Distributes a software product, in the European Union

Council Directive 85/374/EEC · Read the law's page

• Check whether your software is a 'product' under Article 2 as replaced by Directive 1999/34/EC, which covers all movables, even if incorporated into another movable or into an immovable, and electricity; the definition does not name software.
• Be able to show when you first put each product into circulation: you are not liable if you prove you did not put it into circulation, or that the defect probably did not exist then or came into being afterwards (Art. 7(a) and (b)).
• If you import a product into the Community for sale, hire, leasing or any form of distribution in the course of your business, you answer as its producer (Art. 3(2)); if you supply a product whose producer cannot be identified, you are treated as the producer unless you tell the injured person within a reasonable time who the producer or your own supplier is (Art. 3(3)).
• If you make a component, you are not liable where the defect is attributable to the design of the product the component was fitted in or to the instructions given by that product's manufacturer (Art. 7(f)).
• Do not count on a contract term to limit or exclude your liability to an injured person (Art. 12).
• Keep in mind that the injured person's rights against you are extinguished 10 years after you put the actual product that caused the damage into circulation, unless proceedings have been instituted against you in the meantime (Art. 11).

Directive 2009/24/EC, OJ L 111, 5.5.2009, p. 16 · Read the law's page

• This Directive is addressed to the Member States, which implement it in national law, so an app meets these rules through that law (Art. 12).
• Treat a computer program as protected by copyright as a literary work, in the expression of the program in any form but not in the ideas and principles that underlie any element of it, including those that underlie its interfaces (Art. 1(1) and (2)).
• Get the rightholder's authorisation before permanently or temporarily reproducing a computer program, in part or in whole, including where loading, displaying, running, transmission or storage of it necessitates the reproduction (Art. 4(1)(a)).
• Get the rightholder's authorisation before translating, adapting, arranging or otherwise altering a computer program or reproducing the result, or before distributing the program or copies of it to the public, including by rental (Art. 4(1)(b) and (c)).
• After a first sale of a copy in the Community by the rightholder or with his consent, you need no further authorisation to distribute that copy within the Community, except to rent it (Art. 4(2)).
• A lawful acquirer may, in the absence of specific contractual provisions, do the acts in Art. 4(1)(a) and (b) without authorisation where they are necessary to use the program in accordance with its intended purpose, including for error correction (Art. 5(1)).
• A person with a right to use the program may make a back-up copy as far as necessary for that use, and a contract may not prevent it (Art. 5(2)).
• A person with a right to use a copy may observe, study or test the functioning of the program, to determine the ideas and principles underlying any element of it, while performing the acts of loading, displaying, running, transmitting or storing the program that he is entitled to do (Art. 5(3)).
• Decompile only as Art. 6 allows: reproduction of the code and translation of its form need no authorisation only where indispensable to obtain the information necessary for the interoperability of an independently created program, are done by a licensee or another person with a right to use a copy (or on their behalf), the information was not previously readily available to them, and the acts are confined to the parts of the original program necessary for interoperability (Art. 6(1)).
• Do not use information obtained under Art. 6(1) for goals other than the interoperability of the independently created program, give it to others except when necessary for that interoperability, or use it to develop, produce or market a program substantially similar in expression or for any other act that infringes copyright: Art. 6(1) does not permit those uses (Art. 6(2)).
• A contractual term contrary to Art. 6 or to Art. 5(2) or (3) is null and void (Art. 8).

Regulation (EU) 2019/881, Arts. 53, 55 and 56 · Read the law's page

• It reaches you if you manufacture or provide ICT products, ICT services or ICT processes, or managed security services, that a European cybersecurity certification scheme covers; certification is voluntary unless Union law or Member State law specifies otherwise (Article 56(2)), and a certificate or EU statement of conformity carries legal weight where other law gives it some, as Article 27(8) of Regulation (EU) 2024/2847 and Article 24 of Directive (EU) 2022/2555 do.
• If you hold a European cybersecurity certificate, inform the authority or body that issues it of any subsequently detected vulnerabilities or irregularities concerning the security of the certified product, service, process or managed security service that may have an impact on its compliance with the requirements related to the certification (Article 56(8)).
• If you manufacture or provide a certified ICT product, service or process, or one for which an EU statement of conformity has been issued, make publicly available guidance and recommendations for secure configuration, installation, deployment, operation and maintenance, the period during which security support will be offered, in particular the availability of cybersecurity related updates, your contact information and accepted methods for receiving vulnerability information from end users and security researchers, and a reference to online repositories listing publicly disclosed vulnerabilities and to any relevant cybersecurity advisories (Article 55(1)).
• Keep that information available in electronic form and update it as necessary at least until the certificate or EU statement of conformity expires (Article 55(2)).
• If you issue an EU statement of conformity under a scheme that allows conformity self-assessment, which is permitted only for low-risk products at assurance level basic, assume responsibility for the compliance of the product, service, process or managed security service with the scheme, make the statement, the technical documentation and all other relevant information available to the national cybersecurity certification authority for the period the scheme provides, and submit a copy of the statement to that authority and to ENISA (Article 53(1) to (3)).

Commission Regulation (EU) 2019/424, Annex II, point 1.2.3 · Read the law's page

• It reaches you if you place a server or an online data storage product on the market (Article 1(1)); the Regulation does not apply to servers intended for embedded applications, small scale servers, servers with more than four processor sockets, server appliances, large servers, fully fault tolerant servers, network servers, small data storage products or large data storage products (Article 1(2)). Make the latest available version of the firmware available, free of charge or at a fair, transparent and non-discriminatory cost, from two years after the placing on the market of the first product of a model and for a minimum period of eight years after the placing on the market of the last product of that model (Annex II, point 1.2.3, applying from 1 March 2021 under Article 3).
• Make the latest available security update to the firmware available, free of charge, from the time a product model is placed on the market until at least eight years after the placing on the market of the last product of that model (Annex II, point 1.2.3).

Regulation (EU) 2017/745, Annex I, sections 17.2, 17.4 and 23.4(ab) · Read the law's page

• It reaches you if you are a manufacturer that places on the EU market, or puts into service, a medical device, which includes software intended by the manufacturer to be used for human beings for a specific medical purpose, whether the software is incorporated in a device or is a device in itself (Articles 2, point (1), 5(2) and 10(1)).
• Develop and manufacture the software in accordance with the state of the art, taking into account the principles of development life cycle, risk management, including information security, verification and validation (Annex I, section 17.2).
• Where the software is intended to be used in combination with mobile computing platforms, design and manufacture it taking into account the specific features of the mobile platform and the external factors related to their use (section 17.3).
• Set out minimum requirements concerning hardware, IT networks characteristics and IT security measures, including protection against unauthorized access, necessary to run the software as intended (section 17.4).
• Include those minimum requirements in the instructions for use of a device that incorporates electronic programmable systems, including software, or of software that is a device in itself (section 23.4, point (ab)).
• A device with a valid certificate issued under Directive 90/385/EEC or Directive 93/42/EEC may be placed on the market or put into service until the dates fixed in Article 120(3a) and (3b) only if the conditions of Article 120(3c) are met.

Regulation (EU) 2017/745, Annex VIII, Chapter III, Rule 11 · Read the law's page

• Classify software intended to provide information which is used to take decisions with diagnosis or therapeutic purposes as class IIa under Rule 11 (Annex VIII, point 6.3), as class III if such decisions have an impact that may cause death or an irreversible deterioration of a person's state of health, and as class IIb if they may cause a serious deterioration of a person's state of health or a surgical intervention.
• Classify software intended to monitor physiological processes as class IIa, or as class IIb if it is intended for monitoring of vital physiological parameters whose variations could result in immediate danger to the patient (Annex VIII, point 6.3, Rule 11).
• Classify all other software as class I; classify software which drives a device or influences the use of a device in the same class as the device, and software independent of any other device in its own right (Annex VIII, points 3.3 and 6.3).
• Before placing the software on the market, undergo the conformity assessment for its class (Article 52): for class III, Annex IX, or Annex X coupled with Annex XI; for class IIb, Chapters I and III of Annex IX with an assessment of the technical documentation of at least one representative device per generic device group, or Annex X coupled with Annex XI; for class IIa, Chapters I and III of Annex IX with an assessment of the technical documentation of at least one representative device for each category of devices, or the technical documentation in Annexes II and III coupled with Section 10 or Section 18 of Annex XI.
• For class I software, draw up the technical documentation set out in Annexes II and III and issue the EU declaration of conformity referred to in Article 19 before placing it on the market (Article 52(7)).
• If the software is an AI system, or an AI system is a safety component of the device, establish whether the device is required to undergo a third-party conformity assessment under the Regulation: Regulation (EU) 2024/1689 makes the AI system high-risk under Article 6(1) where it is itself such a product, or a safety component of one, covered by the Union harmonisation legislation listed in Annex I, which lists Regulation (EU) 2017/745, and the product is required to undergo a third-party conformity assessment.
• If your software was a device under Directive 93/42/EEC that needed no notified body, with a declaration of conformity drawn up before 26 May 2021, and the Regulation now requires a notified body for it, you may keep placing it on the market until 31 December 2028 only while you meet the conditions of Article 120(3c).

Regulation (EU) 2021/821, Art. 4 · Read the law's page

• Obtain an authorization before you export software not listed in Annex I if the competent authority has informed you that it is or may be intended wholly or partly for a weapons of mass destruction use or for a military end-use in a country under an arms embargo (Regulation (EU) 2021/821 Art. 4(1)).
• Notify the competent authority if you are aware that software you propose to export, not listed in Annex I, is intended for any of those uses; the authority decides whether an authorization is required (Art. 4(2)).

Regulation (EU) 2021/821, Art. 5 · Read the law's page

• Obtain an authorization before you export cyber-surveillance items not listed in Annex I if the competent authority has informed you that they are or may be intended wholly or partly for use in connection with internal repression or serious violations of human rights and international humanitarian law (Regulation (EU) 2021/821 Art. 5(1)).
• Notify the competent authority if your due diligence shows that cyber-surveillance items you propose to export, not listed in Annex I, are intended for such a use; the authority decides whether an authorization is required (Art. 5(2)).

Regulation (EU) 2017/746, Annex I, sections 16.2, 16.4 and 20.4.1(ah) · Read the law's page

• It reaches you if you are a manufacturer that places on the EU market, or puts into service, an in vitro diagnostic medical device, which includes software intended by the manufacturer to be used in vitro for the examination of specimens derived from the human body, whether the software is incorporated in a device or is a device in itself (Articles 2, point (2), and 10(1)).
• Develop and manufacture the software in accordance with the state of the art, taking into account the principles of development life cycle, risk management, including information security, verification and validation (Annex I, section 16.2).
• Where the software is intended to be used in combination with mobile computing platforms, design and manufacture it taking into account the specific features of the mobile platform and the external factors related to their use (section 16.3).
• Set out minimum requirements concerning hardware, IT networks characteristics and IT security measures, including protection against unauthorized access, necessary to run the software as intended (section 16.4).
• Include those minimum requirements in the instructions for use of a device that incorporates electronic programmable systems, including software, or of software that is a device in itself (section 20.4.1, point (ah)).
• A device with a valid certificate issued under Directive 98/79/EC, or one declared to conform under that Directive without a notified body, may be placed on the market or put into service until the dates fixed in Article 110(3a) and (3b) only if the conditions of Article 110(3c) are met.

Regulation (EU) 2018/858, Annex II item H2 and Annex IV point 5, as inserted by Delegated Regulation (EU) 2022/2236 · Read the law's page

• It reaches you if you manufacture vehicles of the categories for which the table in Part I of Annex II to Regulation (EU) 2018/858 marks item H2: establish a software update management system as part of your conformity of production arrangements, and make that system and the whole vehicle type comply with UN Regulation No 156 (Annex IV, point 5, as added by Delegated Regulation (EU) 2022/2236).
• Meet that requirement from 6 July 2022 for a new type of vehicle where you execute software updates that affect type-approved characteristics after registration: national authorities refuse type-approval to a new type that does not comply (Article 2(1)).
• From 7 July 2024, national authorities also refuse type-approval, on grounds relating to software update, to any new type that does not comply, treat certificates of conformity for new vehicles as no longer valid, and prohibit the registration, placing on the market or entry into service of vehicles that do not comply (Article 2(3) and (4)).
• For new complete vehicles those certificate and registration consequences apply from 7 July 2026, and for new completed vehicles from 7 July 2029 (Article 2(7) and (8)).

Regulation (EU) 2019/2144, Art. 4(5)(d) and Annex II, item D4 · Read the law's page

• It reaches you if you are a manufacturer of vehicles, or of the systems, components and separate technical units designed and constructed for them, in the categories for which Annex II marks item D4: ensure that the vehicle, system, component or separate technical unit complies with the requirement for protection of the vehicle against cyberattacks listed there, which item D4 meets through UN Regulation No 155, named in the row since Delegated Regulation (EU) 2022/1398 took effect on 5 September 2022 (Articles 2 and 4(5), point (d)).
• Meet that requirement from the dates in note B of Annex II: national authorities refuse EU type-approval to a new type that does not comply from 6 July 2022, and prohibit the registration of vehicles that do not comply, and the placing on the market and entry into service of components and separate technical units that do not comply, from 7 July 2024 (Article 16).

Regulation (EU) 2022/1925 · Read the law's page

• If you provide a core platform service and meet the thresholds in Article 3(2), notify the Commission without delay and in any event within 2 months after the thresholds are met, with the information identified in Article 3(2) for each core platform service that meets them (Article 3(3)).
• If the Commission designates you as a gatekeeper, comply with Articles 5, 6 and 7 for each core platform service listed in the designation decision within 6 months after it is listed, and ensure and demonstrate compliance with them (Article 3(10) and Article 8(1)).
• Do not combine or cross-use the personal data of end users across your core platform services or other services, or sign end users in to other services to combine it, unless the end user has been presented with the specific choice and has given consent within the meaning of Regulation (EU) 2016/679, and do not repeat a refused consent request for the same purpose more than once within one year (Article 5(2)).
• Do not prevent business users from offering the same products or services at different prices or conditions through other channels, and do not require end users or business users to use, offer or interoperate with your identification service, web browser engine or payment service (Article 5(3) and (7)).
• Allow and technically enable end users to easily un-install software applications on your operating system and to easily change the default settings of your operating system, virtual assistant and web browser, and allow and technically enable the installation and effective use of third-party software applications and software application stores that use or interoperate with your operating system (Article 6(3) and (4)).
• Do not treat your own services and products more favorably in ranking and related indexing and crawling than similar services or products of a third party, and apply transparent, fair and non-discriminatory conditions to the ranking (Article 6(5)).
• Give providers of services and of hardware, free of charge, effective interoperability with the same hardware and software features accessed or controlled via your operating system or virtual assistant that are available to your own services or hardware (Article 6(7)).
• Give end users effective portability of the data they provide or generate in using your core platform service, with free tools and continuous real-time access, and give business users, at their request and free of charge, effective, high-quality, continuous and real-time access to the data generated in the use of your core platform services (Article 6(9) and (10)).
• Apply fair, reasonable and non-discriminatory general conditions of access for business users to your software application stores, online search engines and online social networking services, and publish those conditions with an alternative dispute settlement mechanism (Article 6(12)).
• If you provide a number-independent interpersonal communications service listed in the designation decision, make its basic functionalities interoperable, on request and free of charge, with the services of another provider offering or intending to offer such services in the Union, preserve the level of security including end-to-end encryption, and publish a reference offer with the technical details and general terms and conditions (Article 7).
• Provide the Commission, within 6 months after designation and at least annually after that, with a report on the measures you have implemented to comply with Articles 5, 6 and 7, and publish a non-confidential summary of it (Article 11).
• Inform the Commission of any intended concentration where the merging entities or the target provide core platform services or other services in the digital sector or enable the collection of data, before the concentration is implemented, whether or not it is notifiable under merger rules (Article 14).
• Submit to the Commission, within 6 months after designation, an independently audited description of the techniques you apply for profiling of consumers, and publish an overview of it, updated at least annually (Article 15).

Regulation (EU) 2023/988, Arts. 5, 6(1) and 13(3) · Read the law's page

• It reaches you if you are a manufacturer that places on the EU market a product intended for consumers, or likely to be used by them, including a product interconnected to other items: ensure it is a safe product, designed and manufactured in accordance with the general safety requirement (Articles 3, point (1), 5 and 9(1)).
• It applies only insofar as no specific provision of Union law with the same objective regulates the safety of the product, and where Union harmonisation legislation covers a risk, Chapter II, which holds Articles 5 and 6, does not apply to that risk (Article 2(1)).
• When you assess whether the product is safe, take into account, where required by the nature of the product, the appropriate cybersecurity features necessary to protect it against external influences, including malicious third parties, where such an influence might have an impact on its safety, including the possible loss of interconnection (Article 6(1), point (g)).
• Take into account, where required by the nature of the product, its evolving, learning and predictive functionalities (point (h)) and the effect of non-embedded items that are meant to determine, change or complete the way the product works (point (c)).
• If you are not the manufacturer and you modify a product by physical or digital means in a way that has an impact on its safety, was not foreseen in the initial risk assessment, changes the nature of the hazard, creates a new hazard or raises the level of risk, and is not made by consumers themselves or on their behalf for their own use, you are deemed to be the manufacturer and carry the Article 9 obligations for the part of the product affected, or for the entire product if its safety is affected (Article 13(2) and (3)).

Commission Implementing Regulation (EU) 2024/482, Arts. 32-34 and 36 · Read the law's page

• It reaches you if you hold an EUCC certificate for an ICT product issued under the European Common Criteria-based cybersecurity certification scheme; Chapter VI applies to ICT products for which an EUCC certificate was issued (Article 32). Establish and maintain all necessary vulnerability management procedures in accordance with Chapter VI, supplemented where necessary by the procedures set out in EN ISO/IEC 30111 (Article 33(1)).
• Maintain and publish appropriate methods for receiving information on vulnerabilities related to your products from external sources, including users, certification bodies and security researchers (Article 33(2)).
• When you detect or receive information about a potential vulnerability affecting a certified ICT product, record it and carry out a vulnerability impact analysis (Article 33(3)).
• Refer the vulnerability impact analysis to the target of evaluation and the assurance statements contained in the certificate, carry it out in a timeframe appropriate for the exploitability and criticality of the potential vulnerability and, where applicable, perform an attack potential calculation to determine its exploitability, taking the AVA_VAN level of the certificate into account (Article 34(1) and (2)).
• When a potential vulnerability impacts a composite product, inform the holders of dependent EUCC certificates (Article 33(4)).
• In response to a reasonable request by the certification body that issued the certificate, transmit all relevant information about potential vulnerabilities to that certification body (Article 33(5)).
• Where the vulnerability impact analysis report determines that a vulnerability is not residual and can be remedied, submit a proposal for an appropriate remedial action to the certification body (Article 35(5) and Article 36).

Commission Implementing Regulation (EU) 2024/482, Arts. 35 and 39 · Read the law's page

• It reaches you if you hold an EUCC certificate for an ICT product (Article 32). Where your vulnerability impact analysis shows that a vulnerability has a likely impact on the conformity of the ICT product with its certificate, produce a vulnerability impact analysis report that assesses the impact of the vulnerability on the certified ICT product, possible risks associated with the proximity or availability of an attack, whether the vulnerability may be remedied and, where it may, possible resolutions (Article 35(1) and (2)).
• Include in the report, where applicable, details about the possible means of exploitation of the vulnerability, and handle that information under appropriate security measures that protect its confidentiality and ensure, where necessary, its limited distribution (Article 35(3)).
• Transmit the report to the certification body or the national cybersecurity certification authority, in accordance with Article 56(8) of Regulation (EU) 2019/881, without undue delay (Article 35(4)).
• Monitor any residual vulnerabilities to ensure that they cannot be exploited if the operational environment changes (Article 35(7)).
• Upon withdrawal of the certificate, disclose and register any publicly known and remediated vulnerability in the ICT product on the European vulnerability database established under Article 12 of Directive (EU) 2022/2555, or on the other online repositories referred to in Article 55(1), point (d), of Regulation (EU) 2019/881 (Article 39).

Commission Regulation (EU) 2023/1670, Annex II, Parts A, B and D · Read the law's page

• It reaches you if you are the manufacturer, importer or authorized representative of a smartphone, a mobile phone other than a smartphone or a slate tablet that you place on the market (Article 1(1)); the Regulation does not apply to mobile phones and tablets with a flexible main display that the user can unroll and roll up, or to smartphones for high security communication (Article 1(2)). If you provide security updates, corrective updates or functionality updates to the operating system of a product model, make them available at no cost for all units of that model from the date of end of placement on the market to at least 5 years after that date, whether you offer them voluntarily or provide them to comply with Union law (Annex II, Part A point (6), Part B point (6), Part D point (5)).
• Make security updates and corrective updates available to the user at the latest 4 months after the public release of the source code of an update of the underlying operating system or, if the source code is not publicly released, after an update of the same operating system is released by the operating system provider or on any other product of the same brand (Annex II, point (6)(c) or (5)(c)).
• Make functionality updates available to the user at the latest 6 months after the corresponding release (Annex II, point (6)(d) or (5)(d)).
• For a smartphone or a slate tablet, where a functionality update you provide shows a negative impact on device performance, modify the released operating system to ensure at least the same performance as before the update, within a reasonable period of time, free of charge and without causing significant inconvenience to the end-user, unless the end-user gave explicit consent to the negative impact before the update (Annex II, Part B point (6)(f), Part D point (5)(f)).

Directive (EU) 2019/882, Arts. 2(1) and 7 to 12, Annex I Sections I and II · Read the law's page

• This duty reaches you through the law of each Member State that transposes the Directive, where you place on the Union market after 28 June 2025 a consumer general purpose computer hardware system (including personal computers, notebooks, smartphones and tablets) or an operating system for one, a payment terminal, an automated teller machine, ticketing machine, check-in machine or interactive self-service terminal providing information that is dedicated to the provision of services covered by the Directive (other than a terminal installed as an integrated part of a vehicle, aircraft, ship or rolling stock), consumer terminal equipment with interactive computing capability used for electronic communications services or for accessing audiovisual media services, or an e-reader (Article 2(1) and Article 3(39)).
• Design and produce the product so that it complies with the accessibility requirements of Annex I, Section I, and, except for self-service terminals, Section II, in a way that maximizes its foreseeable use by persons with disabilities (Article 4(2), Article 7(1)).
• Give the product, including its user interface, the features, elements and functions that let persons with disabilities access, perceive, operate, understand and control it: provide communication, operation, information, control and orientation via more than one sensory channel, with alternatives to vision, auditory, speech and tactile elements; provide alternatives to speech and vocal input; provide flexible magnification, brightness and contrast and interoperability with programs and assistive devices to navigate the interface; provide an alternative to color and to audible signals where they convey information, indicate an action, require a response or identify elements; provide flexible ways of improving vision clarity; provide user control of volume and speed and enhanced audio features; provide sequential control and alternatives to fine motor control, with tactilely discernible parts; avoid modes of operation requiring extensive reach and great strength; avoid triggering photosensitive seizures; protect the user's privacy when accessibility features are used; provide an alternative to biometrics identification and control; keep the functionality consistent and give enough, and flexible amounts of, time for interaction; and provide software and hardware for interfacing with assistive technologies (Annex I, Section I, point 2, points (a) to (n)).
• If the product is a self-service terminal, provide text-to-speech technology, allow the use of personal headsets, alert the user via more than one sensory channel where a timed response is required and give the possibility to extend the time given, provide adequate contrast and tactilely discernible keys and controls where keys and controls are available, do not require an accessibility feature to be activated in order to enable a user who needs it to turn it on, and, where it uses audio or audible signals, make it compatible with assistive devices and technologies available at Union level, including hearing technologies; if it is an e-reader, provide text-to-speech technology (Annex I, Section I, point 2(o), items (i) and (ii)).
• If the product is consumer terminal equipment with interactive computing capability used for electronic communications services, handle real time text and support high fidelity audio where it has text capability in addition to voice, handle total conversation, including synchronized voice, real time text and video with a resolution enabling sign language communication, where it has video capabilities, ensure effective wireless coupling to hearing technologies and avoid interferences with assistive devices; if it is used for accessing audiovisual media services, make available to persons with disabilities the accessibility components provided by the audiovisual media service provider, for user access, selection, control and personalization and for transmission to assistive devices (Annex I, Section I, point 2(o), items (iii) and (iv)).
• Provide the information on the use of the product given on the product itself (labeling, instructions and warning), and the instructions for use, via more than one sensory channel, in an understandable way, in ways users can perceive, and in fonts of adequate size and suitable shape with sufficient contrast and adjustable spacing; make instructions not provided on the product itself publicly available when the product is placed on the market, in text formats that can be used to generate alternative assistive formats, with an alternative presentation of any non-textual content, and with a description of the user interface, of the functionality that addresses the needs of persons with disabilities and of the software and hardware interfacing with assistive devices, including a list of the assistive devices tested with the product (Annex I, Section I, point 1). Unless the product is a self-service terminal, make its packaging and its installation, maintenance, storage and disposal instructions accessible (Annex I, Section II). Where support services are available (help desks, call centers, technical support, relay services and training services), have them provide information on the accessibility of the product and its compatibility with assistive technologies, in accessible modes of communication (Annex I, Section I, point 3).
• As a manufacturer, draw up the technical documentation in accordance with Annex IV, carry out the conformity assessment procedure or have it carried out, draw up an EU declaration of conformity and affix the CE marking, visibly, legibly and indelibly and before the product is placed on the market, where compliance has been demonstrated, and keep the technical documentation and the EU declaration of conformity for five years after the product has been placed on the market (Article 7(2) and (3), Article 18(1) and (2)). Where you rely on Article 14, state in the EU declaration of conformity which accessibility requirements are subject to that exception (Article 16(1)).
• As a manufacturer, keep procedures in place so that series production remains in conformity, give each product a type, batch or serial number or other element allowing its identification, indicate your name, registered trade name or registered trade mark and a single address at which you can be contacted on the product, its packaging or an accompanying document, and make sure the product is accompanied by instructions and safety information in a language which can be easily understood by consumers and other end-users, as determined by the Member State concerned (Article 7(4) to (7)).
• As a manufacturer who considers or has reason to believe that a product you placed on the market is not in conformity, immediately take the corrective measures necessary or withdraw it, inform the competent national authorities of the Member States in which you made it available, keep a register of non-complying products and related complaints, and give a competent national authority on a reasoned request all the information and documentation necessary to demonstrate conformity (Article 7(8) and (9)).
• As an importer, place only compliant products on the market; before placing a product on the market, make sure the manufacturer has carried out the conformity assessment procedure, drawn up the technical documentation, affixed the CE marking and met Article 7(5) and (6); do not place a product you believe is not in conformity on the market until it is brought into conformity, and inform the manufacturer and the market surveillance authorities where it does not comply; indicate your name, registered trade name or registered trade mark and contact address on the product, its packaging or an accompanying document; make sure the product is accompanied by instructions and safety information in a language which can be easily understood by consumers and other end-users; make sure storage or transport conditions under your responsibility do not jeopardize its compliance; keep a copy of the EU declaration of conformity for five years and make sure the technical documentation can be made available on request; and where a product you placed on the market is not in conformity, take the corrective measures or withdraw it, immediately inform the competent national authorities, keep a register of non-complying products and related complaints, and provide information and cooperate on a reasoned request (Article 9(1) to (9)).
• As a distributor, act with due care in relation to the requirements of the Directive; before making a product available, verify that it bears the CE marking, is accompanied by the required documents and by instructions and safety information in a language which can be easily understood by consumers and other end-users in the Member State concerned, and that the manufacturer and the importer have met Article 7(5) and (6) and Article 9(4); do not make a product you believe is not in conformity available until it is brought into conformity, and inform the manufacturer or the importer and the market surveillance authorities where it does not comply; make sure storage or transport conditions under your responsibility do not jeopardize its compliance; where a product you made available is not in conformity, make sure the corrective measures or withdrawal are taken and immediately inform the competent national authorities; and provide information and cooperate on a reasoned request (Article 10(1) to (6)).
• If you are an importer or distributor and you place a product on the market under your name or trademark, or modify a product already placed on the market in such a way that compliance may be affected, you are subject to the obligations of a manufacturer under Article 7 (Article 11).
• On request, identify to the market surveillance authorities any economic operator who supplied you with a product and any to whom you supplied one, and be able to do so for five years after the supply (Article 12(1) and (2)).
• Cooperate fully with a market surveillance authority's evaluation of a product it has sufficient reason to believe does not comply, take the corrective action it requires within the period it prescribes, and make sure that action is taken in respect of all the products concerned that you have made available on the market throughout the Union (Article 20(1) and (3)).
• You may rely on fundamental alteration or disproportionate burden only to the extent that compliance would require a significant change that results in the fundamental alteration of the basic nature of the product or would impose a disproportionate burden. Carry out an assessment of either ground, judging disproportionate burden against the criteria in Annex VI, document it, keep all relevant results for five years from the last making available of the product on the market, give a copy of the assessment to the market surveillance authorities on request, and send information that you rely on this ground to the market surveillance authorities of the Member State where the product is placed on the market (Article 14(1), (2), (3) and (8)). A microenterprise dealing with products need not document the assessment or send that information, but if it has chosen to rely on Article 14(1) it provides a market surveillance authority that so requests with the facts relevant to the assessment (Article 14(4) and (8)). You cannot rely on disproportionate burden where you receive funding, public or private, from other sources than your own resources that is provided for the purpose of improving accessibility (Article 14(6)).

Commission Delegated Regulation (EU) 2022/30, Arts. 1 to 3 · Read the law's page

• Directive 2014/53/EU is addressed to the Member States, which adopted its measures by 12 June 2016 and apply them from 13 June 2016 (Article 49(1)), so you meet its rules through each Member State's transposing law; Delegated Regulation (EU) 2022/30, directly applicable and applying from 1 August 2025, decides which radio equipment each of the three essential requirements below reaches.
• It reaches you if you are a manufacturer that places on the EU market radio equipment that can communicate itself over the internet, directly or via any other equipment: design and manufacture it so that it does not harm the network or its functioning nor misuse network resources, thereby causing an unacceptable degradation of service (Article 3(3), point (d) of the Directive; Article 1(1) of the Regulation).
• If that equipment, radio equipment designed or intended exclusively for childcare, radio equipment covered by Directive 2009/48/EC on the safety of toys, or radio equipment designed or intended to be worn on, strapped to, or hung from the human body or clothing is capable of processing personal data, or traffic data or location data, design and manufacture it to incorporate safeguards that protect the personal data and privacy of the user and of the subscriber (point (e); Article 1(2)).
• If internet-connected radio equipment enables the holder or user to transfer money, monetary value or virtual currency, design and manufacture it to support features that protect against fraud (point (f); Article 1(3)).
• Radio equipment to which Regulation (EU) 2017/745 or Regulation (EU) 2017/746 also applies is outside all three requirements, and radio equipment to which Regulation (EU) 2018/1139, Regulation (EU) 2019/2144 or Directive (EU) 2019/520 also applies is outside points (e) and (f) (Article 2).

Regulation (EU) 2023/2854, Art. 36 · Read the law's page

• It reaches you if you are the vendor of an application using smart contracts or, in the absence of one, the person whose trade, business or profession involves deploying smart contracts for others, in the context of executing an agreement, or part of one, to make data available (Article 36(1); Article 1(3), point (g)). Make those smart contracts robust and access-controlled: design them to offer access control mechanisms and a very high degree of robustness to avoid functional errors and to withstand manipulation by third parties (Article 36(1), point (a)).
• Build into the smart contract a mechanism to terminate the continued execution of transactions, with internal functions that can reset or instruct the contract to stop or interrupt the operation, in particular to avoid future accidental executions (Article 36(1), point (b)).
• Provide, for the case in which a smart contract must be terminated or deactivated, a possibility to archive the transactional data, the smart contract logic and the code, to keep the record of operations performed on the data in the past (Article 36(1), point (c)).
• Protect the smart contract through rigorous access control mechanisms at the governance and smart contract layers, and keep it consistent with the terms of the data sharing agreement that it executes (Article 36(1), points (d) and (e)).
• Perform a conformity assessment against those essential requirements and, once they are fulfilled, issue an EU declaration of conformity, by which you become responsible for compliance with them (Article 36(2) and (3)).

Regulation (EU) 2023/2854, Arts. 3-5 · Read the law's page

• For connected products, and the services related to them, placed on the market after 12 September 2026 (Article 50), design and manufacture the connected product, and design and provide the related service, so that product data and related service data, including the relevant metadata necessary to interpret and use those data, are by default easily, securely, free of charge, in a comprehensive, structured, commonly used and machine-readable format and, where relevant and technically feasible, directly accessible to the user (Article 3(1)).
• Before concluding a contract for the purchase, rent or lease of a connected product, and as the seller, rentor or lessor (which may be the manufacturer), give the user in a clear and comprehensible manner at least the type, format and estimated volume of product data the product is capable of generating, whether it is capable of generating data continuously and in real-time, whether it is capable of storing data on-device or on a remote server (with the intended duration of retention, where applicable), and how the user may access, retrieve or, where relevant, erase the data, including the technical means and the terms of use and quality of service (Article 3(2)).
• Before concluding a contract for the provision of a related service, and as the provider of the related service, give the user in a clear and comprehensible manner at least the information listed in Article 3(3), points (a) to (i), among them the nature, estimated volume and collection frequency of the product data the prospective data holder is expected to obtain, whether it expects to use readily available data itself and for which purposes, how the user can request that the data are shared with a third party, the user's right to lodge a complaint with the competent authority designated under Article 37, and the duration of the contract and the arrangements for terminating it (Article 3(3)).
• Where data cannot be directly accessed by the user from the connected product or related service, make readily available data, as well as the relevant metadata necessary to interpret and use those data, accessible to the user without undue delay, of the same quality as is available to the data holder, easily, securely, free of charge, in a comprehensive, structured, commonly used and machine-readable format and, where relevant and technically feasible, continuously and in real-time, on the basis of a simple request through electronic means where technically feasible (Article 4(1)).
• Do not make the exercise of choices or rights under Article 4 by the user unduly difficult, including by offering choices to the user in a non-neutral manner or by subverting or impairing the autonomy, decision-making or choices of the user via the structure, design, function or manner of operation of a user digital interface or a part thereof (Article 4(4)).
• To verify whether a person qualifies as a user, do not require that person to provide any information beyond what is necessary, and do not keep any information, in particular log data, on the user's access to the data requested beyond what is necessary for the sound execution of the user's access request and for the security and maintenance of the data infrastructure (Article 4(5)).
• Identify the data protected as trade secrets, including in the relevant metadata, and agree with the user the proportionate technical and organizational measures necessary to preserve the confidentiality of the shared data, in particular in relation to third parties (Article 4(6)).
• Where the data holder refuses to share data pursuant to Article 4, notify the competent authority designated under Article 37 (Article 4(2)); where the data holder withholds or suspends the sharing of data identified as trade secrets (Article 4(7)), or refuses a request on the ground of serious economic damage from the disclosure of trade secrets (Article 4(8)), also give the user a duly substantiated decision in writing without undue delay (Article 4(7) and (8)).
• Where the user is not the data subject whose personal data is requested, make personal data generated by the use of a connected product or related service available to the user only where there is a valid legal basis for processing under Article 6 of Regulation (EU) 2016/679 and, where relevant, the conditions of Article 9 of that Regulation and of Article 5(3) of Directive 2002/58/EC are fulfilled (Article 4(12)).
• Use readily available data that is non-personal data only on the basis of a contract with the user, and do not use it to derive insights about the economic situation, assets and production methods of, or the use by, the user in any other manner that could undermine the commercial position of that user on the markets in which the user is active (Article 4(13)).
• Do not make non-personal product data available to third parties for commercial or non-commercial purposes other than the fulfillment of the data holder's contract with the user, and where relevant contractually bind third parties not to further share the data received (Article 4(14)).
• Upon request by a user, or by a party acting on behalf of a user, make readily available data, as well as the relevant metadata necessary to interpret and use those data, available to a third party without undue delay, of the same quality as is available to the data holder, easily, securely, free of charge to the user, in a comprehensive, structured, commonly used and machine-readable format and, where relevant and technically feasible, continuously and in real-time, in accordance with Articles 8 and 9 (Article 5(1)).
• Treat an undertaking designated as a gatekeeper pursuant to Article 3 of Regulation (EU) 2022/1925 as not an eligible third party under Article 5 (Article 5(3)).
• To verify whether a person qualifies as a user or as a third party, do not require that person to provide any information beyond what is necessary, and do not keep any information on the third party's access to the data requested beyond what is necessary for the sound execution of the third party's access request and for the security and maintenance of the data infrastructure (Article 5(4)).
• Do not use any readily available data to derive insights about the economic situation, assets and production methods of, or the use by, the third party in any other manner that could undermine the commercial position of the third party on the markets in which the third party is active, unless the third party has given permission to such use and has the technical possibility to easily withdraw that permission at any time (Article 5(6)).
• Where the user is not the data subject whose personal data is requested, make personal data generated by the use of a connected product or related service available to the third party only where there is a valid legal basis for processing under Article 6 of Regulation (EU) 2016/679 and, where relevant, the conditions of Article 9 of that Regulation and of Article 5(3) of Directive 2002/58/EC are fulfilled (Article 5(7)).
• Do not let a failure to agree with the third party on arrangements for transmitting the data hinder, prevent or interfere with the exercise of the rights of the data subject under Regulation (EU) 2016/679, in particular the right to data portability under Article 20 of that Regulation (Article 5(8)).
• Identify the data protected as trade secrets, including in the relevant metadata, agree with the third party all proportionate technical and organizational measures necessary to preserve the confidentiality of the shared data, and disclose trade secrets to third parties only to the extent that disclosure is strictly necessary to fulfill the purpose agreed between the user and the third party (Article 5(9)).
• Where the data holder withholds or suspends the sharing of data identified as trade secrets (Article 5(10)), or refuses a request on the ground of serious economic damage from the disclosure of trade secrets (Article 5(11)), give the third party a duly substantiated decision in writing without undue delay and notify the competent authority designated under Article 37 (Article 5(10) and (11)).

Regulation (EU) 2025/2392, Art. 2 and Annexes I and II · Read the law's page

• This classification reaches you where you are a manufacturer placing on the EU market a product with digital elements whose core functionality meets a technical description in Annex I (important products, class I or class II) or Annex II (critical products), under Regulation (EU) 2024/2847.
• Decide by your product's core functionality, not by an incidental or integrated function, whether it meets a technical description: a product that performs additional functions can still have the core functionality of a category, and a product that can perform a category's functions but has a different core functionality does not meet that description (recitals 4 and 5).
• Where a component of your product meets a technical description, classify the product as a whole rather than treating the whole product as important or critical on that account, and still demonstrate that the whole product, including the integrated component, meets the essential cybersecurity requirements (Article 7(1) of Regulation (EU) 2024/2847 and recital 3).
• Demonstrate conformity of a product that meets a description in Annex I through the procedures of Article 32(2) and (3) of Regulation (EU) 2024/2847, and of a product that meets a description in Annex II through Article 32(4) of that Regulation.

Regulation (EU) 2024/2847, Art. 14 · Read the law's page

• The reporting obligations of Article 14 apply to a product with digital elements from 11 September 2026.
• Notify the CSIRT designated as coordinator for your main establishment and ENISA, through the single reporting platform, of any actively exploited vulnerability you become aware of in your product: an early warning within 24 hours of becoming aware, a vulnerability notification within 72 hours, and a final report no later than 14 days after a corrective or mitigating measure becomes available, the notification and the final report each unless the relevant information has already been provided.
• Notify the same recipients of any severe incident affecting the security of your product on the same 24-hour early warning and 72-hour incident notification clock, followed by a final report within one month of the incident notification; the incident notification and the final report each apply unless the relevant information has already been provided. For either an exploited vulnerability or a severe incident, give the CSIRT an intermediate report on relevant status updates if it asks for one.
• After becoming aware of the vulnerability or incident, inform the affected users, and where appropriate all users, of it and of any risk mitigation or corrective measures they can take.
• Apply this to every product with digital elements within the Regulation's scope that you have on the EU market, including one placed there before 11 December 2027, because Article 69(3) exempts Article 14 from the transitional rule that spares existing products until they are substantially modified. Article 2 leaves out, among others, products covered by Regulations (EU) 2017/745, (EU) 2017/746 and (EU) 2019/2144, products certified under Regulation (EU) 2018/1139, equipment within Directive 2014/90/EU, spare parts that replace identical components, and products developed or modified exclusively for national security or defence purposes.

Directive (EU) 2024/2853 · Read the law's page

• The Directive does not apply to free and open-source software that you develop or supply outside the course of a commercial activity (Art. 2(2)).
• If you develop or produce software, or have it developed under your name or trademark, and make it available in the course of a commercial activity, you answer as its manufacturer for damage it causes by a defect (Arts. 4(1), 4(10) and 8(1)(a)).
• Keep supplying the software updates and upgrades needed to keep the product safe while it is within your control; a defect caused by their absence, or by software, updates or upgrades within your control, is not excused because it arose after you placed the product on the market (Art. 11(2)(b) and (c)).
• Meet the product safety requirements that apply to your product, safety-relevant cybersecurity requirements included: they count in deciding whether it is defective (Art. 7(2)(f)), and failing a mandatory product safety requirement that protects against the damage suffered presumes it defective (Art. 10(2)(b)).
• Account for what your product learns or acquires after release: the effect of any ability to continue to learn or acquire new features after it is placed on the market is weighed in deciding whether it is defective (Art. 7(2)(c)).
• Keep technical documentation you could produce if a court orders disclosure; failing to disclose presumes the product defective (Arts. 9(1), 10(2)(a)).
• If you are outside the EU, the importer or your authorized representative answers for the product in your place (Art. 8(1)(c)).
• If you substantially modify a product outside its manufacturer's control and then make it available on the market or put it into service, you are treated as its manufacturer (Art. 8(2)).
• Do not count on a contract term to limit or exclude your liability to an injured person; Article 15 bars it.
• Be able to show when you placed the product on the market or put it into service: you are not liable if you prove you did not, or that the defect probably did not exist at that time (Art. 11(1)(a) and (c)).

Regulation (EU) 2023/1230, Annex I, Part A, points 5 and 6, with Article 25(2) · Read the law's page

• This duty takes effect on 14 January 2027 (Article 54).
• If you are a manufacturer of a safety component with fully or partially self-evolving behaviour using machine learning approaches ensuring safety functions, or of machinery that embeds such a system and has not placed it independently on the market, apply one of the conformity assessment procedures in Article 25(2): EU type-examination (module B) followed by conformity to type (module C), full quality assurance (module H), or unit verification (module G) (Annex I, Part A, points 5 and 6).

Regulation (EU) 2023/1230, Annex III, sections 1.1.9 and 1.2.1 · Read the law's page

• This duty takes effect on 14 January 2027 (Article 54 of Regulation (EU) 2023/1230), when Directive 2006/42/EC is repealed (Article 51(2)).
• It reaches you if you are a manufacturer, meaning a person that makes machinery or a related product and markets it under its name or trademark, or puts it into service for its own use, and you place that product on the EU market or put it into service; a safety component can be a digital component, including software, that is independently placed on the market to fulfil a safety function: design and construct the product in accordance with the essential health and safety requirements of Annex III (Articles 2(1), 3, point (3), and 10(1)); sections 1.1.9 and 1.2.1 hold its provisions on protection against corruption of software and data and on malicious third-party influence on control systems.
• Design and construct the product so that connecting another device, through a feature of that device or a remote device that communicates with it, does not lead to a hazardous situation (section 1.1.9).
• Design a hardware component that transmits signal or data relevant for connection or access to software critical for compliance so that it is adequately protected against accidental or intentional corruption, and identify software and data critical for compliance as such and protect them adequately against accidental or intentional corruption (section 1.1.9).
• Make the product identify the software installed on it that is necessary for it to operate safely and provide that information at all times in an easily accessible form, and collect evidence of a legitimate or illegitimate intervention in that hardware component, in the software, or in a modification of the software or its configuration (section 1.1.9).
• Design and construct control systems so that they can withstand, where appropriate to the circumstances and the risks, the intended operating stresses and intended and unintended external influences, including reasonably foreseeable malicious attempts from third parties leading to a hazardous situation (section 1.2.1, point (a)).
• Enable a tracing log of the data generated in relation to an intervention, and of the versions of safety software uploaded after the product is placed on the market or put into service, for five years after each upload, exclusively to demonstrate conformity further to a reasoned request from a competent national authority (section 1.2.1, point (f)).
• For control systems with fully or partially self-evolving behavior or logic designed to operate with varying levels of autonomy, enable the recording of data on the safety related decision-making process of software based safety systems, retain it for one year after its collection, and make it possible at all times to correct the product to maintain its inherent safety (section 1.2.1).
• The Regulation does not apply to, among others, motor vehicles within the scope of Regulation (EU) 2018/858, except for machinery mounted on them, or to household appliances, audio and video equipment and information technology equipment insofar as they fall within Directive 2014/35/EU or Directive 2014/53/EU (Article 2(2), points (g) and (p)).

Regulation (EU) 2024/1689, Article 23 · Read the law's page

• Before you place the system on the market, ensure that it is in conformity with the Regulation by verifying that the provider has carried out the conformity assessment procedure referred to in Article 43, has drawn up the technical documentation in accordance with Article 11 and Annex IV, and has appointed an authorised representative in accordance with Article 22(1), and that the system bears the required CE marking and is accompanied by the EU declaration of conformity referred to in Article 47 and instructions for use (Article 23(1)).Distributes itimporter
• If you have sufficient reason to consider that the system is not in conformity with the Regulation, or is falsified, or is accompanied by falsified documentation, do not place it on the market until it has been brought into conformity (Article 23(2)).Distributes itimporter
• Where the system presents a risk within the meaning of Article 79(1), inform the provider of the system, the authorised representative and the market surveillance authorities (Article 23(2)).Distributes itimporter
• Indicate your name, registered trade name or registered trade mark, and the address at which you can be contacted on the system and on its packaging or its accompanying documentation, where applicable (Article 23(3)).Distributes itimporter
• While the system is under your responsibility, ensure that storage or transport conditions, where applicable, do not jeopardise its compliance with the requirements of Section 2 (Article 23(4)).Distributes itimporter
• Keep, for 10 years after the system has been placed on the market or put into service, a copy of the certificate issued by the notified body, where applicable, of the instructions for use, and of the EU declaration of conformity referred to in Article 47 (Article 23(5)).Distributes itimporter
• Provide the relevant competent authorities, upon a reasoned request, with all the necessary information and documentation, including the items you keep for 10 years, to demonstrate the conformity of the system with the requirements of Section 2, in a language which can be easily understood by them, and ensure that the technical documentation can be made available to those authorities (Article 23(6)).Distributes itimporter
• Cooperate with the relevant competent authorities in any action they take in relation to a system you placed on the market, in particular to reduce and mitigate the risks posed by it (Article 23(7)).Distributes itimporter
• This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744), other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.
• It reaches you if you are an importer of a high-risk AI system: you are located or established in the Union and place on the market an AI system that bears the name or trademark of a natural or legal person established in a third country.

Regulation (EU) 2024/1689, Article 24 · Read the law's page

• Before you make the system available on the market, verify that it bears the required CE marking, that it is accompanied by a copy of the EU declaration of conformity referred to in Article 47 and instructions for use, and that the provider and the importer, as applicable, have complied with their obligations under Article 16, points (b) and (c), and Article 23(3) (Article 24(1)).Distributes itdistributor
• If you consider or have reason to consider, on the basis of the information in your possession, that the system is not in conformity with the requirements of Section 2, do not make it available on the market until it has been brought into conformity; where it presents a risk within the meaning of Article 79(1), also inform the provider or the importer, as applicable (Article 24(2)).Distributes itdistributor
• While the system is under your responsibility, ensure that storage or transport conditions, where applicable, do not jeopardise its compliance with the requirements of Section 2 (Article 24(3)).Distributes itdistributor
• If you consider or have reason to consider that a system you have made available on the market is not in conformity with the requirements of Section 2, take the corrective actions necessary to bring it into conformity, to withdraw it or recall it, or ensure that the provider, the importer or any relevant operator, as appropriate, takes them (Article 24(4)).Distributes itdistributor
• Where such a system presents a risk within the meaning of Article 79(1), immediately inform the provider or importer and the authorities competent for the system, giving details, in particular, of the non-compliance and of any corrective actions taken (Article 24(4)).Distributes itdistributor
• Upon a reasoned request from a relevant competent authority, provide it with all the information and documentation regarding your actions under Article 24(1) to (4) that are necessary to demonstrate the conformity of the system with the requirements of Section 2 (Article 24(5)).Distributes itdistributor
• Cooperate with the relevant competent authorities in any action they take in relation to a system you made available on the market, in particular to reduce or mitigate the risk posed by it (Article 24(6)).Distributes itdistributor
• This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744), other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.
• It reaches you if you are a distributor of a high-risk AI system: you are a natural or legal person in the supply chain, other than the provider or the importer, that makes an AI system available on the Union market.

Regulation (EU) 2024/1689, Article 25 · Read the law's page

• If you are a distributor, importer, deployer, or other third party who puts your name or trademark on a high-risk AI system already on the market, makes a substantial modification to one that keeps it high-risk, or changes an AI system's intended purpose so it becomes high-risk, you are treated as its provider and take on the Article 16 provider obligations.
• If you are the initial provider and one of those events happens, closely cooperate with the new provider: make available technical documentation sufficient to assess compliance with Article 16, inform them of known limitations and failure modes, and give them targeted technical access, including for testing and validation, unless you clearly specified that your system was not to be changed into a high-risk one.Makes itprovider
• If you are a product manufacturer and a high-risk AI system is a safety component placed on the market or put into service under your name or trademark, you are treated as its provider.Makes itproduct manufacturer
• If you are the provider of a high-risk AI system, or a third party supplying an AI system, AI model, tool, service, component, or process it integrates, specify by written agreement the necessary information, capabilities, technical access, and other assistance needed for the provider to comply with this Regulation, unless the third party makes the tool, service, process or component available to the public under a free and open-source licence; that exception never covers a general-purpose AI model.
• This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744), other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.

Commission Delegated Regulation (EU) 2025/1455, Annex XVIII to Delegated Regulation (EU) No 44/2014 · Read the law's page

• This duty takes effect on 11 December 2027 for new vehicle types and on 11 June 2029 for existing vehicle types (point 1.3 of Annex XVIII to Delegated Regulation (EU) No 44/2014, added by Delegated Regulation (EU) 2025/1455).
• It reaches you if you are a manufacturer of two- and three-wheel vehicles and quadricycles of categories L1e, L2e, L3e, L4e, L5e, L6e or L7e, other than L1e vehicles designed to pedal referred to in Article 3, point (94)(b), of Regulation (EU) No 168/2013: ensure the vehicle meets all the relevant requirements of UN Regulation No 155 on cyber security and cyber security management system (point 1.2).
• Have a Cyber Security Management System that covers the development, production and post-production phases, and hold a valid Certificate of Compliance for it for the vehicle type being approved (UN Regulation No 155, paragraphs 7.2.2.1 and 7.3.1).
• Identify the critical elements of the vehicle type, perform an exhaustive risk assessment, and protect the vehicle type against the risks identified with proportionate mitigations that include the relevant mitigations of Annex 5, Parts B and C (paragraphs 7.3.3 and 7.3.4).
• Implement measures to detect and prevent cyber-attacks against vehicles of the type, support your monitoring of threats, vulnerabilities and cyber-attacks, and provide data forensic capability; mitigate threats and vulnerabilities that require a response within a reasonable timeframe, and monitor continually, including vehicles after first registration (paragraphs 7.3.7, 7.2.2.3 and 7.2.2.4).
• Report at least once a year, or more frequently if relevant, the outcome of your monitoring activities, including information on new cyber-attacks, and confirm that the mitigations implemented are still effective (paragraph 7.4.1).
• For type approvals of vehicles of category L first issued before 1 July 2029, and each extension of them, if you can demonstrate that the vehicle type could not be developed in compliance with the Cyber Security Management System, demonstrate instead that cyber security was adequately considered during the development phase (paragraph 7.3.1).

Regulation (EU) 2024/2847, Art. 13 and Annex I · Read the law's page

• The Regulation does not reach free and open source software that is not monetized by its manufacturer (monetizing covers charging for the software, charging for technical support beyond recovering costs, providing a platform through which you monetize other services, requiring personal-data processing as a condition of use for reasons other than security, compatibility or interoperability, and accepting donations that exceed costs), or a remote data processing service the product does not need in order to perform one of its own functions.
• Design, develop, and produce the product, on the basis of your cybersecurity risk assessment and where each requirement applies, so it ships without known exploitable vulnerabilities, with a secure default configuration (unless you agree otherwise with a business user for a tailor-made product), protection against unauthorised access, and protection of the confidentiality of stored, transmitted or otherwise processed data, such as by encrypting relevant data at rest or in transit.
• Maintain a support period of at least five years, or the product's expected use time if shorter, handle vulnerabilities in the product and its components throughout that period, and keep each security update available for ten years after release or for the remainder of the support period, whichever is longer.
• From 11 December 2027 (Article 71(2)), when you identify a vulnerability in a component integrated in your product, including an open-source component, report the vulnerability to the person or entity manufacturing or maintaining the component and address and remediate it under the vulnerability handling requirements of Annex I, Part II. If you developed a software or hardware modification to address the vulnerability, share the relevant code or documentation with that person or entity, where appropriate in a machine-readable format (Article 13(6)).
• Put in place a coordinated vulnerability disclosure policy and a contact channel for reporting a vulnerability, and disclose the end date of the support period to the buyer at the time of purchase.

Regulation (EU) 2024/2847, Art. 24 · Read the law's page

• These duties apply from 11 December 2027 (Article 71(2)). They bind an open-source software steward: a legal person, other than a manufacturer, that has the purpose or objective of systematically providing support on a sustained basis for the development of specific products with digital elements, qualifying as free and open-source software and intended for commercial activities, and that ensures the viability of those products (Article 3(14)).
• Put in place and document, in a verifiable manner, a cybersecurity policy to foster the development of a secure product with digital elements and an effective handling of vulnerabilities by the developers of that product. Make the policy foster the voluntary reporting of vulnerabilities under Article 15 by those developers, take into account your specific nature and the legal and organizational arrangements to which you are subject, and include aspects related to documenting, addressing and remediating vulnerabilities and promote the sharing of information concerning discovered vulnerabilities within the open-source community (Article 24(1)).
• Cooperate with the market surveillance authorities, at their request, with a view to mitigating the cybersecurity risks posed by a product with digital elements qualifying as free and open-source software, and, on a reasoned request, give the authority the documentation of your policy in a language it can easily understand, in paper or electronic form (Article 24(2)).
• To the extent that you are involved in the development of products with digital elements, notify any actively exploited vulnerability contained in a product, of which you become aware, to the CSIRT designated as coordinator and to ENISA through the single reporting platform, as Article 14(1) requires of a manufacturer (Article 24(3)).
• To the extent that severe incidents having an impact on the security of products with digital elements affect the network and information systems you provide for the development of such products, notify the severe incident as Article 14(3) requires of a manufacturer, and inform the impacted users as Article 14(8) requires of a manufacturer (Article 24(3)).

Regulation (EU) 2025/327, Art. 30(1)(a) and Annex II · Read the law's page

• This duty takes effect on 26 March 2029 for EHR systems intended by the manufacturer to process the priority categories of personal electronic health data in Article 14(1), points (a), (b) and (c), and on 26 March 2031 for those intended to process points (d), (e) and (f) and for EHR systems put into service under Article 26(2): Article 105 applies the Regulation from 26 March 2027 but applies Articles 25 to 27, which govern placing an EHR system on the market, and Chapter III for Article 26(2) systems from those later dates, and the manufacturer's Article 30 duty attaches to a system placed on the market under them.
• It reaches you if you are the manufacturer of an EHR system, meaning software, or hardware and software together, that stores, intermediates, exports, imports, converts, edits or views personal electronic health data of the priority categories and is intended for use by healthcare providers giving patient care or by patients accessing their own data, including a system manufactured and used within a health institution and a system offered as a service (Article 2, point (k), and Article 26(2)); general purpose software used in a healthcare environment is outside Chapter III (Article 25(2)). Ensure that the harmonised software components of your EHR systems, the European interoperability software component and the European logging software component, and the EHR systems themselves to the extent Chapter III sets requirements for them, conform with the essential requirements in Annex II and with the common specifications adopted under Article 36 (Article 30(1), point (a)).
• Design and develop your EHR system so that its interoperability, safety and security features uphold the rights of natural persons, and so that, where it is operated together with other products including medical devices, the harmonised software components make interoperability and compatibility reliable and secure (Annex II, points 1.3 and 1.4).
• Provide reliable mechanisms for the identification and authentication of health professionals in an EHR system designed to be used by health professionals (Annex II, point 3.1).
• Have the European logging software component of an EHR system designed to enable access to personal electronic health data record at least, on every access event or group of events, the identification of the healthcare provider or other individuals who accessed the data, the identification of the specific natural person or persons who accessed it, the categories of data accessed, the time and date of access and the origin or origins of the data (Annex II, point 3.2).
• Include in the harmonised software components tools or mechanisms to review and analyze the log data, or support the connection and use of external software for the same purposes, and support different retention periods and access rights that take into account the origins and categories of electronic health data (Annex II, points 3.3 and 3.4).
• Provide, where the EHR system is designed to store or intermediate personal electronic health data, an interface enabling access to that data in the European electronic health record exchange format and the ability to receive it in that format; where it is designed to provide access to such data, be able to receive it in that format; and where it includes a functionality for entering structured data, enable entry with sufficient granularity to provide the entered data in that format (Annex II, points 2.1 to 2.4).
• Do not include in the harmonised software components features that prohibit, restrict or place an undue burden on authorized access, sharing or use of personal electronic health data for permitted purposes, or on authorized export of that data for the purpose of replacing the EHR system by another product (Annex II, points 2.5 and 2.6).
• If you make a wellness application, a medical device, an in vitro diagnostic medical device or an AI system and claim interoperability with EHR systems, meet the Annex II essential requirements mutatis mutandis (Annex II, introductory sentence).

Regulation (EU) 2025/327, Art. 44(7) · Read the law's page

• This duty takes effect on 26 March 2029 for EHR systems intended by the manufacturer to process the priority categories of personal electronic health data in Article 14(1), points (a), (b) and (c), and on 26 March 2031 for those intended to process points (d), (e) and (f): Article 105 applies the Regulation from 26 March 2027 but applies Articles 25 to 27, which govern placing an EHR system on the market, from those later dates, and the Article 44(7) report concerns a system placed on the market under them.
• It reaches you if you are the manufacturer of an EHR system placed on the market or put into service. Report any serious incident (Article 2, point (r)) involving the EHR system to the market surveillance authorities of the Member States where the serious incident occurred and of the Member States where the system is placed on the market or put into service, and include a description of the corrective action you have taken or envisage (Article 44(7)).
• Make the report immediately after you have established a causal link between the EHR system and the serious incident or the reasonable likelihood of such a link and, in any event, not later than three days after you become aware of the serious incident (Article 44(7)).
• Make the report without prejudice to any incident notification that Directive (EU) 2022/2555 requires of you (Article 44(7)).

Regulation (EU) 2025/2509, Article 25(2), point (c) · Read the law's page

• This duty takes effect on 1 August 2030 (Article 59).
• If you are a manufacturer of a toy that falls within the scope of Regulation (EU) 2024/1689, Regulation (EU) 2024/2847 or Directive 2014/53/EU, take account of the particular vulnerabilities of children in relation to the intended use of the toy when your safety assessment assesses and addresses its hazards, and include that assessment in the technical documentation (Article 25(2), point (c), and Article 25(3)).