What changed between the draft committee report and the plenary report

Removed:Reference to the definition of cybersecurity contained in the Cyber Security Act.

Added:(23) In line with the commonly established notion of substantial modification for products regulated by Union harmonisation legislation, whenever a substantial modification occurs that may affect the compliance of a product with this Regulation or when the intended purpose of that product changes, it is appropriate that the compliance of the product with digital elements is verified and that, where applicable, it undergoes a new conformity assessment. Where applicable, if the manufacturer undertakes a conformity assessment involving a third party, changes that might lead to substantial modifications should be notified to the third party.

Removed:Article 3 – paragraph 1 – point 21 a (new): (21a) ‘micro, small and medium sized enterprises’ means micro, small and medium sized enterprises as defined in Commission Recommendation 2003/361/EC1a; / 1a Commission Recommendation of 6 May 2003 concerning the definition of micro, small and medium-sized enterprises (notified under document number C(2003) 1422) (OJ L 124, 20.5.2003, p. 36).

Added:(24) Refurbishing, maintaining and repairing of a product with digital elements, as defined in the Regulation [Eco-design Regulation], does not necessarily lead to a substantial modification of the product, for instance if the intended use and functionalities are not changed and the level of risk remains unaffected. However, upgrading a product by the manufacturer might lead to changes in the design and development of the product and therefore might affect the intended use and the compliance of the product with the requirements set out in this Regulation.

Removed:Article 3 – paragraph 1 – point 39 a (new): (39a) ‘incident’ means an incident as defined in Article 6, point (6), of Directive (EU) 2022/2555;

Added:(25) Products with digital elements should be considered critical if the negative impact of the exploitation of potential cybersecurity vulnerabilities in the product can be severe due to, amongst others, the cybersecurity-related functionality, or the intended use. In particular, vulnerabilities in products with digital elements that have a cybersecurity-related functionality, such as secure elements, can lead to a propagation of security issues throughout the supply chain. The severity of the impact of a cybersecurity incident may also increase when taking into account the intended use of the product, such as in an industrial setting or in the context of an essential entity of the type referred to in Annex [Annex I] to Directive (EU) 2022/2555, or ▌the performance of critical or sensitive functions, that have an impact on health, safety or fundamental rights.

Removed:Article 3 – paragraph 1 – point 39 b (new): (39b) ‘near miss’ means a near miss as defined in Article 6, point (5), of Directive (EU) 2022/2555;

Added:(26) Critical products with digital elements should be subject to stricter conformity assessment procedures, while keeping a proportionate approach. For this purpose, critical products with digital elements should be divided into two classes, reflecting the level of cybersecurity risk linked to these categories of products. A potential cyber incident involving products in class II might lead to greater negative impacts than an incident involving products in class I, for instance due to the nature of their cybersecurity-related function or intended use in high risk environments, and therefore should undergo a stricter conformity assessment procedure.

Removed:The definition of near miss, contained in NIS 2, will be used for voluntary reporting in the newly created Article 11a.

Added:(27) The categories of critical products with digital elements referred to in Annex III of this Regulation should be understood as the products which have the core functionality of the type that is listed in Annex III to this Regulation. For example, Annex III to this Regulation lists products which are defined by their core functionality as general purpose microprocessors in class I. As a result, general purpose microprocessors are subject to mandatory third-party conformity assessment. This is not the case for other products not explicitly referred to in Annex III to this Regulation which may integrate a general purpose microprocessor. The Commission should adopt delegated acts [by 6 months since the entry into force of this Regulation] to specify the definitions of the product categories covered under class I and class II as set out in Annex III. In order to ensure legal clarity and certainty as well as predictability for stakeholders to comply with this Regulation, amendments to the list in Annex III should be made at the earliest two years after the entry into force of this Regulation and again at the earliest two years thereafter. The Commission should establish a process under which a product which is a candidate to be a critical product can be reviewed in a collaborative process by all relevant stakeholders, including manufacturers and users, to assess the security risk posed by potential cybersecurity issues with the product, whether and how much designating the product as critical would likely reduce that risk, and the costs associated with designating the product as critical, before adopting the relevant delegated acts.

Removed:Article 3 – paragraph 1 – point 39 c (new): (39c) ‘cyber threat’ means a cyber threat as defined in Article 2, point (8), of Regulation (EU) 2019/881;

Added:(27a) The Commission should set up an expert group on cyber resilience (the ‘Expert Group’), with a wide and diverse membership. The Expert Group should support the Commission in order to ensure the proper implementation of this Regulation, for example by advising the Commission on possible amendments to the list of critical products set out in Annex III or by analysing in what way European and international standards can enable compliance with the essential requirements of this Regulation. The Commission should consult the Expert Group and carry out public consultations while preparing delegated and implementing acts pursuant to this Regulation, in order to ensure that all stakeholders can provide the necessary input.

Removed:The definition of cyber threat, contained in the Cyber Security Act, will be used for voluntary reporting in the newly created Article 11a.

Added:(28) This Regulation addresses cybersecurity risks in a targeted manner. Products with digital elements might, however, pose other safety risks, that are not always related to cybersecurity but can be a consequence of a security breach. Those risks should continue to be regulated by other relevant Union product legislation. If no other Union harmonisation legislation is applicable, they should be subject to Regulation (EU) 2023/988. Therefore, in light of the targeted nature of this Regulation, as a derogation from Article 2(1), third subparagraph, point (b), of Regulation (EU) 2023/988, Chapter III, Section 1, Chapters V and VII, and Chapters IX to XI of Regulation (EU) 2023/988 should apply to products with digital elements with respect to safety risks not covered by this Regulation, if those products are not subject to specific requirements imposed by other Union harmonisation legislation within the meaning of Article 3, point (25) of Regulation (EU) 2023/988.

Removed:Article 6 – paragraph 2 – introductory part: 2. After ... [two years after the date of entry into force of this Regulation] and no more frequently than every two years thereafter, the Commission is empowered to adopt delegated acts in accordance with Article 50 to amend Annex III by including in the list of categories of critical products with digital elements a new category or withdrawing an existing one from that list. When assessing the need to amend the list in Annex III, the Commission shall take into account the level of cybersecurity risk related to the category of products with digital elements. In determining the level of cybersecurity risk, one or several of the following criteria shall be taken into account:

Added:(29) Products with digital elements classified as high-risk AI systems according to Article 6 of Regulation [the AI Regulation] which fall within the scope of this Regulation should comply with the essential requirements set out in this Regulation. When those high-risk AI systems fulfil the essential requirements of this Regulation, they should be deemed compliant with the cybersecurity requirements set out in Article [Article 15] of Regulation [the AI Regulation] in so far as those requirements are covered by the EU declaration of conformity or parts thereof issued under this Regulation. As regards the conformity assessment procedures relating to the essential cybersecurity requirements of a product with digital elements covered by this Regulation and classified as a high-risk AI system, the relevant provisions of Article 43 of Regulation [the AI Regulation] should apply as a rule instead of the respective provisions of this Regulation. However, this rule should not result in reducing the necessary level of assurance for critical products with digital elements covered by this Regulation. Therefore, by way of derogation from this rule, high-risk AI systems that fall within the scope of the Regulation [the AI Regulation] and are also qualified as critical products with digital elements pursuant to this Regulation and to which the conformity assessment procedure based on internal control referred to in Annex VI of the Regulation [the AI Regulation] applies, should be subject to the conformity assessment provisions of this Regulation in so far as the essential requirements of this Regulation are concerned. In this case, for all the other aspects covered by Regulation [the AI Regulation] the respective provisions on conformity assessment based on internal control set out in Annex VI to Regulation [the AI Regulation] should apply.

Removed:For the sake of legal clarity and predictability, it is necessary to ensure that the list of critical products can be amended only once every two years.

Added:(30) The machinery products falling within the scope of Regulation (EU) 2023/1230 of the European Parliament and of the Council which are products with digital elements within the meaning of this Regulation and for which a declaration of conformity has been issued on the basis of this Regulation should be deemed to be in conformity with the essential health and safety requirements set out in [Annex III, sections 1.1.9 and 1.2.1] of the Regulation (EU) 2023/1230, as regards protection against corruption and safety and reliability of control systems in so far as the compliance with those requirements is demonstrated by the EU declaration of conformity issued under this Regulation.

Removed:Article 6 – paragraph 3: 3. The Commission is empowered to adopt a delegated act in accordance with Article 50 to supplement this Regulation by specifying the definitions of the product categories under class I and class II as set out in Annex III. The delegated act shall be adopted [by 6 months since the entry into force of this Regulation].

Added:(31) Regulation [European Health Data Space Regulation proposal] complements the essential requirements laid down in this Regulation. The electronic health record systems (‘EHR systems’) falling under the scope of Regulation [European Health Data Space Regulation proposal] which are products with digital elements within the meaning of this Regulation should therefore also comply with the essential requirements set out in this Regulation. Their manufacturers should demonstrate conformity as required by Regulation [European Health Data Space Regulation proposal]. To facilitate compliance, manufacturers may draw up a single technical documentation containing the elements required by both legal acts. As this Regulation does not cover SaaS as such, EHR systems offered through the SaaS licensing and delivery model are not within the scope of this Regulation. Similarly, EHR systems that are developed and used in-house do not fall within the scope of this Regulation, as they are not placed on the market.

Removed:A rapid definition of the product categories is essential to give undertakings enough time to adapt to this Regulation.

Added:(32) In order to ensure that products with digital elements are secure both at the time of their placing on the market as well as throughout their life-cycle, it is necessary to lay down essential requirements for vulnerability handling and essential cybersecurity requirements relating to the properties of products with digital elements. While manufacturers should comply with all essential requirements related to vulnerability handling throughout the support period, they should determine which other essential requirements related to the product properties are relevant for the concerned type of product. For this purpose, manufacturers should undertake an assessment of the cybersecurity risks associated with a product with digital elements to identify relevant risks and relevant essential requirements and in order to make available their products without known exploitable vulnerabilities that might have an impact on the security of those products and to appropriately apply suitable harmonised standards, common specifications or international standards.

Removed:Article 6 – paragraph 4 – subparagraph 1 a (new): Where a new category of critical products with digital elements is added to the list in Annex III by means of a delegated act pursuant to paragraph 2 of this Article, it shall be subject to the relevant conformity assessment procedures referred to in Article 24(2) and (3) within 12 months of the date of adoption of the related delegated act.

Added:(32a) Manufacturers should determine the support period during which they ensure that vulnerabilities are handled, duly taking into account various criteria, including the expected product lifetime, the nature of the product itself, the availability of the operating environment, the expectations of users, particularly consumers, and, where possible, the support period of other main components integrated into the product. Manufacturers should ensure that the support period adequately reflects the need to promote cybersecurity in the Union’s market and is set with due consideration of the period during which a product with digital elements is expected to be available on the market. Market surveillance authorities should proactively ensure that manufacturers apply these criteria in an adequate manner. Market surveillance authorities and the Commission should collect and analyse data about the support periods set by manufacturers and the expected product lifetimes, in order to ensure that this Regulation meets its goal of promoting the cybersecurity of products with digital elements. Such analyses should, inter alia, inform the Commission’s evaulation of this Regulation, once it applies.

Removed:Manufacturers of critical products that are already listed in Annex III will benefit from a transitional period between entry into force and implementation of this Regulation. Hence, a transitional period should also be envisaged for critical products that are newly added to the list after the entry into force of this Regulation.

Added:(32b) Manufacturers should ensure, where technically feasible, that products with digital elements clearly differentiate between security and functionality updates. Security updates, designed to decrease the level of risk or to remedy potential vulnerabilities, should be installed automatically, in particular in the case of consumer products. Users should retain the possibility to de-activate this feature, with a clear and easy-to-use mechanism. Once the manufacturer no longer ensures that vulnerabilities of the product with digital elements are handled, it should inform users in a simple and clear manner, for example via the display of a user-friendly notification.

Removed:Article 6 – paragraph 5 – introductory part: 5. The Commission is empowered to adopt delegated acts in accordance with Article 50 to supplement this Regulation by specifying categories of highly critical products with digital elements for which the manufacturers shall be required to obtain a European cybersecurity certificate under a European cybersecurity certification scheme pursuant to Regulation (EU) 2019/881 to demonstrate conformity with the essential requirements set out in Annex I, or parts thereof. The obligation to obtain a European cybersecurity certificate shall apply 12 months after the adoption of the relevant delegated act. When determining such categories of highly critical products with digital elements, the Commission shall take into account the level of cybersecurity risk related to the category of products with digital elements, in light of one or several of the criteria listed in paragraph 2, as well as in view of the assessment of whether that category of products is:

Added:(32c) Where manufacturers set a support period of shorter than five years and no longer offer vulnerability handling for the product with digital elements, they should be able to make their source code available to undertakings that wish to provide security updates and other similar services. Such access should be made available only as part of a contractual arrangement that protects the ownership of the product with digital elements and prevents the dissemination of the source code to the public, except where such code has already been provided under a free and open-source licence.

Removed:A transitional period of 12 months should apply for products which will be required to obtain a European cybersecurity certificate.

Added:(33) In order to improve the security of products with digital elements placed on the internal market it is necessary to lay down essential requirements. These essential requirements should be without prejudice to the EU coordinated risk assessments of critical supply chains established by ▌Directive (EU) 2022/2555▌, which take into account both technical and, where relevant, non-technical risk factors, such as undue influence by a third country on suppliers. Furthermore, it should be without prejudice to the Member States’ prerogatives to lay down additional requirements that take account of non-technical factors for the purpose of ensuring a high level of resilience, including those defined in Recommendation (EU) 2019/534, in the Union-wide coordinated risk assessment of 5G networks security and in the EU Toolbox on 5G cybersecurity agreed by the NIS Cooperation Group as referred to in Directive (EU) 2022/2555.

Removed:Article 6 – paragraph 5 a (new): 5a. The Commission is empowered to adopt the delegated acts referred to in paragraph 5 of this Article no earlier than 12 months after the adoption of the relevant European cybersecurity certification scheme pursuant to Regulation (EU) 2019/881.

Added:(34) To ensure that the national CSIRTs and the single point of contacts designated in accordance with ▌Directive (EU) 2022/2555 are provided with the information necessary to fulfil their tasks and raise the overall level of cybersecurity of essential and important entities, and to ensure the effective functioning of market surveillance authorities, manufacturers of products with digital elements should notify to ENISA vulnerabilities that are being actively exploited. As most products with digital elements are marketed across the entire internal market, any exploited vulnerability in a product with digital elements should be considered a threat to the functioning of the internal market. Manufacturers should disclose fixed vulnerabilities to the European vulnerability database established under Directive (EU) 2022/2555 and managed by ENISA▌. ENISA should also publish notified vulnerabilities in the European vulnerability database and should have in place an appropriate procedure regarding the publication process in order to give manufacturers the time to develop the necessary security updates and users the time to implement them or take other corrective or mitigating measures. The European vulnerability database should assist manufacturers in detecting known exploitable vulnerabilities found in their products, in order to ensure that secure products are placed on the market.

Removed:A minimum period of operation for new European cybersecurity certification schemes should be envisaged, to ensure their correct operation and give sufficient time to undertakings to adopt them.

Added:(34a) The Union needs to maximise the benefits of its economic openness while minimising the risks from economic dependencies on high-risk vendors, through a common strategic framework for Union economic security. Dependencies on high-risk suppliers of critical products with digital elements pose a strategic risk that should be addressed at Union level, especially when the critical products with digital elements are intended for the use by essential entities of the type referred to in Directive (EU) 2022/2555. Such risks may be linked to the jurisdiction applicable to the manufacturer, the characteristics of its corporate ownership and the links of control to a third-country government where it is established, in particular whether a country engages in economic espionage and its legislation obliges arbitrary access to any kind of company operations or data, including commercially sensitive data, and can impose obligations for intelligence purposes without democratic checks and balances, oversight mechanism, due process or the right to appeal to an independent judiciary. Market surveillance authorities and the Commission should provide guidance and targeted recommendations to economic operators in order to ensure that appropriate corrective actions are put in place where there is sufficient reason to consider that a product with digital elements presents a significant cybersecurity risk in light of such non-technical risk factors.

Removed:Article 6 – paragraph 5 b (new): 5b. Before adopting the delegated acts referred to in paragraphs 2, 4 and 5 of this Article, the Commission shall consult the Expert Group referred to in [Article 6a].

Added:(35) Manufacturers should also report to ENISA any significant incident having an impact on the security of the product with digital elements. Notwithstanding the incident reporting obligations in Directive Directive (EU) 2022/2555 for essential and important entities, it is crucial for ENISA, the single points of contact designated by the Member States in accordance with Article [Article X] of Directive Directive (EU) 2022/2555 and the market surveillance authorities to receive information from the manufacturers of products with digital elements allowing them to assess the security of these products. In order to ensure that users can react quickly to significant incidents having an impact on the security of their products with digital elements, manufacturers should also inform their users about any such incident and, where applicable, about any corrective measures that the users can deploy to mitigate the impact of the incident, for example by publishing relevant information on their websites or, where the manufacturer is able to contact the users and where justified by the risks, by reaching out to the users directly.

Removed:Stakeholder consultation will be essential to the functioning of this Regulation. The Commission should consult extensively the newly created Expert Group on Cyber Resilience.

Added:(35a) Manufacturers and other entities and actors should also be able to report to ENISA, on a voluntary basis, about other cybersecurity incidents, cyber threats, near misses and any other vulnerability.

Removed:Article 6 a (new): Article 6a / Expert group on cyber resilience / 1. By ... [6 months after the date of entry into force of this Regulation], the Commission shall establish an expert group on cyber resilience (the ‘Expert Group’). The composition of the Expert Group shall aim to be gender and geographically balanced and shall include the following: / (a) representatives of each of the following: / (i) the European Union Agency for Cybersecurity; / (ii) the European Data Protection Board; / (iii) Europol; / (iv) the European Defence Agency; / (b) experts representing relevant private stakeholders, ensuring adequate representation of micro, small and medium sized enterprises; / (c) experts representing civil society, including consumer organisations; / (d) experts appointed in a personal capacity, who have proven knowledge and experience in the areas covered by this Regulation; / (e) experts representing academia, including universities, research institutes and other scientific organisations, including persons with global expertise. / 2. The Expert Group shall advise the Commission with regard to the following: / (a) the list of critical products with digital elements set out in Annex III, as well as on the possible need to update that list; / (b) the implementation of European cybersecurity certification schemes pursuant to Regulation (EU) 2019/881 and on the possibility to make them mandatory for highly critical products with digital elements; / (c) the elements of the Regulation to be address…

Added:(35b) ENISA should establish a secure digital reporting mechanism that, in order to simplify reporting for manufacturers, should serve as a single entry point for reporting obligations established under this Regulation. Manufacturers of products with digital elements are often in a situation where a particular incident, because of its features, needs to be reported to various authorities as a result of notification obligations included in various legal instruments. The mechanism could, where possible, allow other Union law such as Regulation (EU) 2016/679, Directive (EU) 2022/2555 and Directive 2002/58/EC of the European Parliament and of the Council to be reported through the same mechanism. The mechanism may also be used for the voluntary notifications by manufacturers and other entities and actors. ENISA should ensure that they have procedures in place to handle classified information in a secure and confidential manner.

Removed:Stakeholder consultation will be essential to the functioning of this Regulation, which is why the Commission should create and consult extensively the Expert Group on Cyber Resilience.

Added:(35c) Entities and natural persons researching vulnerabilities may in some Member States be exposed to criminal and civil liability. The Commission should issue guidelines with regard to the non-prosecution of information security researchers and an exemption from civil liability for those activities.

Removed:Article 9 a (new): Article 9a / Public procurement of products with digital elements / 1. Without prejudice to Directives 2014/24/EU1 and 2014/25/EU2 of the European Parliament and of the Council, Member States shall ensure, when procuring products with digital elements, a high level of cybersecurity and appropriate expected product lifetimes. / 2. Member States shall ensure that manufacturers remedy vulnerabilities in publicly procured products with digital elements as a matter of urgency, including by making security updates available promptly. / 1 Directive 2014/24/EU of the European Parliament and of the Council of 26 February 2014 on public procurement and repealing Directive 2004/18/EC Text with EEA relevance (OJ L 94, 28.3.2014, p. 65). / 2 Directive 2014/25/EU of the European Parliament and of the Council of 26 February 2014 on procurement by entities operating in the water, energy, transport and postal services sectors and repealing Directive 2004/17/EC Text with EEA relevance (OJ L 94, 28.3.2014, p. 243).

Added:(36) Manufacturers of products with digital elements should put in place coordinated vulnerability disclosure policies to facilitate the reporting of vulnerabilities by individuals or entities either directly to the manufacturer or indirectly, and where requested anonymously, via CSIRTs designated as a coordinator for the purposes of coordinated vulnerability disclosure in accordance with Article 12(1) of Directive (EU) 2022/2555. Manufacturers’ coordinated vulnerability disclosure policy should specify a structured process through which vulnerabilities are reported to a manufacturer in a manner allowing the manufacturer to diagnose and remedy such vulnerabilities before detailed vulnerability information is disclosed to third parties or to the public. Given the fact that information about exploitable vulnerabilities in widely used products with digital elements can be sold at high prices on the black market, manufacturers of such products should be able to use programmes, as part of their coordinated vulnerability disclosure policies, to incentivise the reporting of vulnerabilities by ensuring that individuals or entities receive recognition and compensation for their efforts (so-called ‘bug bounty programmes’).

Removed:It is essential that Member States prioritise cybersecurity in their public procurement.

Added:(36a) Member States and ENISA should make sure that vulnerabilities reported under this Regulation are not used by public bodies for intelligence, surveillance or offensive purposes.

Removed:Article 10 – paragraph 4: 4. For the purposes of complying with the obligation laid down in paragraph 1, manufacturers shall exercise due diligence when integrating components sourced from third parties in products with digital elements. They shall ensure that such components do not compromise the security of the product with digital elements. When integrating components of open-source software that have not been placed on the market in the course of a commercial activity, manufacturers shall ensure that such components comply with this Regulation.

Added:(37) In order to facilitate vulnerability analysis, manufacturers should identify and document components contained in the products with digital elements, including by drawing up a software bill of materials (SBOMs). A SBOM can provide those who manufacture, purchase, and operate software with information that enhances their understanding of the supply chain, which has multiple benefits, most notably it helps manufacturers and users to track known newly emerged vulnerabilities and risks. It is of particular importance for manufacturers to ensure that their products do not contain vulnerable components developed by third parties. Manufacturer should not, however, be obliged to make the software bill of materials public, as this may have unintended consequences on the cybersecurity of their products with digital elements.

Removed:Article 10 – paragraph 6 – subparagraph 1: When placing a product with digital elements on the market, manufacturers shall determine the expected product lifetime of those products. In doing so, the manufacturer shall ensure that the expected product lifetime is in line with reasonable consumer expectations and that it promotes sustainability and the need to ensure long-lasting products with digital elements. Manufacturers shall ensure that vulnerabilities of that product are handled effectively and in accordance with the essential requirements set out in Section 2 of Annex I during at least the expected product lifetime. Where applicable, the expected product lifetime shall be clearly stated on the product, its packaging or be included in contractual agreements.

Added:(38) In order to facilitate assessment of conformity with the requirements laid down by this Regulation, there should be a presumption of conformity for products with digital elements which are in conformity with harmonised standards, which translate the essential requirements of this Regulation into detailed technical specifications, and which are adopted in accordance with Regulation (EU) No 1025/2012 of the European Parliament and of the Council. Regulation (EU) No 1025/2012 provides for a procedure for objections to harmonised standards where those standards do not entirely satisfy the requirements of this Regulation. The standardisation process should ensure a balanced representation of interests and effective participation of civil society stakeholders, including consumer organisations. International standards should also be taken into account, in order to simplify the development of harmonised standards and the implementation of this Regulation, as well as to reduce non-tariff technical barriers to trade.

Removed:The horizontal nature of this Regulation makes it difficult to set the expected product lifetime at a minimum or maximum period of years. Thus, the manufacturer should be able to set the expected product lifetime, provided that this is in line with consumer expectations and it is clearly advertised.

Added:(38a) Considering the broad scope of this Regulation, the timely development of harmonised standards poses a significant challenge. The Commission should ensure that harmonised standards will be in place by the date of application of this Regulation, in order to ensure the successful implementation of this Regulation.

Removed:Article 10 – paragraph 6 – subparagraph 2 a (new): Where applicable, for business-to-consumer products with digital elements, those procedures shall include automatic security updates by default. Users should retain the possibility of de-activating those automatic security updates.

Added:(39) Regulation (EU) 2019/881 establishes a voluntary European cybersecurity certification framework for ICT products, processes and services. European cybersecurity certification schemes can provide a common framework of trust for users to use products with digital elements covered by this Regulation. This Regulation should consequently create synergies with Regulation (EU) 2019/881. In order to facilitate the assessment of conformity with the requirements laid down in this Regulation, products with digital elements that are certified or for which a statement of conformity has been issued under a cybersecurity scheme pursuant to Regulation (EU) 2019/881 and which has been identified by the Commission in an implementing act, shall be presumed to be in compliance with the essential requirements of this Regulation in so far as the cybersecurity certificate or statement of conformity or parts thereof cover those requirements. The need for new European cybersecurity certification schemes for products with digital elements should be assessed in the light of this Regulation. Such future European cybersecurity certification schemes covering products with digital elements should take into account the essential requirements as set out in this Regulation and facilitate compliance with this Regulation. The Commission should be empowered to specify, by means of delegated acts, the European cybersecurity certification schemes that can be used to demonstrate conformity for products with digital elements with the essential requirements set out in this Regulation. Furthermore, in order to avoid undue administrative burden for manufacturers, there should be no obligation for manufacturers to carry out a third-party conformity assessment as provided by this Regulation for corresponding requirements where a cybersecurity certificate has been issued under such European cybersecurity certification schemes, at a substantial or high level.

Removed:Where possible, security updates should be installed automatically.

Added:(39a) In order to facilitate the compliance with this Regulation, the Commission should update the Union rolling work programme and request ENISA to prepare the missing candidate schemes in accordance with Article 48 of Regulation (EU) 2019/881.

Removed:Article 10 – paragraph 6 – subparagraph 2 b (new): Manufacturers shall actively inform users when their product with digital elements has reached the end of its expected product lifetime and vulnerability handling requirements cease to apply.

Added:(40) Upon entry into force of the implementing act setting out the [Commission Implementing Regulation (EU) No …/... of XXX on the European Common Criteria-based cybersecurity certification scheme] (EUCC) which concerns hardware products covered by this Regulation, such as hardware security modules and microprocessors, the Commission may specify, by means of an implementing act, how the EUCC provides a presumption of conformity with the essential requirements as referred to in Annex I of this Regulation or parts thereof. Furthermore, such implementing act may specify how a certificate issued under the EUCC eliminates the obligation for manufacturers to carry out a third-party assessment as requested by this Regulation for corresponding requirements.

Removed:Article 10 – paragraph 6 – subparagraph 2 c (new): Where the expected product lifetime is shorter than five years and the handling of vulnerabilities has therefore ended in accordance with the vulnerability handling requirements set out in Section 2 of Annex I, manufacturers shall provide free access to the source code of such a product with digital elements to undertakings. Those undertakings shall commit to extending the provision of vulnerability handling services, in particular security updates. Access to such source codes shall be provided only where provided for in a contractual arrangement. Those arrangements shall protect the ownership of the product with digital elements and shall prevent the dissemination of the source code to the public. The obligation to provide free access to the source code shall cease to apply when the lifetime of the product has reached five years.

Added:(41) Where no harmonised standards are adopted or where the harmonised standards do not sufficiently address the essential requirements of this Regulation, the Commission should be able to adopt common specifications by means of delegated acts, after taking into account international standards. Such an option should be seen as an exceptional ‘fall back’ solution, where the standardisation processis blocked, where there are undue delays in the establishment of appropriate harmonised standards, or where the deliverables fail to comply with the initial request of the Commission. In order to facilitate assessment of conformity with the essential requirements laid down by this Regulation, there should be a presumption of conformity for products with digital elements that are in conformity with the common specifications adopted by the Commission according to this Regulation for the purpose of expressing detailed technical specifications of those requirements.