Changes from plenary report to adopted text

Removed(i) the European Union Agency for Cybersecurity;

Removed(ia) the European Cybersecurity Competence Centre;

Removed(ii) the European Data Protection Board;

Removed(iii) European standardisation bodies.

RemovedWhere needed, representatives of other Union Agencies may be invited.

Removed(b) experts representing relevant economic operators, ensuring the adequate representation of microenterprises and small and medium-sized enterprises;

Removed(c) experts representing civil society, including consumer organisations and the free and open-source community;

Removed(d) experts appointed in a personal capacity, who have proven knowledge and experience in the areas covered by this Regulation;

Removed(e) experts representing academia, including universities, research institutes and other scientific organisations, including persons with global expertise.

Removed2. The Expert Group shall advise the Commission with regard to the following:

Removed(a) the list of critical products with digital elements set out in Annex III, as well as on the possible need to update that list;

Removed(b) the implementation of European cybersecurity certification schemes pursuant to Regulation (EU) 2019/881 and on the possibility to make them mandatory for highly critical products with digital elements;

Removed(c) non-binding evaluations of products with digital elements upon request by a market surveillance authority that is conducting an investigation under Article 43;

Removed(d) the application of relevant concepts of the new legislative framework to software, in particular free and open-source software;

Removed(e) the elements of the Regulation to be addressed by the guidelines referred to in Article 17a;

Removed(f) the availability and the quality of European and international standards, and the possibility to supplement or replace them with common technical specifications;

Removed(g) the availability of skilled professionals in the field of cybersecurity across the Union, including of adequate personnel to perform third-party conformity assessments pursuant to this Regulation;

Removed(h) the possible need to amend this Regulation.

RemovedThe Expert Group shall also map trends at Union and Member State level regarding existing and patched vulnerabilities.

Removed3. The Expert Group shall take into account the views of a wide range of stakeholders and perform their tasks with highest level of professionalism, independence, impartiality and objectivity.

Removed3a. The Commission shall consult the Expert Group when preparing delegated or implementing acts based upon this Regulation.

Removed3b. The Expert Group may provide market surveillance authorities with non-binding evaluations of products with digital elements to facilitate investigations under Article 43.

Removed4. The Expert Group shall be chaired by the Commission and shall be constituted in accordance with the horizontal rules on the creation and operation of Commission expert groups. In that context, the Commission may invite experts with specific expertise on an ad hoc basis.

Removed5. The Expert Group shall carry out its tasks in accordance with the principle of transparency. The Commission shall publish the composition of the Expert Group, the declaration of interests of its members, a summary of the meetings of the Expert Group and other relevant documents on the Commission website.

RemovedFor the purpose of this Regulation and in order to respond to the demand of professionals capable of ensuring the cybersecurity of products with digital elements, the Commission and Member States, in cooperation with ENISA, shall ensure the implementation of:

Removed(a) education and training programmes in the cyber security field and their associated career pathways, contributing to making the cyber security workforce more resilient and inclusive, also in terms of gender and aligned with the needs of undertakings concerned, in particular where such undertakings are microenterprises, small or medium-sized enterprises, including start-ups, or public administration;

Removed(b) initiatives to increase the collaboration between the private sector, economic operators, including via re-skilling or up-skilling for manufacturers’ employees, consumers, education and training providers as well as Member States, expanding the options for young people to access jobs in this sector;

Removed(c) strategies aiming to enhance workforce mobility, developing cyber security skills and creating organisational and technological tools to maximise existent cyber security talent.

RemovedBy way of derogation from Article 2(1), third subparagraph, point (b), of Regulation (EU) 2023/988 where products with digital elements are not subject to specific requirements laid down in other Union harmonisation legislation within the meaning of [Article 3, point (25) of Regulation (EU) 2023/988, Chapter III, Section 1, Chapters V and VII, and Chapters IX to XI of Regulation (EU) 2023/988 shall apply to those products with respect to safety risks not covered by this Regulation.

Removed1. Products with digital elements classified as high-risk AI systems in accordance with Article [Article 6] of Regulation [the AI Regulation] which fall within the scope of this Regulation, and fulfil the essential requirements set out in Section 1 of Annex I of this Regulation, and where the processes put in place by the manufacturer are compliant with the essential requirements set out in Section 2 of Annex I, shall be deemed in compliance with the requirements related to cybersecurity set out in Article [Article 15] of Regulation [the AI Regulation], without prejudice to the other requirements related to accuracy and robustness included in the aforementioned Article, and in so far as the achievement of the level of protection required by those requirements is demonstrated by the EU declaration of conformity issued under this Regulation.

Removed2. For the products and cybersecurity requirements referred to in paragraph 1, the relevant conformity assessment procedure as required by Article [Article 43] of Regulation [AI Regulation] shall apply. For the purpose of that assessment, relevant bodies which are entitled to control the conformity of the high-risk AI systems under the Regulation [AI Regulation] shall be also entitled to control the conformity of the high-risk AI systems that fall within the scope of this Regulation with the requirements set out in Annex I to this Regulation, provided that the compliance of those notified bodies with the requirements laid down in Article 29 of this Regulation have been assessed in the context of the notification procedure under Regulation [AI Regulation].

Removed3. By derogation from paragraph 2, critical products with digital elements listed in Annex III of this Regulation, which have to apply the conformity assessment procedures referred to in Articles 24(2)(a), 24(2)(b), 24(3)(a) and 24(3)(b) under this Regulation and which are also classified as high-risk AI systems according to Article [Article 6] of the Regulation [AI Regulation] and to which the conformity assessment procedure based on internal control referred to in Annex [Annex VI] to Regulation [the AI Regulation] applies, shall be subject to the conformity assessment procedures as required by this Regulation in so far as the essential requirements of this Regulation are concerned.

Removed3a. Manufacturers of products with digital elements classified as high-risk AI systems in accordance with paragraph 1 of this Article may participate in the AI regulatory sandboxes referred to in Article 53 of Regulation [the AI Regulation].

RemovedMachinery products that fall within the scope of Regulation (EU) 2023/1230 which are products with digital elements or partly completed products with digital elements within the meaning of this Regulation and for which an EU declaration of conformity has been issued on the basis of this Regulation shall be deemed to be in conformity with the essential health and safety requirements set out in Annex [Annex III, Sections 1.1.9 and 1.2.1] to Regulation (EU) 2023/1230, as regards protection against corruption and safety and reliability of control systems, and in so far as the achievement of the level of protection required by those requirements is demonstrated in the EU declaration of conformity issued under this Regulation.

Removed1. Without prejudice to Directives 2014/24/EU and 2014/25/EU of the European Parliament and of the Council, Member States shall ensure, when procuring products with digital elements, a high level of cybersecurity and an appropriate support period.

Removed2. Member States shall ensure that manufacturers remedy vulnerabilities in publicly procured products with digital elements, including by making security updates available promptly.

RemovedOBLIGATIONS OF ECONOMIC OPERATORS

Removed1. When placing a product with digital elements on the market, manufacturers shall ensure that it has been designed, developed and produced in accordance with the essential requirements set out in Section 1 of Annex I.

Removed2. For the purposes of complying with the obligation laid down in paragraph 1, manufacturers shall undertake an assessment of the cybersecurity risks associated with a product with digital elements and take the outcome of that assessment into account during the planning, design, development, production, delivery and maintenance phases of the product with digital elements with a view to minimising cybersecurity risks, preventing security incidents and minimising the impacts of such incidents, including in relation to the health and safety of users.

Removed2a. On the basis of the cybersecurity risk assessment, manufacturers shall determine how the essential requirements set out in Section 1 of Annex I are applicable to their product with digital elements. They shall include the risk assessment in the technical documentation as set out in Article 23.3. When placing a product with digital elements on the market, the manufacturer shall include a cybersecurity risk assessment in the technical documentation as set out in Article 23 and Annex V. For products with digital elements referred to in Articles 8 and 24(4) that are also subject to other Union acts, the cybersecurity risk assessment may be part of the risk assessment required by those respective Union acts. Where certain essential requirements are not applicable to the marketed product with digital elements, the manufacturer shall include a clear justification in that documentation.

Removed4. For the purposes of complying with the obligation laid down in paragraph 1, manufacturers shall exercise due diligence when integrating components sourced from third parties in products with digital elements. It falls upon the manufacturer to ensure that such components do not compromise the security of the product with digital elements, including when integrating components of free and open-source software that have not been made available on the market in the course of a commercial activity.

RemovedManufacturers shall, upon identifying a vulnerability in a component, including in a free and open-source component, which is integrated in the product with digital elements, address and remediate the vulnerability in accordance with the vulnerability handling requirements set out in Annex I, Section 2, and share the corrective measures taken with the person or entity maintaining the component.

Removed4a. The manufacturer of components shall provide to the manufacturer of the final product with digital elements the information and documentation necessary to comply with the requirements of this Regulation, when supplying them with such components. This information shall be provided free of charge.

Removed5. The manufacturer shall systematically document, in a manner that is proportionate to the nature and the cybersecurity risks, relevant cybersecurity aspects concerning the product with digital elements, including vulnerabilities they become aware of and any relevant information provided by third parties, and, where applicable, update the risk assessment of the product.

Removed6. When placing a product with digital elements on the market, manufacturers shall determine the support period during which vulnerabilities of that product are handled effectively and in accordance with the essential requirements set out in Section 2 of Annex I. In doing so, the manufacturer shall ensure that the support period is proportionate to the expected product lifetime as well as in line with the nature of the product and users’ expectations, the availability of the operating environment and, where applicable, the support period of the main components integrated into the product with digital elements. To that end manufacturers shall make available upon request of market surveillance authorities information on the expected product lifetime they considered in order to determine the duration of the support period for the product made available on the market. Market surveillance authorities shall monitor products with digital elements and ensure actively that manufacturers have applied these criteria in an adequate manner, including an assessment of the information received from the manufacturers on the expected product lifetime, when determining the support period.

RemovedWhere applicable, the support period shall be clearly stated on the product, its packaging or be included in contractual agreements. In any case, end users shall also be informed before purchase of the duration of the support period.

RemovedManufacturers shall have appropriate policies and procedures, including coordinated vulnerability disclosure policies, referred to in Section 2, point (5), of Annex I, to process and remediate potential vulnerabilities in the product with digital elements reported from internal or external sources.

RemovedWhere applicable, for consumer products with digital elements, those procedures shall include automatic security updates by default. Users should retain the possibility of de-activating those automatic security updates.

RemovedManufacturers shall actively inform users when their product with digital elements has reached the end of its support period.

Removed6a Where the support period is shorter than five years and the handling of vulnerabilities has ended, manufacturers may provide access to the source code of such a product with digital elements to other undertakings which commit to extending the provision of vulnerability handling services, in particular security updates. Access to such source codes shall be provided only where provided for in a contractual arrangement. Those arrangements shall protect the ownership of the product with digital elements and shall prevent the dissemination of the source code to the public, except where such code has already been provided under a free and open-source licence.

Removed7. Before placing a product with digital elements on the market, manufacturers shall draw up the technical documentation referred to in Article 23.

RemovedThey shall carry out the chosen conformity assessment procedures referred to in Article 24 or have them carried out.

RemovedWhere compliance of the product with digital elements with the essential requirements set out in Section 1 of Annex I and of the processes put in place by the manufacturer with the essential requirements set out in Section 2 of Annex I has been demonstrated by that conformity assessment procedure, manufacturers shall draw up the EU declaration of conformity in accordance with Article 20 and affix the CE marking in accordance with Article 22.

Removed8. Manufacturers shall keep the technical documentation and the EU declaration of conformity▌at the disposal of the market surveillance authorities for at least ten years or the support period, whichever is longer, after the product with digital elements has been placed on the market.

RemovedMarket surveillance authorities shall ensure the confidentiality and appropriate protection of the information in the technical documentation provided by manufacturers in accordance with Article 52.

Removed9. Manufacturers shall ensure that procedures are in place for products with digital elements that are part of a series of production to remain in conformity. The manufacturer shall adequately take into account changes in the development and production process or in the design or characteristics of the product with digital elements and changes in the harmonised horizontal or sector specific standards, European cybersecurity certification schemes or the common specifications referred to in Article 19 by reference to which the conformity of the product with digital elements is declared or by application of which its conformity is verified.

Removed10. Manufacturers shall ensure that products with digital elements are accompanied by the information and instructions set out in Annex II, in an electronic or physical form. Such information and instructions shall be in a language which can be easily understood by users. They shall be clear, understandable, intelligible and legible. They shall allow for a secure installation, operation and use of the products with digital elements.

RemovedWhere such information and instructions are provided in electronic form, manufacturers shall:

Removed(a) present them in a user-friendly format that makes it possible for the user to consult them online, download them, save them on an electronic device and print them;

Removed(b) ensure that they are accessible online during at least the support period of the product with digital elements.