CyprusSecurity of Networks and Information Systems Law, Radio Equipment Cybersecurity Requirements
Art. 42A of the Security of Networks and Information Systems Law of 2020 N. 89(I)/2020, as inserted by the Security of Networks and Information Systems (Amendment) Law of 2025, N. 60(I)/2025
In force since .
A product security requirements rule binding private bodies.
- Obligation class
- Security
What it requires
- This binds a manufacturer, importer or distributor placing on the Cypriot market radio equipment of a category or class the Authority has designated by Decision under Article 42A(2); which categories are in scope, and the conformity-assessment and notified-body approval procedure that applies to them, is fixed in that Decision and is not described here.
- Construct the equipment so that it does not harm the network, and its operation does not misuse network resources so as to cause an unacceptable degradation of service.NIST CSF 2.0PR.PS-06
- Incorporate safeguards to protect the personal data and privacy of the equipment's users and subscriber, and support features protecting against fraud.NIST CSF 2.0PR.PS-06
- Support features ensuring that software can be installed on the radio equipment only once the compatibility of the combination of the radio equipment and the software has been demonstrated.NIST CSF 2.0PR.PS-05
These lines are LexLint's reading of the law's text. Also read by: Digital Security Authority (DSA) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- CIS Controls
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
1 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Article 43 sets an administrative fine, imposed by the Authority and open to challenge before the Administrative Court, and states no custodial or criminal penalty. The Law's criminal offences are in Article 22 (failure to comply with Article 21) and Article 44, and neither reaches the Article 42A duty. Article 54 speaks of legal-person liability for "offences" under Articles 22 and 43, but Article 43 itself creates only the administrative fine.
Penalty structure
Article 43(1): subject to Article 43A, where the Authority establishes an act or omission contrary to this Law, it may impose an administrative fine of up to EUR 200,000, depending on the seriousness of the infringement, and, on repetition, a further fine of up to EUR 10,000 for each day the infringement continues. This is the general fine that reaches an Article 42A radio-equipment breach, distinct from Article 43A's EUR 10,000,000/2 percent and EUR 7,000,000/1.4 percent tiers, which are scoped only to Articles 35 and 35B.
- Rule
- Fixed only
- As of
- Currency
- EUR
- Fixed cap
- 200,000
Who enforces it
Enforcement body
The Digital Security Authority (Αρχή Ψηφιακής Ασφάλειας), with market-surveillance and seizure powers over non-conforming radio equipment.
Settledness
- As of
- Guidance link
- https://dsa.cy/en/legislation/laws
- Guidance body
- Digital Security Authority (DSA)
- Open questions
- Has the Authority yet issued the Decision under Article 42A(2) designating the categories or classes of radio equipment in scope and fixing the conformity-assessment and market-surveillance procedure?
What this law does
Article 42A, inserted to partially harmonize with the Radio Equipment Directive (Directive 2014/53/EU), requires the Digital Security Authority to ensure that radio equipment of categories or classes it designates by Decision is constructed to meet essential requirements set by the European Commission.
In particular, the equipment must not harm the network or degrade service by misusing network resources, must incorporate safeguards protecting users' and subscribers' personal data and privacy, must support features protecting against fraud, and must support features ensuring that software can be installed on the equipment only once the compatibility of that hardware-software combination has been demonstrated.
The Authority sets the specific conformity-assessment procedure, notified-body approval criteria, and market-surveillance process, including a seizure power, by its own Decision, and orders compliance measures or the elimination of risk where equipment endangers health, personal safety, or network and information-system security.
When LexLint raises it
When your app profile says your app distributes a software product.
Back to the example · Lint your app
Page updated .