A revised version of the Cyber Resilience Act has been shared by the Spanish presidency of the EU Council of Ministers. The updated version focuses on reporting obligations, highly critical products, and product lifetime. The discussions surrounding these changes have informed the final fine-tuning of the text, which will be adopted by the EU Council’s Committee of Permanent Representatives. Simultaneously, the European Parliament’s Industry Committee will also adopt its version of the text. Negotiations between the EU co-legislators are set to begin in September.
One key change in the cybersecurity regulation is the obligation for manufacturers to inform the competent authority if they become aware of any cybersecurity incident or actively exploited vulnerability. This task has been shifted from ENISA, the EU cybersecurity agency, to national Computer Security Incident Response Teams (CSIRTs). The new text encourages member states to establish a single national entry point for reporting requirements. The CSIRT that receives the report will share it with other CSIRTs via a single reporting platform, unless there are justified cybersecurity-related reasons to delay transmission. ENISA will establish the pan-European platform based on specifications developed by the CSIRTs.
The concept of highly critical products, for which the European Commission could mandate EU cybersecurity certification schemes, has been introduced in the Cyber Resilience Act. However, the latest version removed explicit references to ‘highly critical products’. EU countries have reduced the discretion of the EU executive in this regard and introduced a first list of highly critical product categories that can be amended later. The Council text also requires the EU executive to conduct an impact assessment before requesting mandatory certification and consult with relevant stakeholders.
Manufacturers are now required to indicate the expected product lifetime during which users can expect security updates. The elements considered for this calculation have been moved to the preamble of the regulation. Market surveillance authorities can no longer request manufacturers for a justification on how the product lifetime was calculated.
The responsibility to comply with the cybersecurity law now falls on the economic operator that substantially modifies a connected device. However, this responsibility is waived for security patches that do not modify the intended purpose of a product. The new version specifies that excluded security updates include those that decrease the level of cybersecurity risk and products developed or modified exclusively for a public administration entity’s use.
Enforcement of the regulation at the national level will be streamlined through guidance documents issued by EU market surveillance authorities. The regulation’s scope excludes spare parts of connected devices manufactured exclusively to replace identical components, provided they follow the same development and production processes as the original product.