The European Commission has presented a legislative proposal that introduces mandatory cybersecurity requirements for products that have digital components throughout their lifecycle.

Cyber ​​securityPhoto: Chatree Bamrung | Dreamstime.com

“The European Cyber ​​Resilience Act ensures that the connected objects and software we buy will provide robust cybersecurity safeguards,” says Margrethe Vestager, Executive Vice President of Digital Europe.

A proposal for more secure hardware and software products

The legislation provides that manufacturers will have stricter liability obligations, requiring them to provide security support and software updates to address discovered vulnerabilities.

The commission presented a proposal for new cyber resilience legislation aimed at protecting consumers and businesses from products with inadequate security features. This law, the first of its kind at EU level, introduces mandatory cybersecurity requirements for products that have digital components throughout their entire lifecycle.

The legislation, which was announced by President Ursula von der Leyen in her address to the European Union in September 2021 and builds on the EU Cybersecurity Strategy to 2020 and the EU Strategy for the Security Union to 2020, will ensure that digital products such as wireless communications or wireless products and software are safer for consumers across the EU.

The law will allow consumers to have sufficient information about the cybersecurity of the products they buy and use.

The measures proposed for the products will establish:

  • (a) rules on the placing on the market of products with digital components designed to ensure the cyber security of those products;
  • (b) basic requirements for the design, development and production of products with digital components and the obligations of business entities regarding these products;
  • (c) the essential requirements for the vulnerability management processes implemented by manufacturers to ensure the cybersecurity of products with digital components throughout the entire life cycle, as well as the obligations of economic operators in relation to these processes. Manufacturers will also be required to report actively exploited vulnerabilities and incidents;
  • (d) market monitoring and enforcement.

,“We deserve to feel safe using products bought in the single market. Just as we can trust a CE-marked toy or fridge, the European Cybersecurity Act ensures that the connected objects and software we buy offer strong cybersecurity guarantees. This legislation will hold accountable those who are truly responsible for bringing products to market,” says Margrethe Vestager, Executive Vice President of Digital Ready Europe.

Every 11 seconds, somewhere in the world, an organization becomes the target of ransomware attacks; According to a recent report, in 2021 the annual loss from cybercrime will reach 5.5 trillion euros worldwide.

Photo source: Dreamstime.com