European UnionRegulation (EU) 2021/821 Article 5
Officially Cyber-surveillance items catch-all (Article 5)
Regulation (EU) 2021/821, Art. 5
In force since .
An end user controls rule binding private bodies.
- Obligation class
- Licensing, Reporting
As of .
What it requires
- Obtain an authorization before you export cyber-surveillance items not listed in Annex I if the competent authority has informed you that they are or may be intended wholly or partly for use in connection with internal repression or serious violations of human rights and international humanitarian law (Regulation (EU) 2021/821 Art. 5(1)).
- Notify the competent authority if your due diligence shows that cyber-surveillance items you propose to export, not listed in Annex I, are intended for such a use; the authority decides whether an authorization is required (Art. 5(2)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
Each Member State, which takes the measures that ensure proper enforcement and lays down the penalties applicable to infringements (Article 25(1)).
What this law does
Article 5(1) requires an authorization to export cyber-surveillance items not listed in Annex I when the competent authority has informed the exporter that they are or may be intended, wholly or partly, for use in connection with internal repression or serious violations of human rights and international humanitarian law.
Under Article 5(2), an exporter who is aware, according to its due diligence findings, of such an intended use must notify the competent authority, which decides whether to require an authorization. Article 2 defines cyber-surveillance items. Each Member State lays down the penalties for infringement under Article 25(1).
When LexLint raises it
When your app profile says your app ships encryption, distributes a software product or ships a mobile app.