Changes from plenary report to adopted text

RemovedEXPLANATORY STATEMENT

RemovedThe Rapporteur strongly welcomes the Commission proposal to address cybersecurity deficiencies in hardware and software products. In 2021, the global cost of cybercrime has reached a staggering EUR 5.5 trillion. This phenomenon, coupled with the upward trend of digitalisation, calls on legislators to ensure that appropriate cybersecurity measures are in place to safeguard the interests of both consumers and industry.

RemovedOn this note, the Rapporteur is pleased that the Commission has put forward an ambitious proposal, which will raise the overall level of cybersecurity in the Member States and the functioning of the internal market. A harmonised regulatory framework is necessary so that undertakings who operate in the Single Market can benefit from legal clarity, as well as to ensure that the Union can play a leading role in the definition of norms on cybersecurity on the global stage.

RemovedOn the issue of the scope, the rapporteur agrees with the Commission’s proposal to include all products with digital elements. This comprehensive approach would provide assurance of cybersecurity compliance throughout the value chain, improving the competitiveness and the attractiveness of products manufactured in the Union. It is nonetheless necessary to simplify the current wording and refer to directly and indirectly connectable products, while excluding spare parts designed solely for the repair process, which have been in the market before this Regulation is implemented. When it comes to open source software, the Rapporteur is aware of the need to safeguard this important source of innovation and has thus put forward an amendment to ensure that developers should not be expected to comply with this Regulation if they are not receiving any financial returns for their projects. Nonetheless, open source software supplied in the framework of a commercial activity should be covered, to ensure the cybersecurity of the Union’s ecosystem.

RemovedWhile the vast majority of products with digital elements will only have to undergo self-assessment, critical products pursuant to Article 6 will be subject to third party assessment. On this issue, the Rapporteur believes that the Regulation should be improved by providing more clarity on how often the list set out in Annex III can be amended as well as the procedures to follow after a product has been added to this list. The latter is particularly important in order to provide undertakings with adequate time to adjust. Nonetheless, the Rapporteur believes that home automation systems and products that enhance private security, such as cameras and smart locks, should constitute critical products under class I. This is because the integrity of these goods is paramount to citizens’ safety and privacy.

RemovedFurthermore, the draft report foresees more involvement from stakeholders through the creation of the Expert group on Cyber Resilience. This body should be tasked to advise the Commission and to take an active role in the preparation of the delegated acts referred to in this Regulation. Thus, in order to express fully the interests of all side, the Expert group should be comprised of institutions, industry, civil society, academia and individual experts.

RemovedIn addition to the aforementioned topic, the draft report stresses the need for Member States to take cybersecurity strongly into account when publicly procuring products with digital elements, and to ensure that vulnerabilities are promptly tackled.

RemovedOn the issue of manufacturers’ obligations, the rapporteur believes that having a set date for the expected product lifetime is inadequate to a horizontal regulation, which intends to cover a wide range of products from software to phones and industrial machineries. This is why the rapporteur believes that it is more appropriate to have manufacturers determine the lifetime of their respective products, provided that the suggested duration is compatible with reasonable consumer expectations. A flexible duration would also enable manufacturers to showcase their products and have lengthy lifetimes as an element of competitiveness. Therefore, in order to raise the awareness of the consumers to this particular matter, the regulation should also oblige the manufacturers to clearly state the expected product lifetime on its packaging or include it in contractual agreements, and to notify the consumers when the lifetime is about to end. Furthermore, the draft report wants to put the utmost emphasis on safety. Thus, the rapporteur believes that the manufacturers should also be obliged to automatically update, when possible, safety features of their respective product. Where a manufacturer has defined an expected lifetime of under five years, it should stand ready to enter into contractual arrangements with undertakings that wish to provide services that extend a product’s lifetime and disclose to them its source code. This possibility should not entail a transfer of ownership or the public disclosure of the source code.

RemovedOn the matter of reporting obligations pursuant to Article 11, the Rapporteur wishes to align the timeline to the NIS2 so that there is more coherence and legal certainty for the stakeholders. In this sense, the Rapporteur suggests to report significant incidents (rather than all incidents), as well as actively exploited vulnerabilities, provided that clear protocols on how to handle such notifications securely are in place, as to avoid the spread of information concerning unpatched vulnerabilities. The Rapporteur also introduces a mechanism of voluntary reporting for other incidents, near misses and cyber threats.

RemovedHowever, to maximise the effect of reporting it is important to have a one-stop entity, also in order to simplify the reporting requirements for manufacturers across the Union. On this note, the Rapporteur believes that the best institution to play this role is ENISA. Therefore, in light of the increase in tasks and competence bestowed to ENISA, the Commission should modify the legislative financial statement accompanying this Regulation by providing the European Union Agency for Cybersecurity with additional posts and corresponding additional appropriations in order to fulfil the agency's additional tasks set out in this Regulation.

RemovedAdditionally, an issue that is fundamental for the Rapporteur is to ensure that sufficient support is in place for undertakings to implement the requirements of this Regulation. This is particularly the case for micro, small and medium enterprises, which given their limited capabilities may find some challenges in ensuring compliance with the CRA. Therefore, the rapporteur believes that it is essential to prolong the date from which the regulation applies to 40 months. In this transition period, it should be possible for manufacturers to comply with the CRA on a voluntary basis, in order to obtain a presumption of conformity with the Radio Equipment Directive Delegated Regulation and to adapt to this Regulation ahead of its official implementation. Furthermore, the Rapporteur wants to emphasise the importance for the Union to provide support for the upskilling and reskilling of workers and ensure the availability of cybersecurity professionals, a key element for the success of this Regulation.

RemovedMoreover, as a general approach to help all stakeholders, the rapporteur calls for guidelines from the Commission to provide more specification on the actual implementation phase, thus providing more clarity to all parties involved.

RemovedAnother equally pressing affair to the Rapporteur is international trade. This is why the draft report calls for the Commission to consider mutual recognition agreements with likeminded third countries, where they share comparable level of technical development and have a compatible approach concerning conformity assessment, ensuring the same level of protection as the one provided for by this Regulation. Nonetheless, it is essential that adequate monitoring of products coming from risky countries, which may contain backdoors or other vulnerabilities, is ensured: ENISA should coordinate with market surveillance authorities and perform the necessary checks on vendors who might present a higher risk profile.

RemovedLastly, the rapporteur believes that revenues generated from the penalties should be earmarked to projects, which will raise the overall cybersecurity level across the Union, and hence be allocated to the Digital Europe Programme, supporting projects aimed at - among others - the re-skilling and upskilling of the current workforce.