EU digital legislation
CRA-Update – Episode 1: Which products fall within the scope of the proposed CRA?
The current proposal for a new European Cyber Resilience Act by the European Commission from 15th September 2022 (CRA) applies to products with digital elements whose intended or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network (see recital 7 and Art. 2 (1) of the proposed CRA).
Art. 3 (1) of the proposed CRA defines a product with digital elements as any software or hardware product and its remote data processing solutions, including software or hardware components to be placed on the market separately.
Due to the broad definition almost every software or hardware product that is able to establish a data connection to a device or network falls within the scope of this regulation, e.g. connected devices, operating systems, hard drives and games.
The proposed CRA does not cover cloud computing services and cloud service models, such as Software-as-a-Service (SaaS), since the NIS-2 Directive already puts in place respective cybersecurity requirements for these services. SaaS only falls within the scope of the proposed CRA, if it is developed by the manufacturer or under his responsibility as a remote data processing solution for the operation of a product with digital elements which is required for this purpose, such as apps for smart scales for example.
Furthermore, the proposed CRA does not apply to products with digital elements that are already subject to sectoral regulations that address cybersecurity risks. This exemption would cover medical devices, in vitro diagnostic devices, systems and components of vehicles, aeronautical products being subject to the Directive (EU) 2018/1139 on common rules in the field of civil aviation, and products developed exclusively for national security or military purposes or that are designed to process classified information.
According to Art. 2 (4) of the proposed CRA, the Commission is empowered to adopt delegated acts to exclude further products with digital elements from the application of this regulation when they are covered by other Union rules.
Open-source software is also not covered by the proposed CRA, but only if the software is developed or supplied outside the course of a commercial activity. However, the commercial use of open-source software (e.g. making it part of an offering) falls within the scope of the CRA.
Practical recommendations:
Due to the broad scope of the proposed CRA, we recommend checking at an early stage whether the products manufactured or distributed by companies are subject to the regulation. In addition, the ongoing legislative process should be followed with regard to possible adjustments in the material scope of application. The latter applies in particular since changes to the draft regulation are still to be expected. Among other things, the rules on application of the regulation to SaaS services and open-source software have already been criticized.
In our CRA-Update series, we regularly present information on the proposed Cyber Resilience Act and keep you informed about changes in the ongoing legislative process. In each of our articles, we give you a brief overview of a specific topic, presenting the most important aspects and practical implications.
CRA-Update
CRA-Update – Episode 11: Final draft of the CRA – Overview on the most relevant amendments
On October 10, 2024, the Council of Ministers adopted the final draft of the Cyber Resilience Act (CRA). The regulation will soon be published in the Official Journal of the European Union and will then enter into force the following day.
We have taken a look at the current text of the regulation and compared it with the European Commission's original draft. We have listed the most important changes for you below.
CRA-Update – Episode 10: Penalties under the CRA-E
With the proposed Cyber Resilience Act (CRA-E), the European Commission has set itself the goal of strengthening the security of products with digital elements with horizontal legal requirements in order to better protect the European internal market from growing cyber threats. Concerning this matter, the regulation contains a large number of obligations that apply to all economic operators in a product supply chain, namely manufacturers, importers and distributors.
CRA-Update – Episode 9: Surveillance authorities
The Commission's draft for the Cyber Resilience Act (CRA-E) mentions different authorities with different tasks for monitoring and compliance with the standards of the regulation.
CRA-Update – Episode 8: The conformity assessment procedure
In order to demonstrate the conformity of products with digital elements with the requirements of the proposed Cyber Resilience Act (CRA-E), manufacturers must carry out a so-called conformity assessment procedure in accordance with Art. 24 (1) CRA-E. For this purpose, the CRA-E basically provides for three different types of procedures, for each of which information can be found in Annex VI. The procedures mentioned there are based on Decision 768/2008/EC, which aims to establish a common framework for legislation harmonizing the conditions for the marketing of products and provides for conformity assessment procedures for this purpose.
CRA-Update – Episode 7: What are vulnerability handling processes put in place by manufacturers and when are they compliant under the CRA?
According to Art. 1 (c) of the planned Cyber Resilience Act (CRA-E) this regulation should also include provisions for vulnerability handling processes put in place by manufacturers. The purpose of these processes is to ensure the cybersecurity of products with digital elements during the whole life cycle.
CRA-Update – Episode 6: When is a product with digital elements in conformity with the requirements of the CRA-E?
The planned Cyber Resilience Act (CRA-E) aims to establish uniform EU cybersecurity requirements for products with digital elements in order to handle the growing threat of cyberattacks. For this purpose, the regulation stipulates numerous obligations that primarily affect the manufacturers of such products.
CRA-Update – Episode 5: What are the obligations of the distributor under the CRA-E?
Being the last economic operator in the supply chain of products with digital elements, the distributor falls within the scope of the proposed Cyber Resilience Act (CRA-E) as well.
According to the definition in Art. 3 (21) CRA-E, a (legal) person can only fall under the term of the distributor if it makes a product with digital elements available on the Union market without affecting its properties and without being already qualified as a manufacturer or importer.
CRA-Update – Episode 4: What are the obligations of the importer under the CRA-E?
The role of the importer becomes relevant within the proposed Cyber Resilience Act (CRA-E) when he makes available a product with digital elements bearing the name or trademark of a (legal) person and being established outside the European Union on the Union market for the first time.
CRA-Update – Episode 3: What are the obligations of the manufacturer under the CRA-E?
In comparison to the other economic operators, the manufacturer is subject to the most comprehensive obligations of the proposed CRA (CRA-E). This is probably because the manufacturer significantly controls the development of the product with digital elements, determines its characteristics and can thus influence the inherent cybersecurity risks. The specific obligations for manufacturers are set out in Art. 10 and 11 of the proposed CRA.
CRA-Update – Episode 1: Which products fall within the scope of the proposed CRA?
The current proposal for a new European Cyber Resilience Act by the European Commission from 15th September 2022 (CRA) applies to products with digital elements whose intended or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network (see recital 7 and Art. 2 (1) of the proposed CRA).