under NIS2 are deemed compliant.
  8. Manufacturers must provide free security updates during the minimum product lifetime, and must inform users about significant incidents without undue delay.
  9. Components manufacturers must provide necessary information and documentation free of charge to finished product manufacturers, and manufacturers must exercise due diligence when integrating third-party components.
  10. Market surveillance authorities shall regularly carry out joint activities, including inspections under cover identity, and shall conduct simultaneous coordinated control actions ('sweeps') coordinated by the Commission.
  11. Penalties must take into account the specificities of micro, small and medium-sized enterprises, and authorities may apply fines below the minimum threshold under certain conditions.
  12. The regulation shall apply from 40 months after entry into force, with certain chapters applying no earlier than 40 months for products with digital elements and no earlier than 20 months after publication of harmonised standards for critical products.

Who is affected

  • Manufacturers of products with digital elements: must handle vulnerabilities, notify ENISA, provide security updates, and ensure conformity.
  • Micro, small and medium-sized enterprises: benefit from simplified procedures, reduced fees, and specific guidance.
  • Market surveillance authorities: must conduct joint activities, sweeps, and receive consumer complaints.
  • Authorised representatives: must provide mandate copies, inform manufacturers of risks, and cooperate with authorities.
  • Importers: must verify conformity and indicate contact details on products.

Figures and deadlines

  • 24 hours: deadline for manufacturers to notify ENISA of an actively exploited vulnerability.
  • 72 hours: deadline for manufacturers to provide further details to ENISA on an exploited vulnerability.
  • five years: period for which manufacturers must handle vulnerabilities and take corrective measures, if longer than expected product lifetime.
  • 40 months: period after entry into force for the regulation to apply.
  • 20 months: period after publication of harmonised standards for critical products for certain chapters to apply.
  • 6 months: deadline after entry into force for the Commission to issue guidelines on non-tangible products.
  • three years: period during which no administrative fines have been applied for a similar infringement for fines below the minimum threshold.