Changes from plenary report to adopted text

RemovedDRAFT EUROPEAN PARLIAMENT LEGISLATIVE RESOLUTION

AddedCyber Resilience Act

Removedon the proposal for a regulation of the European Parliament and of the Council on horizontal cybersecurity requirements for products with digital elements and amending Regulation (EU) 2019/1020

AddedCommittee on Industry, Research and Energy

Removed(COM(2022)0454 – C90308/2022 – 2022/0272(COD))

AddedPE745.538

AddedEuropean Parliament legislative resolution of 12 March 2024 on the proposal for a regulation of the European Parliament and of the Council on horizontal cybersecurity requirements for products with digital elements and amending Regulation (EU) 2019/1020 (COM(2022)0454 – C9-0308/2022 – 2022/0272(COD))

▸6 unchanged paragraphs

(Ordinary legislative procedure: first reading)

The European Parliament,

– having regard to the Commission proposal to Parliament and the Council (COM(2022)0454),

– having regard to Article 294(2) and Article 114 of the Treaty on the Functioning of the European Union, pursuant to which the Commission submitted the proposal to Parliament (C90308/2022),

– having regard to Article 294(3) of the Treaty on the Functioning of the European Union,

– having regard to the opinion of the European Economic and Social Committee of 14 December 2022,

Added– having regard to the provisional agreement approved by the committee responsible under Rule 74(4) of its Rules of Procedure and the undertaking given by the Council representative by letter of 20 December 2023 to approve Parliament’s position, in accordance with Article 294(4) of the Treaty on the Functioning of the European Union,

▸4 unchanged paragraphs

– having regard to Rule 59 of its Rules of Procedure,

– having regard to the opinion of the Committee on the Internal Market and Consumer Protection,

– having regard to the report of the Committee on Industry, Research and Energy (A9-0253/2023),

1. Adopts its position at first reading hereinafter set out;

Change 1

Removed2. Requests the Commission to modify the financial statement accompanying the proposal by increasing the establishment plan of the European Union Agency for Cybersecurity (ENISA) by 9.0 additional full-time posts and by providing corresponding additional appropriations in order to ensure that the obligations of ENISA under this Regulation can be fulfilled and not to compromise existing obligations of the Agency under other Union legislation;

Added2. Approves the joint statement by Parliament, the Council and the Commission annexed to this resolution, which will be published in the C series of the Official Journal of the European Union;

3. Calls on the Commission to refer the matter to Parliament again if it replaces, substantially amends or intends to substantially amend its proposal;

4. Instructs its President to forward its position to the Council, the Commission and the national parliaments.

Change 2

RemovedAMENDMENTS BY THE EUROPEAN PARLIAMENT*

AddedP9_TC1-COD(2022)0272

Removedto the Commission proposal

AddedPosition of the European Parliament adopted at first reading on 12 March 2024 with a view to the adoption of Regulation (EU) 2024/… of the European Parliament and of the Council on horizontal cybersecurity requirements for products with digital elements and amending Regulations (EU) No 168/2013 and (EU) 2019/1020 and Directive (EU) 2020/1828 (Cyber Resilience Act)

Removed---------------------------------------------------------

Added(As an agreement was reached between Parliament and Council, Parliament's position corresponds to the final legislative act, Regulation (EU) 2024/2847.)

RemovedProposal for a

AddedANNEX TO THE LEGISLATIVE RESOLUTION

RemovedREGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

AddedJoint political statement by the European Parliament, the Council and the Commission on ENISA resources, on the occasion of the adoption of Regulation (EU) 2024/2847 of the European Parliament and of the Council on horizontal cybersecurity requirements for products with digital elements, amending Regulations (EU) No 168/2013 and (EU) 2019/1020 and Directive (EU) 2020/1828 (Cyber Resilience Act)

Removedon horizontal cybersecurity requirements for products with digital elements and amending Regulation (EU) 2019/1020 and Directive 2020/1828/EC (Cyber Resilience Act)

AddedThe European Parliament and the Council consider that this Regulation confers additional tasks on ENISA which result in additional workload and would require additional resources in terms of both expertise and number. In view of this, in order to enable ENISA to effectively carry out the tasks under this Regulation, the European Parliament, the Council and the Commission consider that an increase in its resources, in particular its human resources with the adequate expertise, may be necessary. Such increase could be provided for in the annual procedure related to the establishment plan of ENISA. Accordingly, the Commission, which is responsible for entering in the draft general budget of the Union the estimates it deems to be necessary for ENISA’s establishment plan, in the framework of the budgetary procedure set out in Article 314 TFEU and in accordance the procedure set out in the Cybersecurity Act, shall assess the estimates for the establishment plan of ENISA entered for the first year after entry into force of this Regulation in consideration of the necessary resources, in particular human resources, to enable ENISA to adequately carry out its tasks under this Regulation.

Removed(Text with EEA relevance)

RemovedTHE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,

RemovedHaving regard to the Treaty on the Functioning of the European Union, and in particular Article 114 thereof,

RemovedHaving regard to the proposal from the European Commission,

RemovedAfter transmission of the draft legislative act to the national parliaments,

RemovedHaving regard to the opinion of the European Economic and Social Committee,

RemovedHaving regard to the opinion of the Committee of the Regions,

RemovedActing in accordance with the ordinary legislative procedure,

RemovedWhereas:

Removed(1) Cybersecurity is one of the key challenges for the Union and the number and variety of connected devices will rise exponentially in the coming years. Cyberattacks represent a matter of public interest as they have a critical impact not just on the Union’s economy, but also on democracy and consumer safety and health. It is therefore necessary to strengthen the Union’s approach to cybersecurity, address cyber resilience at Union level and improve the functioning of the internal market by laying down a uniform legal framework for essential cybersecurity requirements for placing products with digital elements on the Union market. Two major problems adding costs for users and society should be addressed: a low level of cybersecurity of products with digital elements, reflected by widespread vulnerabilities and the insufficient and inconsistent provision of security updates to address them, and an insufficient understanding and access to information by users, preventing them from choosing products with adequate cybersecurity properties or using them in a secure manner.

Removed(2) This Regulation aims to set the boundary conditions for the development of secure products with digital elements by ensuring that hardware and software products are placed on the market with fewer vulnerabilities and that manufactures take security seriously throughout a product’s life cycle. It also aims to create conditions allowing users to take cybersecurity into account when selecting and using products with digital elements, for example by improving transparency with regard to the support period of products placed on the market.

Removed(3) The relevant Union legislation that is currently in force comprises several sets of horizontal rules that address certain aspects linked to cybersecurity from different angles, including measures to improve the security of the digital supply chain. However, the existing Union legislation related to cybersecurity, including Regulation (EU) 2019/881 of the European Parliament and of the Council and Directive (EU) 2022/2555 of the European Parliament and of the Council does not directly cover mandatory requirements for the security of products with digital elements.

Removed(4) While the existing Union legislation applies to certain products with digital elements, there is no horizontal Union regulatory framework establishing comprehensive cybersecurity requirements for all products with digital elements. The various acts and initiatives taken thus far at Union and national levels only partially address the identified cybersecurity-related problems and risks, creating a legislative patchwork within the internal market, increasing legal uncertainty for both manufacturers and users of those products and adding an unnecessary burden on undertakings and organisations to comply with a number of requirements for similar types of products. The cybersecurity of these products has a particularly strong cross-border dimension, as products manufactured in one country are often used by organisations and consumers across the entire internal market. This makes it necessary to regulate the field at Union level, to ensure a harmonised and clear regulatory framework for undertakings, particularly micro, small and medium-sized enterprises. The Union regulatory landscape should be harmonised by introducing cybersecurity requirements for products with digital elements. In addition, certainty for operators and users should be ensured across the Union, as well as a better harmonisation of the single market and proportionality for microenterprises and small and medium-sized enterprises, creating more viable conditions for economic operators aiming at entering the Union market.

Removed(4a) The horizontal nature of this Regulation means that it will have an impact on very different segments of the Union's economy. It is therefore important that the specificities of each sector are taken into account and that the cybersecurity requirements laid down in this Regulation are proportional to the risks. The Commission should therefore issue guidelines which explain in a clear and detailed manner how to apply this Regulation. Guidelines should cover inter alia a detailed explanation of the scope, in particular the notion of remote data processing and the implications for free and open-source developers, the criteria used to determine how critical products with digital elements are classified and the interplay between this Regulation and other Union law.

Removed(4b) A business operating online may offer a variety of different services. Depending on the nature of services provided, the same entity may fall under several different categories of economic operators. Where an entity provides online intermediation services for a product with digital elements and is a provider of an online marketplace, as defined in Article 3(14) of Regulation 2023/988 of the European Parliament and of the Council, it does not qualify as an economic operator as defined in this Regulation. Where the same entity is a provider of an online marketplace and acts as an economic operator as defined in this Regulation, for the sale of products with digital elements, it should be subject to the scope of this Regulation with regard to such products. The provisions of Regulation (EU) 2023/988 is fully applicable to this Regulation. Given the prominent role that online marketplaces have in enabling electronic commerce, they should strive to cooperate with the market surveillance authorities of the Member States in order to ensure that products purchased through online marketplaces comply with the cybersecurity requirements laid down in this Regulation.

Removed(5) At Union level, various programmatic and political documents, such as the EU’s Cybersecurity Strategy for the Digital Decade, the Council Conclusions of 2 December 2020 and of 23 May 2022 or the Resolution of the European Parliament of 10 June 2021, have called for specific Union cybersecurity requirements for digital or connected products, with several countries around the world introducing measures to address this issue on their own initiative. In the final report of the Conference on the Future of Europe, citizens called for “a stronger role for the EU in countering cybersecurity threats”. In order for the Union to play a leading international role in the field of cybersecurity, it is important to establish an ambitious overarching regulatory framework.

Removed(6) To increase the overall level of cybersecurity of all products with digital elements placed on the internal market, it is necessary to introduce objective-oriented and technology-neutral essential cybersecurity requirements for these products that apply horizontally.

Removed(7) Under certain conditions, all products with digital elements integrated in or connected to a larger electronic information system can serve as an attack vector for malicious actors. As a result, even hardware and software considered as less critical can facilitate the initial compromise of a device or network, enabling malicious actors to gain privileged access to a system or move laterally across systems. Manufacturers should therefore ensure that all connectable products with digital elements are designed and developed in accordance with essential requirements laid down in this Regulation. This includes both products that can be connected physically via hardware interfaces and products that are connected logically, such as via network sockets, pipes, files, application programming interfaces or any other types of software interface. As cybersecurity threats can propagate through various products with digital elements before reaching a certain target, for example by chaining together multiple vulnerability exploits, manufacturers should also ensure the cybersecurity of those products that are only indirectly connected to other devices or networks.

Removed(8) By setting cybersecurity requirements for placing on the market products with digital elements, the cybersecurity of these products for consumers and for businesses alike will be enhanced. This also includes requirements for placing on the market consumer products with digital elements intended for vulnerable consumers, such as toys and baby monitors. Those requirements will also ensure that cybersecurity is taken into account throughout supply chains, making final products with digital elements more secure. This will, in turn, represent a competitive advantage for manufacturers established or represented in the Union, which will be able to advertise the cybersecurity of their products.

Removed(9) This Regulation ensures a high level of cybersecurity of products with digital elements and their integrated remote data processing solutions. Such remote data processing solutions relating to a product with digital elements are defined as any data processing at a distance for which the software is designed and developed by or on behalf of the manufacturer of the product concerned ▌, and the absence of which would prevent such a product with digital elements from performing one of its functions. For example, cloud enabled functionalities provided by the manufacturer of smart home devices that enable users to control the device at a distance, should fall within the scope of this Regulation. On the other hand, websites not inextricably linked to a product with digital elements or cloud services outside the responsibility of the manufacturer should not to be considered to be remote data processing solutions under this Regulation. Directive (EU) 2022/2555 puts in place cybersecurity and incident reporting requirements for essential and important entities, such as critical infrastructure, with a view to increasing the resilience of the services they provide. While Directive (EU) 2022/2555 applies to cloud computing services and cloud service models, and this Regulation does not apply to services, such as Software-as-a-Service (SaaS), Platform-as-a-Service (PaaS) or Infrastructure-as-a-Service (IaaS), they may fall within the scope of this Regulation to the extent they meet the definition of remote data processing solutions. ▌

Removed(9a) Software and data that are openly shared and where users can freely access, use, modify and redistribute them or modified versions thereof, can contribute to research and innovation in the market. Research by the European Commission also shows that free and open-source software can contribute between EUR 65 billion to EUR 95 billion to the Union’s GDP and that it can provide significant growth opportunities for the Union’s economy. Users are allowed to run, copy, distribute, study, change and improve software and data, including models by way of free and open-source licences. To foster the development and deployment of free and open-source software, in particular by microenterprises and small, medium-sized enterprises, including start-ups, and not-for-profit organisations, academic research and individuals, this Regulation should apply to free and open-source software products in specific cases, to take into account the fact that different development models of software distributed and developed under public licences exist.

Removed(10) Only free and open-source software made available on the market in the course of a commercial activity should ▌be covered by this Regulation. ▌ Whether a free and open-source product has been made available as part of a commercial activity should be assessed on a product-by-product basis, looking at both the development model and the supply phase of the free and open-source product with digital elements.

Removed(10a) For example, a fully decentralised development model, where no single commercial entity exercises control over what is accepted into the project’s code base, should be taken as an indication that the product has been developed in a non-commercial setting. On the other hand, where free and open-source software is developed by a single organisation or an asymmetric community, where a single organisation is generating revenues from related use in business relationships, this should be considered to be a commercial activity. Similarly, where the main contributors to free and open-source projects are developers employed by commercial entities and when such developers or the employer can exercise control as to which modifications are accepted in the code base, the project should generally be considered to be of a commercial nature.

Removed(10b) With regard to the supply phase, in the context of free and open-source software, a commercial activity might be characterized not only by charging a price for a product, but also by charging a price for technical support services, when this does not serve only for the recuperation of actual costs, by providing a software platform through which the manufacturer monetises other services, or by the use of personal data for reasons other than exclusively for improving the security, compatibility or interoperability of the software. Accepting donations without the intention of making a profit should not be considered to be a commercial activity, unless such donations are made by commercial entities and are recurring in nature.

Removed(10c) Developers contributing individually to free and open-source projects should not be subject to obligations pursuant to this Regulation.

Removed(10d) The sole act of hosting free and open-source software on open repositories does not in itself constitute making available on the market of a product with digital elements. As such, most package managers, code hosting and collaboration platforms should not be considered to be distributors within the meaning of this Regulation.