Skip to content
DRAFT REPORT (COM(2022)0454 – C90308/2022 – 2022/0272(COD))

On the proposal for a regulation of the European Parliament and of the Council on horizontal cybersecurity requirements for products with digital elements and amending Regulation (EU) 2019/1020

ITRE-PR-745538

Committee on Industry, Research and Energy · Rapporteur: Nicola Danti

Official HTML ↗ PDF DOCX
✦ In shortFull text
✦ In short · AI summary of this text, generated 26 Sept 2026

Written by a language model from the full text only; every figure comes from the text. The paragraph links open the paragraph a statement rests on — check the text itself before relying on it.

The rapporteur's draft report sets out Parliament's position on the proposed regulation on horizontal cybersecurity requirements for products with digital elements, amending Regulation (EU) 2019/1020. It amends the Commission proposal on scope, manufacturer and distributor duties, vulnerability and incident reporting to ENISA, conformity assessment, market surveillance and penalties. It asks the Commission to give ENISA 8,5 additional full-time posts and matching appropriations, and to set up an expert group on cyber resilience. It delays application to 40 months after entry into force, with reporting obligations applying after 20 months.

Committee position. The rapporteur proposes to amend the Commission proposal to simplify the scope, align reporting with Directive (EU) 2022/2555, give manufacturers flexibility on product lifetime, add support for small businesses, strengthen ENISA and market surveillance, and delay application to 40 months.

Key points

  1. The draft resolution adopts Parliament's first-reading position and asks the Commission to increase ENISA's establishment plan by 8,5 full-time posts with corresponding appropriations.
  2. It simplifies the scope to products that can have a direct or indirect data connection, and exempts spare parts made for products placed on the market before 40 months after entry into force.
  3. Free and open-source software supplied outside a commercial activity is covered only where incorporated into products; manufacturers must ensure such components comply.
  4. Manufacturers must determine the expected product lifetime, ensure it matches consumer expectations, handle vulnerabilities for at least that period and state it on the product or in contracts.
  5. Business-to-consumer products should install security updates automatically by default, with users able to de-activate this, and users must be told when the lifetime ends.
  6. Where the expected lifetime is under five years, manufacturers must give undertakings free access to source code under contract to extend vulnerability handling, for up to five years.
  7. Manufacturers must notify ENISA of actively exploited vulnerabilities and significant incidents under a staged procedure: early warning within 24 hours, notification within 72 hours, and a final report within one month.
  8. Voluntary reporting to ENISA is allowed for manufacturers, other entities and any actor on incidents, cyber threats, near misses and vulnerabilities, without extra obligations for the notifier.
  9. The Commission must set up an expert group on cyber resilience within 6 months of entry into force, with members from EU bodies, industry, civil society, academia and individual experts.
  10. Member States must ensure a high level of cybersecurity and appropriate product lifetimes in public procurement, and manufacturers must urgently remedy vulnerabilities in publicly procured products.
  11. The Commission must issue a handbook for economic operators within 12 months of entry into force, focusing on helping micro, small and medium-sized enterprises comply.
  12. Penalty revenue is allocated to the Digital Europe Programme for cybersecurity projects, and the Commission may conclude mutual recognition agreements with comparable third countries.

Who is affected

  • Manufacturers of products with digital elements: new duties on lifetime, updates, source code access and reporting to ENISA.
  • Micro, small and medium-sized enterprises: guidelines, financial support, reduced conformity fees and penalty rules reflecting their capacity.
  • Distributors: must act on information they hold, but are not required to research conformity proactively.
  • Member States: public procurement must prioritise cybersecurity, and market surveillance authorities need adequate resources.
  • ENISA: gains new notification, database and reporting tasks, plus 8,5 additional full-time posts.

Figures and deadlines

  • 8,5 additional full-time posts for ENISA.
  • 40 months after entry into force for the regulation to apply.
  • 20 months after entry into force for reporting obligations under Article 11.
  • 24 hours to send an early warning on an actively exploited vulnerability or significant incident.
  • 72 hours to send a vulnerability or incident notification.
  • One month after the notification to submit a final report.
  • Five years: threshold for source code access obligation and end of free access.
  • Six months: period harmonised standards or certification schemes must be in place before class I conformity assessment applies.

Legal basis: Article 294(2) and Article 114 of the Treaty on the Functioning of the European Union.