On the proposal for a regulation of the European Parliament and of the Council on Horizontal cybersecurity requirements for products with digital elements and amending Regulation (EU) 2019/1020
As the former Rapporteur for opinion in the IMCO Committee on the NIS2 Directive, the Rapporteur sees the Cyber Resilience Act as a crucial and natural next step to improve the cybersecurity of the European Union. Being mindful that by definition cyber security will never be 100 per cent complete, the Rapporteur is of the opinion that it is important that everything within our power is done to decrease the number of weak links in our Union, and for this the Cyber Resilience Act is a welcomed next step. We need to increase the cybersecurity of the products with digital elements and other new products such as IoT devices that have become natural parts of the everyday lives of European consumers and businesses.
As the IMCO Committee is responsible for the functioning and implementation of the Single Market, including the Digital Single Market, and rules on consumer protection, the Rapporteur sought to introduce amendments that aim to improve the functioning of the internal market, while providing for a high level of consumer protection within the scope of the proposal, specifically with regard to cybersecurity requirements for products with digital elements.
Furthermore, the Rapporteur believes that some aspects of the proposed Regulation require improvement to ensure legal clarity and coherence between the relevant provisions of the proposed Regulation and other pieces of legislation. This relates in particular to the NIS2 Directive, the recently adopted General Product Safety Regulation, the Artificial Intelligence Regulation, and the Machinery Regulation, as well as a number of relevant delegated and implementing acts. Therefore, the Rapporteur proposed amendments that aim to improve legal clarity and help to ensure coherent, effective and consistent interpretation and application of the mentioned legislations.
Moreover, as micro, small and medium sized enterprises are crucial economic players in the digital market, the Rapporteur introduced a number of amendments to simplify administrative procedures and limit the administrative burden on small businesses, without lowering the level of safety. Furthermore, the Rapporteur introduced amendments that ensure that micro-enterprises and SMEs, will be provided with specific guidance and advice in complying with the requirements in the Cyber Resilience Act.
Finally, the Rapporteur has introduced amendments with the aim of ensuring more efficient communication with competent authorities (national market surveillance authorities, ENISA), as well as strengthening the provisions for the obligations and competences of relevant authorities with regards to complaints, inspections and joint activities. Further to this the some amendments by the Rapporteur focus on improving the cybersecurity requirements for components integrated into final products with digital elements, specifying the obligations of economic operators, such as manufacturers and authorised representatives.
The Rapporteur reiterates the position that the introduction of the Cyber Resilience Act is a timely and natural next step to tighten the net around cybersecurity threats in our Union. With the suggested amendments, the Rapporteur has sought to find the right balance between ensuring an increased level of cybersecurity to the benefit of European consumers with a proportionate burden on the business community. It is the ambition of the Rapporteur that cybersecurity will become a natural parameter of competition in the internal market. It is with this in mind, that the Rapporteur has sought to adjust the proposal.
The Committee on the Internal Market and Consumer Protection calls on the Committee on Industry, Research and Energy, as the committee responsible, to take into account the following amendments:
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission(15) Delegated Regulation (EU) 2022/30 specifies that the essential requirements set out in Article 3(3), point (d) (network harm and misuse of network resources), point (e) (personal data and privacy) and point (f) (fraud) of Directive 2014/53/EU apply to certain radio equipment. [Commission implementation decision XXX/2022 on a standardisation request to the European Standardisation Organisations] lays down requirements for the development of specific standards further specifying how these three essential requirements should be addressed. The essential requirements laid down by this Regulation include all the elements of the essential requirements referred to in Article 3(3), points (d), (e) and (f) of Directive 2014/53/EU. Further, the essential requirements laid down in this Regulation are aligned with the objectives of the requirements for specific standards included in that standardisation request. Therefore, if the Commission repeals or amends Delegated Regulation (EU) 2022/30 with the consequence that it ceases to apply to certain products subject to this Regulation, the Commission and the European Standardisation Organisations should take into account the standardisation work carried out in the context of Commission Implementing Decision C(2022)5637 on a standardisation request for the RED Delegated Regulation 2022/30 in the preparation and development of harmonised standards to facilitate the implementation of this Regulation.
Amendment(15) Delegated Regulation (EU) 2022/30 specifies that the essential requirements set out in Article 3(3), point (d) (network harm and misuse of network resources), point (e) (personal data and privacy) and point (f) (fraud) of Directive 2014/53/EU apply to certain radio equipment. [Commission implementation decision XXX/2022 on a standardisation request to the European Standardisation Organisations] lays down requirements for the development of specific standards further specifying how these three essential requirements should be addressed. The essential requirements laid down by this Regulation include all the elements of the essential requirements referred to in Article 3(3), points (d), (e) and (f) of Directive 2014/53/EU. Further, the essential requirements laid down in this Regulation are aligned with the objectives of the requirements for specific standards included in that standardisation request. Therefore, when the Commission repeals the Delegated Regulation (EU) 2022/30 with the consequence that it ceases to apply to certain products subject to this Regulation, the Commission and the European Standardisation Organisations should take into account the standardisation work carried out in the context of Commission Implementing Decision C(2022)5637 on a standardisation request for the RED Delegated Regulation 2022/30 in the preparation and development of harmonised standards to facilitate the implementation of this Regulation.
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission
Amendment(56a) In order for economic operators that are SMEs and micro-businesses to be able to cope with the new obligations imposed by this Regulation, the Commission should provide them with guidelines and advice, for example, via a direct channel to connect to experts in case of questions, taking into account the need to simplify and limit the administrative burdens.
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the CommissionThis Regulation lays down:
AmendmentThe objective of this Regulation is to improve the functioning of the internal market while providing for a high level of consumer protection.
Text proposed by the Commission
AmendmentThis Regulation lays down harmonised rules on:
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission(18) ‘manufacturer’ means any natural or legal person who develops or manufactures products with digital elements or has products with digital elements designed, developed or manufactured, and markets them under his or her name or trademark, whether for payment or free of charge;
Amendment(18) ‘manufacturer’ means any natural or legal person who develops or manufactures products with digital elements or has products with digital elements designed, developed or manufactured, and markets them under its name or trademark, whether for payment or free of charge;
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission(19) ‘authorised representative’ means any natural or legal person established within the Union who has received a written mandate from a manufacturer to act on his or her behalf in relation to specified tasks;
Amendment(19) ‘authorised representative’ means any natural or legal person established within the Union who has received a written mandate from a manufacturer to act on its behalf in relation to specified tasks with regard to the manufacturer's obligations;
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission(26) ‘reasonably foreseeable misuse’ means the use of a product with digital elements in a way that is not in accordance with its intended purpose, but which may result from reasonably foreseeable human behaviour or interaction with other systems;
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission(31) ‘substantial modification’ means a change to the product with digital elements following its placing on the market, which affects the compliance of the product with digital elements with the essential requirements set out in Section 1 of Annex I or results in a modification to the intended use for which the product with digital elements has been assessed;
Amendment(31) ‘substantial modification’ means a change to the product with digital elements excluding security and maintenance updates following its placing on the market, which affects the compliance of the product with digital elements with the essential requirements set out in Section 1 of Annex I or results in a modification to the intended use for which the product with digital elements has been assessed;
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission2. At trade fairs, exhibitions and demonstrations or similar events, Member States shall not prevent the presentation and use of a product with digital elements which does not comply with this Regulation.
Amendment2. At trade fairs, exhibitions and demonstrations or similar events, Member States shall not prevent the presentation and use of a product with digital elements which does not comply with this Regulation provided that the product with digital elements is used exclusively for presentation purposes within the course of the event and that a visible sign clearly indicates its non-compliance with this Regulation.
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission
Amendment3a. This Regulation shall not prevent Member States from subjecting products with digital elements to additional measures when these specific products will be used for military, defence or national security purposes, and such measures are necessary and proportionate for achievement of those purposes.
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission1. Products with digital elements that belong to a category which is listed in Annex III shall be considered critical products with digital elements. Products which have the core functionality of a category that is listed in Annex III to this Regulation shall be considered as falling into that category. Categories of critical products with digital elements shall be divided into class I and class II as set out in Annex III, reflecting the level of cybersecurity risk related to these products.
Amendment1. Products with digital elements that belong to a category which is listed in Annex III shall be considered critical products with digital elements. Only products which have the core functionality of a category that is listed in Annex III to this Regulation shall be considered as falling into that category. Categories of critical products with digital elements shall be divided into class I and class II as set out in Annex III, reflecting the level of cybersecurity risk related to these products. Integrating a component of higher class of criticality into a product of lower criticality does not change the level of criticality for the product the component is integrated into.
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission
AmendmentThis Regulation is designed in such a way that all products covered by the essential requirements laid down in Article 3(3), points (d), (e) and (f) of Directive 2014/53/EU as described in the delegated regulation (EU) 2022/30 comply with this Regulation. To generate legal certainty the delegated regulation (EU) 2022/30 will be repealed when this Regulation comes into force.
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission1. When placing a product with digital elements on the market, manufacturers shall ensure that it has been designed, developed and produced in accordance with the essential requirements set out in Section 1 of Annex I.
Amendment1. When placing a product with digital elements on the market, manufacturers shall ensure that it has been designed, developed and manufactured in accordance with the general safety requirements laid down in Article 5 of the Regulation on general product safety and with the essential requirements set out in Section 1 of Annex I.
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission4. For the purposes of complying with the obligation laid down in paragraph 1, manufacturers shall exercise due diligence when integrating components sourced from third parties in products with digital elements. They shall ensure that such components do not compromise the security of the product with digital elements.
Amendment4. For the purposes of complying with the obligation laid down in paragraph 1, manufacturers shall exercise due diligence when integrating components sourced from third parties in products with digital elements. They shall ensure that such components do not compromise the security of the product with digital elements and that the appropriate conformity assessment procedure has been carried out by the components manufacturers.
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission
Amendment4a. The components manufacturers shall provide the information and documentation necessary to comply with the requirements of this Regulation, when supplying such components to the manufacturer of finished products. This informations shall be provided free of charge.
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the CommissionWhen placing a product with digital elements on the market, and for the expected product lifetime or for a period of five years from the placing of the product on the market, whichever is shorter, manufacturers shall ensure that vulnerabilities of that product are handled effectively and in accordance with the essential requirements set out in Section 2 of Annex I.
AmendmentWhen placing a product with digital elements on the market, and for the expected product lifetime or for a period of five years from the placing of the product on the market, whichever is longer, manufacturers shall ensure that vulnerabilities of that product are handled effectively and in accordance with the essential requirements set out in Section 2 of Annex I, provided that it is within the manufacturer's control.
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission
AmendmentWhere software updates are implemented, the manufacturer shall not be required to carry out another conformity assessment of the product with digital elements, unless the software update results in a substantial modification of the product with digital elements within the meaning of Article 3(31) of this Regulation.
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission10. Manufacturers shall ensure that products with digital elements are accompanied by the information and instructions set out in Annex II, in an electronic or physical form. Such information and instructions shall be in a language which can be easily understood by users. They shall be clear, understandable, intelligible and legible. They shall allow for a secure installation, operation and use of the products with digital elements.
Amendment10. Manufacturers shall ensure that products with digital elements are accompanied by the safety information and instructions set out in Annex II, in an electronic or physical form. Such information and instructions shall be in a language which can be easily understood by users. They shall be clear, understandable, intelligible and legible. They shall allow for a secure installation, operation and use of the products with digital elements.
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission12. From the placing on the market and for the expected product lifetime or for a period of five years after the placing on the market of a product with digital elements, whichever is shorter, manufacturers who know or have reason to believe that the product with digital elements or the processes put in place by the manufacturer are not in conformity with the essential requirements set out in Annex I shall immediately take the corrective measures necessary to bring that product with digital elements or the manufacturer’s processes into conformity, to withdraw or to recall the product, as appropriate.
Amendment12. From the placing on the market and for the expected product lifetime or for a period of five years after the placing on the market of a product with digital elements, whichever is longer, manufacturers who know or have reason to believe that the product with digital elements or the processes put in place by the manufacturer are not in conformity with the essential requirements set out in Annex I shall immediately take the corrective measures necessary to bring that product with digital elements or the manufacturer’s processes into conformity, to withdraw or to recall the product, as appropriate.
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission1. The manufacturer shall, without undue delay and in any event within 24 hours of becoming aware of it, notify to ENISA any actively exploited vulnerability contained in the product with digital elements. The notification shall include details concerning that vulnerability and, where applicable, any corrective or mitigating measures taken. ENISA shall, without undue delay, unless for justified cybersecurity risk-related grounds, forward the notification to the CSIRT designated for the purposes of coordinated vulnerability disclosure in accordance with Article [Article X] of Directive [Directive XXX/XXXX (NIS2)] of Member States concerned upon receipt and inform the market surveillance authority about the notified vulnerability.
Amendment1. The manufacturer shall, without undue delay and in any event within 24 hours of becoming aware of it, notify ENISA, by means of an early warning, of any actively exploited vulnerability contained in the product with digital elements.
Text proposed by the Commission
AmendmentThe manufacturer shall without undue delay and in any event within 72 hours of becoming aware of exploited vulnerability contained in the product with digital elements further notify ENISA more details on the exploited vulnerability. The notification shall include details concerning that vulnerability and, where applicable, any corrective or mitigating measures taken. ENISA shall, without undue delay, unless for justified cybersecurity risk-related grounds, forward the notification to the CSIRT designated for the purposes of coordinated vulnerability disclosure in accordance with Article [Article X] of Directive [Directive XXX/XXXX (NIS2)] of Member States concerned upon receipt and inform the market surveillance authority about the notified vulnerability.
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission
Amendment2a. Economic operators that are also identified as essential entities or important entities under the NIS2 and who submit their incident notification pursuant to the NIS2 should be deemed compliant with the requirements in point 2 of this Article.
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission4. The manufacturer shall inform, without undue delay and after becoming aware, the users of the product with digital elements about the incident and, where necessary, about corrective measures that the user can deploy to mitigate the impact of the incident.
Amendment4. The manufacturer shall inform, without undue delay and after becoming aware, the users of the product with digital elements about the significant incident and, where necessary, about corrective measures that the user can deploy to mitigate the impact of the significant incident.
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission
Amendment4a. The obligations laid down in paragraphs 1, 2 and 4 will apply during the product lifetime. During the minimum product lifetime period the manufacturer will provide security updates for free, which will apply only to products with digital elements for which the manufacturer has drawn up an EU declaration of conformity, in accordance with Article 20 of this Regulation.
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission5. The Commission may, by means of implementing acts, specify further the type of information, format and procedure of the notifications submitted pursuant to paragraphs 1 and 2. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 51(2).
Amendment5. The Commission may, by means of implementing acts, specify further the type of information, format and procedure of the notifications submitted pursuant to paragraphs 1 and 2. Those implementing acts shall be based on standard ISO/IEC 29157 and shall be adopted in accordance with the examination procedure referred to in Article 51(2).
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission3. An authorised representative shall perform the tasks specified in the mandate received from the manufacturer. The mandate shall allow the authorised representative to do at least the following:
Amendment3. An authorised representative shall perform the tasks specified in the mandate received from the manufacturer. It shall provide a copy of the mandate to the market surveillance authorities upon request. The mandate shall allow the authorised representative to do at least the following:
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission
Amendment(aa) where the authorised representative has a reason to believe that a product with digital elements in question presents a cybersecurity risk, inform the manufacturer;
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission(b) further to a reasoned request from a market surveillance authority, provide that authority with all the information and documentation necessary to demonstrate the conformity of the product with digital elements;
Amendment(b) further to a reasoned request from a market surveillance authority, provide that authority with all the information and documentation necessary to demonstrate the safety and the conformity of the product with digital elements in an official language which can be understood by that authority;
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission(c) cooperate with the market surveillance authorities, at their request, on any action taken to eliminate the risks posed by a product with digital elements covered by the authorised representative's mandate.
Amendment(c) cooperate with the market surveillance authorities, at their request, on any action taken to effectively eliminate the risks posed by a product with digital elements covered by the authorised representative's mandate.
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission(c) the product with digital elements bears the CE marking referred to in Article 22 and is accompanied by the information and instructions for use as set out in Annex II.
Amendment(c) the product with digital elements bears the CE marking referred to in Article 22 and is accompanied by the safety information and instructions for use as set out in Annex II.
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission3. Where an importer considers or has reason to believe that a product with digital elements or the processes put in place by the manufacturer are not in conformity with the essential requirements set out in Annex I, the importer shall not place the product on the market until that product or the processes put in place by the manufacturer have been brought into conformity with the essential requirements set out in Annex I. Furthermore, where the product with digital elements presents a significant cybersecurity risk, the importer shall inform the manufacturer and the market surveillance authorities to that effect.
Amendment3. Where an importer considers or has reason to believe, on the basis of the information at their disposal, that a product with digital elements or the processes put in place by the manufacturer are not in conformity with the essential requirements set out in Annex I, the importer shall not place the product on the market until that product or the processes put in place by the manufacturer have been brought into conformity with the essential requirements set out in Annex I. Furthermore, where the product with digital elements presents a significant cybersecurity risk, the importer shall inform the manufacturer and the market surveillance authorities to that effect.
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission4. Importers shall indicate their name, registered trade name or registered trademark, the postal address and the email address at which they can be contacted on the product with digital elements or, where that is not possible, on its packaging or in a document accompanying the product with digital elements. The contact details shall be in a language easily understood by users and market surveillance authorities.
Amendment4. Importers shall indicate their name, their registered trade name or registered trademark, the postal address and the email address at which they can be contacted on the product with digital elements or, where that is not possible, on its packaging or in a document accompanying the product with digital elements. The contact details shall be in a language easily understood by users and market surveillance authorities.
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the CommissionA natural or legal person, other than the manufacturer, the importer or the distributor, that carries out a substantial modification of the product with digital elements shall be considered a manufacturer for the purposes of this Regulation.
AmendmentA natural or legal person, other than the manufacturer, the importer or the distributor, that in the course of professional activity carries out a substantial modification of the product with digital elements shall be considered a manufacturer for the purposes of this Regulation.
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission2. The EU declaration of conformity shall have the model structure set out in Annex IV and shall contain the elements specified in the relevant conformity assessment procedures set out in Annex VI. Such a declaration shall be continuously updated. It shall be made available in the language or languages required by the Member State in which the product with digital elements is placed on the market or made available.
Amendment2. The EU declaration of conformity shall have the model structure set out in Annex IV and shall contain the elements specified in the relevant conformity assessment procedures set out in Annex VI. Such a declaration shall be continuously updated. It shall be made available in a language which can easily be understood by the authorities of the Member State in which the product with digital elements is placed on the market or made available.
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission2. The technical documentation shall be drawn up before the product with digital elements is placed on the market and shall be continuously updated, where appropriate, during the expected product lifetime or during a period of five years after the placing on the market of a product with digital elements, whichever is shorter.
Amendment2. The technical documentation shall be drawn up before the product with digital elements is placed on the market and shall be continuously updated, where appropriate, during the expected product lifetime or during a period of five years after the placing on the market of a product with digital elements, whichever is longer.
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission5. The Commission is empowered to adopt delegated acts in accordance with Article 50 to supplement this Regulation by the elements to be included in the technical documentation set out in Annex V to take account of technological developments, as well as developments encountered in the implementation process of this Regulation.
Amendment5. The Commission is empowered to adopt delegated acts in accordance with Article 50 to supplement this Regulation by the elements to be included in the technical documentation set out in Annex V to take account of technological developments, as well as developments encountered in the implementation process of this Regulation. The Commission shall strive to minimise the administrative burden for micro, small and medium sized enterprises.
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission5. Notified bodies shall take into account the specific interests and needs of small and medium sized enterprises (SMEs) when setting the fees for conformity assessment procedures and reduce those fees proportionately to their specific interests and needs.
Amendment5. Notified bodies shall take into account the specific interests and needs of micro, small and medium sized enterprises when setting the fees for conformity assessment procedures and reduce those fees proportionately to their specific interests and needs. The Commission shall take action to ensure appropriate financial support in the framework of existing Union programmes, particularly in order to ease the burden on micro, small and medium sized enterprises.
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission
Amendment7 a. Member States and the Commission shall put in place appropriate measures to ensure sufficient availability of skilled professionals, in order to minimise bottlenecks in the activities of conformity assessment bodies.
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission12. Conformity assessment bodies shall operate in accordance with a set of consistent, fair and reasonable terms and conditions, in particular taking into account the interests of SMEs in relation to fees.
Amendment12. Conformity assessment bodies shall operate in accordance with a set of consistent, fair and reasonable terms and conditions, in particular taking into account the interests of micro, small and medium sized enterprises in relation to fees.
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission5. Where, in the course of the monitoring of conformity following the issuance of a certificate, a notified body finds that a product no longer complies with the requirements laid down in this Regulation, it shall require the manufacturer to take appropriate corrective measures and shall suspend or withdraw the certificate if necessary.
Amendment5. Where, in the course of the monitoring of conformity following the issuance of a certificate, a notified body finds that a product no longer complies with the requirements laid down in this Regulation, it shall require the manufacturer to take appropriate corrective measures and shall restrict, suspend or withdraw the certificate if necessary.
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission8. Market surveillance authorities may provide guidance and advice to economic operators on the implementation of this Regulation, with the support of the Commission.
Amendment8. The Commission shall adopt guidelines and provide advice to economic operators, particularly those that qualify as SMEs, including micro-enterprises, on the implementation of this Regulation. In particular, the guidelines and the advice shall aim to simplify and limit the administrative burden, while ensuring the effective and consistent application in accordance with the general objective of ensuring product safety and consumer protection.
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission
Amendment8a. Market surveillance authorities shall be equipped to receive complaints by consumers who identify inconsistencies in the application of this Regulation to relevant products.
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission
AmendmentBefore the above mentioned evaluation is conducted, if necessary, taking into account the significance of the cybersecurity risk, the market surveillance authority may require the relevant operator to immediately suspend or restrict the availability of the product on the market for the period of the above mentioned evaluation.
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission1. Where the Commission has sufficient reasons to consider, including based on information provided by ENISA, that a product with digital elements that presents a significant cybersecurity risk is non-compliant with the requirements laid down in this Regulation, it may request the relevant market surveillance authorities to carry out an evaluation of compliance and follow the procedures referred to in Article 43.
Amendment1. Where the Commission has sufficient reasons to consider, including based on information provided by ENISA, that a product with digital elements that presents a significant cybersecurity risk is non-compliant with the requirements laid down in this Regulation, it shall request the relevant market surveillance authorities to carry out an evaluation of compliance and follow the procedures referred to in Article 43.
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission2. In exceptional circumstances which justify an immediate intervention to preserve the good functioning of the internal market and where the Commission has sufficient reasons to consider that the product referred to in paragraph 1 remains non-compliant with the requirements laid down in this Regulation and no effective measures have been taken by the relevant market surveillance authorities, the Commission may request ENISA to carry out an evaluation of compliance. The Commission shall inform the relevant market surveillance authorities accordingly. The relevant economic operators shall cooperate as necessary with ENISA.
Amendment2. In circumstances which justify an immediate intervention to preserve the good functioning of the internal market and where the Commission has sufficient reasons to consider that the product referred to in paragraph 1 remains non-compliant with the requirements laid down in this Regulation and no effective measures have been taken by the relevant market surveillance authorities, the Commission shall request ENISA to carry out an evaluation of compliance. The Commission shall inform the relevant market surveillance authorities accordingly. The relevant economic operators shall cooperate as necessary with ENISA.
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission1. Market surveillance authorities may agree with other relevant authorities to carry out joint activities aimed at ensuring cybersecurity and protection of consumers with respect to specific products with digital elements placed or made available on the market, in particular products that are often found to present cybersecurity risks.
Amendment1. Market surveillance authorities shall regularly carry out joint activities with other relevant authorities aimed at ensuring cybersecurity and protection of consumers with respect to specific products with digital elements placed or made available on the market, in particular products that are often found to present cybersecurity risks. Those activities shall include inspections on products acquired under a cover identity.
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission2. The Commission or ENISA may propose joint activities for checking compliance with this Regulation to be conducted by market surveillance authorities based on indications or information of potential non-compliance across several Member States of products falling in the scope of this Regulation with the requirements laid down by the latter.
Amendment2. The Commission or ENISA shall propose joint activities for checking compliance with this Regulation to be conducted by market surveillance authorities based on indications or information of potential non-compliance across several Member States of products falling in the scope of this Regulation with the requirements laid down by the latter.
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission1. Market surveillance authorities may decide to conduct simultaneous coordinated control actions (“sweeps”) of particular products with digital elements or categories thereof to check compliance with or to detect infringements to this Regulation.
Amendment1. Market surveillance authorities shall conduct simultaneous coordinated control actions (“sweeps”) of particular products with digital elements or categories thereof to check compliance with or to detect infringements to this Regulation.
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission2. Unless otherwise agreed upon by the market surveillance authorities involved, sweeps shall be coordinated by the Commission. The coordinator of the sweep may, where appropriate, make the aggregated results publicly available.
Amendment2. Unless otherwise agreed upon by the market surveillance authorities involved, sweeps shall be coordinated by the Commission. The coordinator of the sweep shall, where appropriate, make the aggregated results publicly available.
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission1. Member States shall lay down the rules on penalties applicable to infringements by economic operators of this Regulation and shall take all measures necessary to ensure that they are enforced. The penalties provided for shall be effective, proportionate and dissuasive.
Amendment1. Member States shall lay down the rules on penalties applicable to infringements by economic operators of this Regulation and shall take all measures necessary to ensure that they are enforced. The penalties provided for shall be effective, proportionate and dissuasive and shall take into account the specificities of micro, small and medium sized enterprises.
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission(b) whether administrative fines have been already applied by other market surveillance authorities to the same operator for a similar infringement;
Amendment(b) whether administrative fines have been already applied by the same other market surveillance authorities to the same operator for a similar infringement;
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission
AmendmentThe respective authority may be empowered to apply fines below the minimum threshold when all of the following is observed:
Text proposed by the Commission
Amendment(a) the infringement is unintentional;
Text proposed by the Commission
Amendment(b) the infringement did not and is unlikely to result in negative consequences;
Text proposed by the Commission
Amendment(c) no administrative fines have previously been applied by the same of other market surveillance authorities to the same operator for a similar infringement during the previous three years;
Text proposed by the Commission
Amendment(d) upon coming to know about the respective non-compliance the operator employed all the appropriate corrective measures as well as reasonably necessary measures to avoid or minimise potential negative consequences.
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the CommissionIt shall apply from [24 months after the date of entry into force of this Regulation]. However Article 11 shall apply from [12 months after the date of entry into force of this Regulation].
AmendmentIt shall apply from [40 months after the date of entry into force of this Regulation]. However, Chapter II, III, V and VII shall apply no earlier than [40 months after the date of entry into force of this Regulation] as far as products with digital elements are concerned. As far as products with critical elements are concerned, Chapter II, III, V and VII shall apply no earlier than [20 months after the date of publication of the harmonised standards developed under the standardisation requires for the purpose of this Regulation].
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission
AmendmentNo later than 6 months after the date of entry into force of this Regulation, the Commission shall issue guidelines on how to apply the requirements in this Regulation to non-tangible products.
Amendment: Text proposed by the Commission and Amendment
Text proposed by the Commission
Amendment
Text proposed by the Commission5. any known or foreseeable circumstance, related to the use of the product with digital elements in accordance with its intended purpose or under conditions of reasonably foreseeable misuse, which may lead to significant cybersecurity risks;
Parts that accompany the text rather than belong to it: explanatory statement, annexes, opinions appended by other committees. Collapsed.
▸Annex: list of entities or persons from whom the rapporteur has received input2 blocks
The following list is drawn up on a purely voluntary basis under the exclusive responsibility of the rapporteur. The rapporteur has received input from the following entities or persons in the preparation of the draft opinion:
European Parliament (2023). “DRAFT OPINION on the proposal for a regulation of the European Parliament and of the Council on Horizontal cybersecurity requirements for products with digital elements and amending Regulation (EU) 2019/1020”. Text, 31 March 2023. docId IMCO-PA-742490. EU Parl Watch Research. https://news.eu-parl.st-solutions.dev/texts/IMCO-PA-742490 (retrieved 25 September 2026). Data: EP Open Data API: document record, https://data.europarl.europa.eu/api/v2/documents/IMCO-PA-742490 (CC BY 4.0).
BibTeX
@misc{epw-text-imco-pa-742490,
author = {{European Parliament}},
title = {{DRAFT OPINION on the proposal for a regulation of the European Parliament and of the Council on Horizontal cybersecurity requirements for products with digital elements and amending Regulation (EU) 2019/1020}},
year = {2023},
date = {2023-03-31},
howpublished = {\url{https://news.eu-parl.st-solutions.dev/texts/IMCO-PA-742490}},
url = {https://news.eu-parl.st-solutions.dev/texts/IMCO-PA-742490},
urldate = {2026-09-25},
publisher = {EU Parl Watch Research},
note = {Text. docId IMCO-PA-742490. Data: EP Open Data API: document record (CC BY 4.0)}
}