The European Commission has unveiled a new proposal called the Cyber Resilience Act, which aims to impose stricter cybersecurity requirements on internet-connected devices. This includes a wide range of products, from “smart” toys and fridges to security cameras. The proposal would apply to manufacturers of these digitally connected products, regardless of whether they are produced within the EU or not.
The act seeks to ensure that products carrying the CE marking meet a minimum level of cybersecurity checks. Failure to comply with the new requirements could result in fines of up to €15 million or 2.5 percent of worldwide turnover, whichever is higher.
EU Internal Market Commissioner Thierry Breton emphasized the need to protect the IT area, cyberspace, and the internal market. He demonstrated the potential risks associated with internet-connected cameras, including hacking and state-backed espionage.
The legislation includes an annex that outlines two categories for products: critical products, which will cover approximately 10 percent of the market, and all other products. Low-risk products will require companies to perform a self-assessment to indicate compliance with cybersecurity standards. However, manufacturers of products posing significant cybersecurity risks will need to prove compliance either to a national authority or through a third-party assessment.
Commission Vice President Margaritis Schinas highlighted the need to address the cybersecurity aspects of products like mobile phones, which currently escape regulation.
Under the proposed law, the European Commission would have the authority to direct the EU Cybersecurity Agency ENISA to evaluate whether a product presents a “significant cybersecurity risk” and recall it if necessary.
Before becoming law, the new bill will undergo review by the European Parliament and the EU Council.