European UnionCyber Resilience Act, Essential Requirements and Manufacturer Obligations
Regulation (EU) 2024/2847, Art. 13 and Annex I
A product security requirements rule binding public and private bodies.
- Obligation class
- Security, Governance, Disclosure
What it requires
- The Regulation does not reach free and open source software that is not monetized by its manufacturer (monetizing covers charging for the software, charging for technical support beyond recovering costs, providing a platform through which you monetize other services, requiring personal-data processing as a condition of use for reasons other than security, compatibility or interoperability, and accepting donations that exceed costs), or a remote data processing service the product does not need in order to perform one of its own functions.
- Design, develop, and produce the product, on the basis of your cybersecurity risk assessment and where each requirement applies, so it ships without known exploitable vulnerabilities, with a secure default configuration (unless you agree otherwise with a business user for a tailor-made product), protection against unauthorised access, and protection of the confidentiality of stored, transmitted or otherwise processed data, such as by encrypting relevant data at rest or in transit.NIST CSF 2.0PR.PS-06
- Maintain a support period of at least five years, or the product's expected use time if shorter, handle vulnerabilities in the product and its components throughout that period, and keep each security update available for ten years after release or for the remainder of the support period, whichever is longer.NIST CSF 2.0PR.PS-02
- From (Article 71(2)), when you identify a vulnerability in a component integrated in your product, including an open-source component, report the vulnerability to the person or entity manufacturing or maintaining the component and address and remediate it under the vulnerability handling requirements of Annex I, Part II. If you developed a software or hardware modification to address the vulnerability, share the relevant code or documentation with that person or entity, where appropriate in a machine-readable format (Article 13(6)).NIST CSF 2.0ID.RA-08
- Put in place a coordinated vulnerability disclosure policy and a contact channel for reporting a vulnerability, and disclose the end date of the support period to the buyer at the time of purchase.NIST CSF 2.0ID.RA-08NIST CSF 2.0PR.PS-02
These lines are LexLint's reading of the law's text. Also read by: European Commission, Directorate-General for Communications Networks, Content and Technology (DG CONNECT) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- NIST CSF 2.0
- ID.RA-08Processes for receiving, analyzing, and responding to vulnerability disclosures are established
- PR.PS-02Software is maintained, replaced, and removed commensurate with risk
- PR.PS-06Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle
- CIS Controls
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
1 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
Article 64(2): non-compliance with the essential cybersecurity requirements set out in Annex I and the obligations set out in Articles 13 and 14 carries a higher tier of up to EUR 15,000,000 or 2.5 percent of worldwide annual turnover, whichever is higher. A separate, lower tier under Article 64(3) covers other listed obligations (Articles 18 to 23, 28, and others) at up to EUR 10,000,000 or 2 percent, and Article 64(4) caps the supply of incorrect, incomplete or misleading information to notified bodies and market surveillance authorities at up to EUR 5,000,000 or 1 percent. Article 64(10) exempts manufacturers qualifying as microenterprises or small enterprises from the administrative fines for missing the Article 14(2)(a) or 14(4)(a) 24-hour deadline, and exempts open-source software stewards from administrative fines entirely.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 15,000,000
- Turnover percentage cap
- 2.5
Who enforces it
Enforcement body
The market surveillance authority designated by each EU Member State under Article 52 of the Regulation, coordinated through the dedicated administrative cooperation group (ADCO).
Settledness
- As of
- Guidance link
- https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act
- Guidance body
- European Commission, Directorate-General for Communications Networks, Content and Technology (DG CONNECT)
- Open questions
- Where a remote data processing service the manufacturer markets alongside the product is needed for one of the product's functions but not for its core function, does Article 3(2) bring it within the Regulation because its absence would prevent the product from performing one of its functions, and where will the Commission's Article 26 guidance on remote data processing solutions draw that line?
Also on the record
EEA status
- Status
- Pending
- Source link
- https://www.efta.int/eea-lex/32024r2847
What this law does
Article 13 requires a manufacturer placing a product with digital elements on the EU market to design, develop and produce it in accordance with the essential cybersecurity requirements of Annex I, Part I, which, on the basis of the manufacturer's cybersecurity risk assessment and where applicable, include shipping without known exploitable vulnerabilities, a secure default configuration (unless otherwise agreed with a business user for a tailor-made product), protection against unauthorised access, protection of the confidentiality of stored, transmitted or otherwise processed data, such as by encrypting relevant data at rest or in transit, data minimisation, and protection of the availability of essential and basic functions, including through resilience and mitigation measures against denial-of-service attacks.
Annex I, Part II requires the manufacturer to identify and document vulnerabilities, including through a software bill of materials, remediate them without delay, operate a coordinated vulnerability disclosure policy, and provide security updates without delay and, unless otherwise agreed with a business user for a tailor-made product, free of charge; under Article 13(8) and (9) the manufacturer must set a support period of not less than five years, or the product's expected use time if shorter, and keep each security update available for ten years after it is issued or for the remainder of the support period, whichever is longer.
Article 13(6) requires a manufacturer that identifies a vulnerability in a component integrated in its product, including an open-source component, to report the vulnerability to the person or entity manufacturing or maintaining the component, to address and remediate it in accordance with the vulnerability handling requirements of Annex I, Part II, and, where it has developed a software or hardware modification to address it, to share the relevant code or documentation with that person or entity, where appropriate in a machine-readable format.
The Regulation does not reach free and open source software that its manufacturer does not monetise. Monetising covers charging a price for the software, charging for technical support beyond recovering costs, providing a platform through which the manufacturer monetises other services, requiring personal-data processing as a condition of use for reasons other than improving security, compatibility or interoperability, and accepting donations that exceed costs.
Its remote data processing requirements reach only data processing at a distance for which the software is designed and developed by the manufacturer, or under its responsibility, and the absence of which would prevent the product from performing one of its functions, not a service the product could operate without. Article 65 makes Directive (EU) 2020/1828 on representative actions apply to an infringement of this Regulation that harms, or may harm, the collective interests of consumers.
Under that Directive a qualified entity, meaning an organisation or public body representing consumers' interests, brings the action as claimant on consumers' behalf.
When LexLint raises it
When your app profile says your app distributes a software product or ships a mobile app.
Back to the example · Lint your app
Page updated .