Changes from report parliamentary committee draft to plenary report

Added2. The Commission shall make publicly available the list of the bodies notified under this Regulation, including the identification numbers that have been allocated to them and the activities for which they have been notified.

AddedThe Commission shall ensure that that list is kept up to date.

Added1. Where a notifying authority has ascertained or has been informed that a notified body no longer meets the requirements laid down in Article 29, or that it is failing to fulfil its obligations, the notifying authority shall restrict, suspend or withdraw notification as appropriate, depending on the seriousness of the failure to meet those requirements or fulfil those obligations. It shall immediately inform the Commission and the other Member States accordingly.

Added2. In the event of restriction, suspension or withdrawal of notification, or where the notified body has ceased its activity, the notifying Member State shall take appropriate steps to ensure that the files of that body are either processed by another notified body or kept available for the responsible notifying and market surveillance authorities at their request.

Added1. The Commission shall investigate all cases where it doubts, or doubt is brought to its attention regarding the competence of a notified body or the continued fulfilment by a notified body of the requirements and responsibilities to which it is subject.

Added2. The notifying Member State shall provide the Commission, on request, with all information relating to the basis for the notification or the maintenance of the competence of the body concerned.

Added3. The Commission shall ensure that all sensitive information obtained in the course of its investigations is treated confidentially.

Added4. Where the Commission ascertains that a notified body does not meet or no longer meets the requirements for its notification, it shall inform the notifying Member State accordingly and request it to take the necessary corrective measures, including de-notification if necessary.

Added1. Notified bodies shall carry out conformity assessments in accordance with the conformity assessment procedures provided for in Article 24 and Annex VI.

Added2. Conformity assessments shall be carried out in a proportionate manner, avoiding unnecessary burdens for economic operators, with consideration for microenterprises and small and medium-sized enterprises. Conformity assessment bodies shall perform their activities taking due account of the size of an undertaking, the sector in which it operates, its structure, the degree of complexity and the risk exposure of the product type and technology in question and the mass or serial nature of the production process.

Added3. Notified bodies shall however respect the degree of rigour and the level of protection required for the compliance of the product with the provisions of Regulation.

Added4. Where a notified body finds that requirements laid down in Annex I or in corresponding harmonised standards or in common specifications as referred to in Article 19 have not been met by a manufacturer, it shall require that manufacturer to take appropriate corrective measures and shall not issue a conformity certificate.

Added5. Where, in the course of the monitoring of conformity following the issuance of a certificate, a notified body finds that a product no longer complies with the requirements laid down in this Regulation, it shall require the manufacturer to take appropriate corrective measures and shall suspend or withdraw the certificate if necessary.

Added6. Where corrective measures are not taken or do not have the required effect, the notified body shall restrict, suspend or withdraw any certificates, as appropriate.

Added1. Notified bodies shall inform the notifying authority of the following:

Added(a) any refusal, restriction, suspension or withdrawal of a certificate;

Added(b) any circumstances affecting the scope of and conditions for notification;

Added(c) any request for information which they have received from market surveillance authorities regarding conformity assessment activities;

Added(d) on request, conformity assessment activities performed within the scope of their notification and any other activity performed, including cross-border activities and subcontracting.

Added2. Notified bodies shall provide the other bodies notified under this Regulation carrying out similar conformity assessment activities covering the same products with relevant information on issues relating to negative and, on request, positive conformity assessment results.

AddedThe Commission shall provide for the organisation of exchange of experience between the Member States' national authorities responsible for notification policy.

Added1. The Commission shall ensure that appropriate coordination and cooperation between notified bodies are put in place, taking also in account the need to reduce the administrative burden and fees, and properly operated in the form of a cross-sectoral group of notified bodies.

Added2. Member States shall ensure that the bodies notified by them participate in the work of that group, directly or by means of designated representatives.

AddedMARKET SURVEILLANCE AND ENFORCEMENT

AddedArticle 41 Market surveillance and control of products with digital elements in the Union market

Added1. Regulation (EU) 2019/1020 shall apply to the products with digital elements that fall within the scope of this Regulation.

Added2. Each Member State shall designate one or more market surveillance authorities for the purpose of ensuring the effective implementation of this Regulation. Member States may designate an existing or new authority to act as market surveillance authority for this Regulation.

Added3. Where relevant, the market surveillance authorities shall cooperate with the national cybersecurity certification authorities designated under Article 58 of Regulation (EU) 2019/881, competent authorities and CSIRTs designated pursuant to Directive (EU) 2022/2555 and exchange information on a regular basis. ▌

Added3a. With respect to the supervision of the implementation of the reporting obligations pursuant to Article 11 of this Regulation, the designated market surveillance authorities shall cooperate with ENISA. The market surveillance authorities may request ENISA to provide technical advice on matters related to the implementation and enforcement of this Regulation. When conducting an investigation under Article 43, market surveillance authorities may request ENISA to provide non-binding evaluations of compliance of products with digital elements.

Added4. Where relevant, the market surveillance authorities shall cooperate with other market surveillance authorities designated on the basis of other Union harmonisation legislation for other products, and exchange information on a regular basis.

Added5. Market surveillance authorities shall cooperate, as appropriate, with the authorities supervising Union data protection law. Such cooperation includes informing these authorities of any finding relevant for the fulfilment of their competences, including when issuing guidance and advice pursuant to paragraph 8 of this Article if such guidance and advice concerns the processing of personal data.

AddedAuthorities supervising Union data protection law shall have the power to request and access any documentation created or maintained under this Regulation when access to that documentation is necessary for the fulfilment of their tasks. They shall inform the designated market surveillance authorities of the Member State concerned of any such request.

Added6. Member States shall ensure that the designated market surveillance authorities are provided with adequate financial and human resources, with appropriate cybersecurity skills, in order to fulfil their tasks under this Regulation.

Added7. The Commission shall facilitate the regular and structured exchange of experience between designated market surveillance authorities.

Added8. Market surveillance authorities may provide guidance and advice to economic operators on the implementation of this Regulation as well as on non-technical risk factors, with the support of CSIRTs, ENISA and the Commission.

Added8a. Market surveillance authorities shall be equipped to receive complaints by consumers in accordance with Article 11 of Regulation 2019/1020, including by establishing clear and accessible mechanisms to facilitate reporting of vulnerabilities, incidents and cyber threats.

Added9. The market surveillance authorities shall report to the Commission on an annual basis the outcomes of relevant market surveillance activities. The designated market surveillance authorities shall report, without delay, to the Commission and relevant national competition authorities any information identified in the course of market surveillance activities that may be of potential interest for the application of Union competition law.

AddedMarket surveillance authorities shall provide the Commission with data about the average support period set by the manufacturers, as well as when available the average expected product lifetime, and disaggregated per category of product with digital elements. The Commission shall analyse this information and publish it in a publicly accessible and user-friendly database.

Added9a. The Commission shall evaluate the reported data including pursuant to paragraph 9 of this Article for the purpose of the reports referred to in Article 56. Where the reported data suggests an increased level of non-compliance in specific categories of products, the Commission, after consulting the Expert Group and ADCO, may recommend that surveillance authorities focus closely on the product categories concerned.

Added10. For products with digital elements that fall within the scope of this Regulation classified as high-risk AI systems according to Article [Article 6] of the Regulation [the AI Regulation], the market surveillance authorities designated for the purposes of the Regulation [the AI Regulation] shall be the authorities responsible for market surveillance activities required under this Regulation. The market surveillance authorities designated pursuant to Regulation [the AI Regulation] shall cooperate, as appropriate, with the market surveillance authorities designated pursuant to this Regulation and, with respect to the supervision of the implementation of the reporting obligations pursuant to Article 11, with ENISA. Market surveillance authorities designated pursuant to Regulation [the AI Regulation] shall in particular inform market surveillance authorities designated pursuant to this Regulation of any finding relevant for the fulfilment of their tasks in relation to the implementation of this Regulation.

Added11. An ▌ADCO for cyber resilience of products with digital elements shall be established for the uniform application of this Regulation, pursuant to Article 30(2) of Regulation (EU) 2019/1020. This ADCO shall be composed of representatives of the designated market surveillance authorities and, if appropriate, representatives of single liaison offices. In particular, this ADCO shall exchange best practices and, where relevant, cooperate with the Expert Group and ENISA as well as the Cooperation Group and the CSIRTs Network referred to under Directive (EU) 2022/2555.

Added11a. Market surveillance authorities shall facilitate the involvement of stakeholders, including scientific, research and consumer organisations, in their activities.

AddedWhere necessary to assess the conformity of products with digital elements and the processes put in place by their manufacturers with the essential requirements set out in Annex I and upon a reasoned request, the market surveillance authorities shall be granted access to the data required to assess the design, development, production and vulnerability handling of such products, including related internal documentation of the respective economic operator.

AddedArticle 43 Procedure at national level concerning products with digital elements presenting a significant cybersecurity risk

Added1. Where the market surveillance authority of a Member State has sufficient reasons to consider that a product with digital elements, including its vulnerability handling, presents a significant cybersecurity risk, it shall carry out without undue delay, and where appropriate in cooperation with CSIRT, an evaluation of the product with digital elements concerned in respect of its compliance with all the requirements laid down in this Regulation. The relevant economic operators shall cooperate as necessary with the market surveillance authority.

AddedWhere, in the course of that evaluation, the market surveillance authority finds that the product with digital elements does not comply with the requirements laid down in this Regulation, it shall without delay require the relevant economic operator to take all appropriate corrective actions to bring the product into compliance with those requirements, to withdraw it from the market, or to recall it within a reasonable period, commensurate with the nature of the risk, as it may prescribe.

AddedThe market surveillance authority shall inform the relevant notified body accordingly. Article 18 of Regulation (EU) 2019/1020 shall apply to the appropriate corrective actions.

Added1a. Where the market surveillance authority of a Member State has sufficient reason to consider that a product with digital elements presents a significant cybersecurity risk or threats to national security in light of non-technical risk factors, it shall issue targeted recommendations to economic operators aimed at ensuring that appropriate corrective actions are put in place.

Added2. Where the market surveillance authority considers that non-compliance is not restricted to its national territory, it shall inform the Commission and the other Member States of the results of the evaluation and of the actions which it has required the operator to take.

Added3. The manufacturer shall ensure that all appropriate corrective action is taken in respect of all the products with digital elements concerned that it has made available on the market throughout the Union.

Added4. Where the manufacturer of a product with digital elements does not take adequate corrective action within the period referred to in paragraph 1, second subparagraph, the market surveillance authority shall take all appropriate provisional measures to prohibit or restrict that product being made available on its national market, to withdraw it from that market or to recall it.

AddedThat authority shall inform the Commission and the other Member States, without delay, of those measures.

Added5. The information referred to in paragraph 4 shall include all available details, in particular the data necessary for the identification of the non-compliant products with digital elements, the origin of the product with digital elements, the nature of the alleged non-compliance and the risk involved, the nature and duration of the national measures taken and the arguments put forward by the relevant operator. In particular, the market surveillance authority shall indicate whether the non-compliance is due to one or more of the following:

Added(a) a failure of the product or of the processes put in place by the manufacturer to meet the essential requirements set out in Annex I;

Added(b) shortcomings in the harmonised standards, cybersecurity certification schemes, or common specifications, referred to in Article 18.

Added6. The market surveillance authorities of the Member States other than the market surveillance authority of the Member State initiating the procedure shall without delay inform the Commission and the other Member States of any measures adopted and of any additional information at their disposal relating to the non-compliance of the product concerned, and, in the event of disagreement with the notified national measure, of their objections.

Added7. Where, within three months of receipt of the information referred to in paragraph 4, no objection has been raised by either a Member State or the Commission in respect of a provisional measure taken by a Member State, that measure shall be deemed justified. This is without prejudice to the procedural rights of the operator concerned in accordance with Article 18 of Regulation (EU) 2019/1020.

Added8. The market surveillance authorities of all Member States shall ensure that appropriate restrictive measures are taken in respect of the product concerned, such as withdrawal of the product from their market, without delay.

Added1. Where, within three months of receipt of the notification referred to in Article 43(4), objections are raised by a Member State against a measure taken by another Member State, or where the Commission considers the measure to be contrary to Union legislation, the Commission shall without delay enter into consultation with the relevant Member State and the economic operator or operators and shall evaluate the national measure. On the basis of the results of that evaluation, the Commission shall decide whether the national measure is justified or not within nine months from the notification referred to in Article 43(4) and notify such decision to the Member State concerned.

Added2. If the national measure is considered justified, all Member States shall take the measures necessary to ensure that the non-compliant product with digital elements is withdrawn from their market, and shall inform the Commission accordingly. If the national measure is considered unjustified, the Member State concerned shall withdraw the measure.