On 30 November 2023, the Council presidency and the European Parliament’s negotiators reached a so-called provisional agreement on the Commission’s proposed legislation regarding cybersecurity requirements for products with digital elements through their life cycle. The legislation is aiming at ensuring that products, e.g., home cameras, refrigerators, TVs, and toys are safe before they are placed on the market. The agreed text was made public on 10 January 2024. Our comments below are based on this version.

The Cybersecurity Resilience Act (CRA, the regulation) describes EU-wide cybersecurity requirements for the design, development, production and placing on the market of hardware and software products. The scope of the law covers all products that are connected either directly or indirectly to another device or to a network. The CRA does not address certain product categories, such as cars or medical devices, because they already have sector-specific rules.

Among the many changes, the regulation maintains the principle that the support period for a digital product corresponds to its expected lifetime—at least five years—except for products whose life cycle is less than that.

Regarding products that are planning to enter the EU market, a cornerstone of the Cybersecurity Resilience Act is the market surveillance and conformity assessment.

The CRA, under Article 24, explains the conformity assessment procedure for products with digital elements. This article must be interpreted with Article 18 (10) Annex III, Annex VI for “important products,” and Article 6a and Annex IIIa for “critical products.” SMEs can also reach out to the European Cybersecurity Competence Center and follow the development of national regulatory sandboxes. The European Commission, under Article 17c, will also develop a guidance for smaller companies on how to be cyber resilient.

The process for conducting a conformity demonstration is the following: (based on the so-called essential requirements as set out in Annex I). The manufacturer must demonstrate conformity by one of the following:

1. Internal control procedures based on the procedure set out in Module A, Annex VI
2. procedure that is the combination of Module B and C, Annex VI, A
3. full quality-assurance procedure based on Module H, Annex VI, under the European cybersecurity certification scheme – if it exists.

The CRA in its current version describes two special cases. One addresses class I important products and must be read in conjunction with Art 18. If the manufacturer does not apply harmonized standards, common specs or EU cybersecurity certification schemes, then an extra process must be submitted for either (i) an EU-type examination procedure (based on module B), as set out in Annex VI, followed by conformity to EU-type, based on internal production control (based on module C), as set out in Annex VI; or (ii) a conformity assessment based on a full quality assurance procedure (based on module H) as set out in Annex VI.

The other special case for “important” products with digital elements under Class II. In this case, the manufacturer must demonstrate conformity with the essential requirements set out in Annex I by using any of the following procedures:

1. An EU-type examination procedure (based on module B) as set out in Annex VI followed by conformity to EU-type, based on internal production controls (based on module C) as set out in Annex VI;
2. A conformity assessment based on a full quality-assurance procedure (based on module H), as set out in Annex VI
3. (Where available and applicable,) a European cybersecurity certification scheme as specified in Article 18(10) at an assurance level that is at least substantial in accordance with Regulation (EU) 2019/881.