Skip to content
EU Parl Watch

Changes between two versions

What changed between the draft committee report and the plenary report

From · draft committee report· 31 Mar 2023

ITRE-PR-745538

on the proposal for a regulation of the European Parliament and of the Council on horizontal cybersecurity requirements for products with digital elements and amending Regulation (EU) 2019/1020

To · plenary report· 27 Jul 2023

A-9-2023-0253

on the proposal for a regulation of the European Parliament and of the Council on horizontal cybersecurity requirements for products with digital elements and amending Regulation (EU) 2019/1020

These two texts have too little in common to compare paragraph by paragraph: they are different documents rather than versions of one (for example one group’s motion and the joint text that was adopted).

+850 added · −171 removed · 3 changed paragraphs, packaging included.

Part 12 of 20: Paragraphs 602–661

Added:4. Manufacturers of products with digital elements that are classified as EHR systems under ▌Regulation [the European Health Data Space Regulation] shall demonstrate conformity with the essential requirements laid down in Annex I of this Regulation using the relevant conformity assessment procedure as required by Regulation [Chapter III of the European Health Data Space Regulation].

Added:5. Notified bodies shall take into account the specific interests and needs of microenterprises and small and medium-sized enterprises ▌ when setting the fees for conformity assessment procedures and reduce those fees proportionately to their specific interests and needs. The Commission shall ensure appropriate financial support in the regulatory framework of existing Union programmes, in particular in order to ease the financial burden on microenterprises and on small and medium-sized enterprises.

Added:In order to promote international trade, the Commission shall endeavour to conclude Mutual Recognition Agreements (MRAs) with third countries. The Union shall establish MRAs only with third countries that are on a comparable level of technical development and have a compatible approach concerning conformity assessment. The MRAs shall ensure the same level of protection as that provided for by this Regulation.

Added:NOTIFICATION OF CONFORMITY ASSESSMENT BODIES

Added:Member States shall notify the Commission and the other Member States of conformity assessment bodies authorised to carry out conformity assessments in accordance with this Regulation.

Added:1. Member States shall designate a notifying authority that shall be responsible for setting up and carrying out the necessary procedures for the assessment and notification of conformity assessment bodies and the monitoring of notified bodies, including compliance with Article 31.

Added:2. Member States may decide that the assessment and monitoring referred to in paragraph 1 shall be carried out by a national accreditation body within the meaning of and in accordance with Regulation (EC) No 765/2008.

Added:1. A notifying authority shall be established in such a way that no conflict of interest with conformity assessment bodies occurs.

Added:2. A notifying authority shall be organised and shall function so as to safeguard the objectivity and impartiality of its activities.

Added:3. A notifying authority shall be organised in such a way that each decision relating to notification of a conformity assessment body is taken by competent persons different from those who carried out the assessment.

Added:4. A notifying authority shall not offer or provide any activities that conformity assessment bodies perform or consultancy services on commercial or competitive basis.

Added:5. A notifying authority shall safeguard the confidentiality of the information it obtains.

Added:6. A notifying authority shall have a sufficient number of competent personnel at its disposal for the proper performance of its tasks.

Added:6a. A notifying authority shall minimise administrative burden and fees imposed, in particular, on microenterprises and small and medium-sized enterprises.

Added:1. Member States shall inform the Commission of their procedures for the assessment and notification of conformity assessment bodies and the monitoring of notified bodies, and of any changes thereto.

Added:1a. Member States shall, by ... [24 months after the date of entry into force of this Regulation], ensure that there is a sufficient number of notified bodies in the Union to carry out conformity assessments, in order to avoid bottlenecks and hindrances to market entry.

Added:2. The Commission shall make that information publicly available.

Added:1. For the purposes of notification, a conformity assessment body shall meet the requirements laid down in paragraphs 2 to 12.

Added:2. A conformity assessment body shall be established under national law and have legal personality.

Added:3. A conformity assessment body shall be a third-party body independent of the organisation or the product it assesses.

Added:A body belonging to a business association or professional federation representing undertakings involved in the design, development, production, provision, assembly, use or maintenance of products with digital elements which it assesses, may, on condition that its independence and the absence of any conflict of interest are demonstrated, be considered such a body.

Added:4. A conformity assessment body, its top level management and the personnel responsible for carrying out the conformity assessment tasks shall not be the designer, developer, manufacturer, supplier, installer, purchaser, owner, user or maintainer of the products with digital elements which they assess, nor the authorised representative of any of those parties. This shall not preclude the use of assessed products that are necessary for the operations of the conformity assessment body or the use of such products for personal purposes.

Added:A conformity assessment body, its top level management and the personnel responsible for carrying out the conformity assessment tasks shall not be directly involved in the design, development, production, the marketing, installation, use or maintenance of those products, or represent the parties engaged in those activities. They shall not engage in any activity that may conflict with their independence of judgement or integrity in relation to conformity assessment activities for which they are notified. This shall in particular apply to consultancy services.

Added:Conformity assessment bodies shall ensure that the activities of their subsidiaries or subcontractors do not affect the confidentiality, objectivity or impartiality of their conformity assessment activities.

Added:5. Conformity assessment bodies and their personnel shall carry out the conformity assessment activities with the highest degree of professional integrity and the requisite technical competence in the specific field and shall be free from all pressures and inducements, particularly financial, which might influence their judgement or the results of their conformity assessment activities, especially as regards persons or groups of persons with an interest in the results of those activities.

Added:6. A conformity assessment body shall be capable of carrying out all the conformity assessment tasks referred to in Annex VI and in relation to which it has been notified, regardless of whether those tasks are carried out by the conformity assessment body itself or on its behalf and under its responsibility.

Added:At all times and for each conformity assessment procedure and each kind or category of products with digital elements in relation to which it has been notified, a conformity assessment body shall have at its disposal the necessary:

Added:(a) staff with technical knowledge and sufficient and appropriate experience to perform the conformity assessment tasks;

Added:(b) descriptions of procedures in accordance with which conformity assessment is carried out, ensuring the transparency and the ability of reproduction of those procedures. It shall have appropriate policies and procedures in place that distinguish between tasks it carries out as a notified body and other activities;

Added:(c) procedures for the performance of activities which take due account of the size of an undertaking, the sector in which it operates, its structure, the degree of complexity of the product technology in question and the mass or serial nature of the production process.

Added:It shall have the means necessary to perform the technical and administrative tasks connected with the conformity assessment activities in an appropriate manner and shall have access to all necessary equipment or facilities.

Added:7. The personnel responsible for carrying out conformity assessment activities shall have the following:

Added:(a) sound technical and vocational training covering all the conformity assessment activities in relation to which the conformity assessment body has been notified;

Added:(b) satisfactory knowledge of the requirements of the assessments they carry out and adequate authority to carry out those assessments;

Added:(c) appropriate knowledge and understanding of the essential requirements set out in Annex I, of the applicable harmonised standards and of the relevant provisions of Union harmonisation legislation and of its implementing acts;

Added:(d) the ability to draw up certificates, records and reports demonstrating that assessments have been carried out.

Added:7a. Member States and the Commission shall put in place appropriate measures to ensure sufficient availability of skilled professionals, in order to minimise bottlenecks in the activities of conformity assessment bodies and facilitate the compliance of economic operators with this Regulation.

Added:8. The impartiality of the conformity assessment bodies, their top level management and of the assessment personnel shall be guaranteed.

Added:The remuneration of the top level management and assessment personnel of a conformity assessment body shall not depend on the number of assessments carried out or on the results of those assessments.

Added:9. Conformity assessment bodies shall take out liability insurance unless liability is assumed by the State in accordance with national law, or the Member State itself is directly responsible for the conformity assessment.

Added:10. The personnel of a conformity assessment body shall observe professional secrecy with regard to all information obtained in carrying out their tasks under Annex VI or any provision of national law giving effect to it, except in relation to the market surveillance authorities of the Member State in which its activities are carried out. Proprietary rights shall be protected in accordance with Article 52. The conformity assessment body shall have documented procedures ensuring compliance with this paragraph.

Added:11. Conformity assessment bodies shall participate in, or ensure that their assessment personnel are informed of, the relevant standardisation activities and the activities of the notified body coordination group established under Article 40 and apply as general guidance the administrative decisions and documents produced as a result of the work of that group.

Added:12. Conformity assessment bodies shall operate in accordance with a set of consistent, fair and reasonable terms and conditions in accordance with Article 37(2), in particular taking into account the interests of microenterprises and small and medium-sized enterprises in relation to fees.

Added:Where a conformity assessment body demonstrates its conformity with the criteria laid down in the relevant harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union it shall be presumed to comply with the requirements set out in Article 29 in so far as the applicable harmonised standards cover those requirements.

Added:1. Where a notified body subcontracts specific tasks connected with conformity assessment or has recourse to a subsidiary, it shall ensure that the subcontractor or the subsidiary meets the requirements set out in Article 29 and shall inform the notifying authority accordingly.

Added:2. Notified bodies shall take full responsibility for the tasks performed by subcontractors or subsidiaries wherever these are established.

Added:3. Activities may be subcontracted or carried out by a subsidiary only with the agreement of the manufacturer.

Added:4. Notified bodies shall keep at the disposal of the notifying authority the relevant documents concerning the assessment of the qualifications of the subcontractor or the subsidiary and the work carried out by them under this Regulation.

Added:1. A conformity assessment body shall submit an application for notification to the notifying authority of the Member State in which it is established.

Added:2. That application shall be accompanied by a description of the conformity assessment activities, the conformity assessment procedure or procedures and the product or products for which that body claims to be competent, as well as by an accreditation certificate, where one exists, issued by a national accreditation body attesting that the conformity assessment body fulfils the requirements laid down in Article 29.

Added:3. Where the conformity assessment body concerned cannot provide an accreditation certificate, it shall provide the notifying authority with all the documentary evidence necessary for the verification, recognition and regular monitoring of its compliance with the requirements laid down in Article 29.

Added:1. Notifying authorities may notify only conformity assessment bodies, which have satisfied the requirements laid down in Article 29.

Added:2. The notifying authority shall notify the Commission and the other Member States using the New Approach Notified and Designated Organisations (NANDO) information system developed and managed by the Commission.

Added:3. The notification shall include full details of the conformity assessment activities, the conformity assessment module or modules and product or products concerned and the relevant attestation of competence.

Added:4. Where a notification is not based on an accreditation certificate as referred to in Article 32(2), the notifying authority shall provide the Commission and the other Member States with documentary evidence which attests to the conformity assessment body's competence and the arrangements in place to ensure that that body will be monitored regularly and will continue to satisfy the requirements laid down in Article 29.

Added:5. The body concerned may perform the activities of a notified body only where no objections are raised by the Commission or the other Member States within two weeks of a notification where an accreditation certificate is used or within two months of a notification where accreditation is not used.

Added:Only such a body shall be considered a notified body for the purposes of this Regulation.

Added:6. The Commission and the other Member States shall be notified of any subsequent relevant changes to the notification.

Added:1. The Commission shall assign an identification number to a notified body.

Added:It shall assign a single such number even where the body is notified under several Union acts.