COM(2022) 454 Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on horizontal cybersecurity requirements for products with digital elements and amending Regulation (EU) 2019/1020

EXPLANATORY MEMORANDUM 1. CONTEXT OF THE PROPOSAL • Reasons for and objectives of the proposal Hardware and software products are increasingly subject to successful cyberattacks, leading to an estimated global annual cost of cybercrime of EUR 5.5 trillion by 2021. Such products suffer from two major problems adding costs for users and the society: (1) a low level of cybersecurity, reflected by widespread vulnerabilities and the insufficient and inconsistent provision of security updates to address them, and (2) an insufficient understanding and access to information by users, preventing them from choosing products with adequate cybersecurity properties or using them in a secure manner. In a connected environment, a cybersecurity incident in one product can affect an entire organisation or a whole supply chain, often propagating across the borders of the internal market within a matter of minutes. This can lead to severe disruption of economic and social activities or even become life threatening. The cybersecurity of products with digital elements has a strong cross-border dimension, as products manufactured in one country are often used across the internal market. In addition, incidents initially affecting a single entity or a single Member State often spread within minutes across the entire internal market. While existing internal market legislation applies to certain products with digital elements , most of the hardware and software products are currently not covered by any EU legislation tackling their cybersecurity. In particular, the current EU legal framework does not address the cybersecurity of non-embedded software, even if cybersecurity attacks increasingly target vulnerabilities in these products, causing significant societal and economic costs. There are numerous examples of noteworthy cyberattacks resulting from suboptimal product security, such as the WannaCry ransomware worm, which exploited a Windows vulnerability that affected 200 000 computers across 150 countries in 2017 and caused a damage amounting to billions of USD; the Kaseya VSA supply chain attack, which used Kaseya’s network administration software to attack over 1 000 companies and forcing a supermarket chain to close all its 500 shops across Sweden; or the many incidents in which banking applications are hacked to steal money from unsuspecting consumers. Two main objectives were identified aiming to ensure the proper functioning of the internal market: (1) create conditions for the development of secure products with digital elements by ensuring that hardware and software products are placed on the market with fewer vulnerabilities and en s ure that manufacture r s take security seriously throughout a product’s life cycle; and (2) create conditions allowing users to take cybersecurity into account when selecting and using products with digital elements . Four specific objectives were set out: (i) ensure that manufacturers improve the security of products with digital elements since the design and development phase and throughout the whole life cycle; (ii) ensure a coherent cybersecurity framework, facilitating compliance for hardware and software producers; (iii) enhance the transparency of security properties of products with digital elements , and (iv) enable businesses and consumers to use products with digital elements securely. The strong cross-border nature of cybersecurity and the growing incidents , with spill-over effects across borders, sectors and products, mean that the objectives cannot effectively be achieved by Member States alone. Given the global nature of markets for product s with digital elements , Member States face the same risks for the same product with digital elements on their territory. An emerging fragmented framework of potentially diverging national rules risks hampering an open and competitive single market for products with digital elements . Joint action at EU level is thus necessary to increase the level of trust among users and the attractiveness of EU products with digital elements . It would also benefit the internal market by providing legal certainty and achieving a level playing field for vendors of products with digital elements , as highlighted also in the final report of the Conference on the Future of Europe , in which citizens call for a stronger role for the EU in countering cybersecurity threats . • Interplay with existing policy provisions in the policy area The EU framework comprises several pieces of horizontal legislation that cover certain aspects linked to cybersecurity from different angles (products, services, crisis management, and crimes). In 2013, the Directive on attacks against information systems, h armonising criminalisation and penalties for a number of offences directed against information systems came into force. In August 2016, Directive (EU) 2016/1148 on security of network and information systems ( NIS Directive ) entered into force as the first piece of EU-wide legislation on cybersecurity. Its revision, resulting in Directive [ Directive XXX/XXXX ( NIS2 ) ] , raises the EU common level of ambition. In 2019, t he EU Cybersecurity Act entered into force, aiming to enhance the security of ICT products, ICT services and ICT processes by introducing a voluntary European cybersecurity certification framework . Cybersecurity of the entire supply chain is ensured only if all its components are cyber-secure. The above-mentioned EU legislation has however substantial gaps in this regard, as it does not cover mandatory requirements for the security of products with digital elements . While the proposed Cyber Resilience Act covers products with digital elements placed on the market, the Directive [ Directive XXX/XXX ( NIS2 ) ] aims at ensuring a high level of cybersecurity of services provided by essential and important entities. Directive [ Directive XXX/XXXX ( NIS2 ) ] requires Member States to ensure that essential and important entities within the scope, such as health care or cloud providers and public administration entities, take appropriate and proportionate technical, operational and organisational cybersecurity measures. This includes, among others, a requirement to ensure security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure. Directive [ Directive XXX/XXXX ( NIS2 ) ] requires the Commission to adopt implementing acts laying down the technical and the methodological requirements of those measures within 21 months after the date of entry into force of this Directive for certain types of entities, such as cloud computing service providers. For all other entities, the Commission may adopt an implementing act, laying down the technical and the methodological requirements, as well as sectoral requirements. This framework will ensure that technical specifications and measures similar to the essential cybersecurity requirements of the Cyber Resilience Act are also implemented for the design, development and vulnerability handling of software provided as a service (Software-as-a-Service). For example, this could be a means to ensure a high level of cybersecurity in cases such as electronic health records (EHR) systems, including when delivered as Software-as-a-Service (SaaS) or developed within health institutions (in-house), in accordance with the proposed [European Health Data Space Regulation]. • Interplay with other Union policies As set out in the Communication ‘Shaping Europe’s digital future’ , it is crucial for the EU to reap all the benefits of the digital age and to strengthen its industry and innovation capacity, within safe and ethical boundaries. The European strategy for data sets out four pillars – data protection, fundamental rights, safety and cybersecurity – as essential pre-requisites for a society empowered by the use of data. The current EU framework applicable to products that may also have digital elements comprises several pieces of legislation, including EU legislation on specific products covering safety-related aspects and general legislation on product liability. The proposal is coherent with the current product-related EU regulatory framework , as well as with recent legislative proposal s such as the Commission’s propos al for Regulation [the Artificial Intelligence (AI) Regulation] . The proposed Regulation w ould apply to all radio equipment within the scope of Commission Delegated Regulation (EU) 2022/30. Moreover, the requirements laid down by this Regulation include all the elements of the essential requirements referred to in Article 3(3), points (d), (e) and (f) of Direc tive 2014/53/EU, including the main elements set out in the [Commission implementation decision XXX/2022 on a standardisation request to the European Standardisation Organisations ] issued on the basis of that Delegated Regulation. In order to avoid a regulatory overlap, it is envisaged that the Commission would repeal or amend the Delegated Regulation with respect to the radio equipment covered by the proposed Regulation, so that the latter one would apply to it, once applicable. Moreover, in order to avoid a duplic ation of work, it is envisaged that the Commission and the European Standardisation Organisations take into account the standardisation work carried out in the context of Commission I mplementing D ecision C(2022)5637 on a standardisation request for the RED Delegated Regulation 2022/30 in the preparation and development of harmonised standards to facilitate the implementation of the Regulation . 2. LEGAL BASIS, SUBSIDIARITY AND PROPORTIONALITY • Legal basis The legal basis for this proposal is Article 114 of the Treaty on the Functioning of the European Union (TFEU) , which provides for the adoption of measures to ensure the establishing and functioning of the internal market. The purpose of the proposal is to harmonise cybersecurity requirements for products with digital elements in all Member States and to remove obstacles to the free movement of goods. Article 114 TFEU may be used as a legal basis to prevent the occurrence of these obstacles resulting from diverging national laws and approaches on how to address the legal uncertainties and gaps in the existing legal frameworks. Furthermore, the Court of Justice has recognised that applying heterogeneous technical requirements could be valid grounds to trigger Article 114 TFEU. The current EU legislative framework applicable to products with digital elements is based on Article 114 TFEU , and comprises several pieces of legislation, including on specific products and safety-related aspects or general legislation on product liability. However, it covers only certain aspects linked to the cybersecurity of tangible digital products and, as applicable, software embedded in these products. A t national level, Member States are starting to take national measures requiring vendors of digital products to enhance their cybersecurity. At the same time, t he cybersecurity of digital products has a particularly strong cross-border dimension, as products manufactured in one country are often used by organisations and consumers across the entire internal market. Incidents that initially concern a single entity or Member State often spread within minutes across organisations, sectors and several Member States . The various acts and initiatives taken so far at EU and national levels only partially address the problems identified and risk creating a legislative patchwork within the internal market, increasing legal uncertainty for both vendors and users of these products and adding unnecessary burden on companies to comply with a number of requirements for similar types of products. The proposed Regulation would harmonise and streamline the EU regulatory landscape by introducing cybersecurity requirements for products with digital elements and avoid overlapping requirements stemming from different pieces of legislation. This would create greater legal certainty for operators and users across the Union, as well as a better harmonisation of the European single market, creating more viable conditions for operators aiming at entering the EU market. • Subsidiarity (for non-exclusive competence) The strong cross-border nature of cybersecurity in general and the growing number of risks and incidents, which have spill-over effects across borders, sectors and products, mean that the objectives of the present intervention cannot effectively be achieved by Member States alone. National approaches in addressing the problems, and in particular approaches introducing mandatory requirements, will create additional legal uncertainty and legal barriers. Companies could be prevented from seamlessly expanding into other Member States, depriving users of the benefits of their products. Joint action at EU level is therefore necessary to establish a high level of trust among users, increasing the attractiveness of EU products with digital elements . It would also benefit the digital single market and internal market in general by providing legal certainty and achieving a level playing field for manufacturers of products with digital elements . Ultimately, the Council Conclusions of 23 May 2022 on the development of the European Union’s cyber posture call upon the Commission to propose, by the end of 2022, common cybersecurity requirements for connected devices. • Proportionality As regards the proportionality of the propos ed Regulation , the measures in the policy options considered would not go beyond what is needed to achieve the general and specific objectives and would not impose disproportionate costs. More specifically, the intervention considered would ensure that products with digital elements would be secured throughout their whole life cycle and proportionally to the risks faced through objective-oriented and technology neutral requirements that remain reasonable and generally corresponding to the interest of the entities involved. The essential cybersecurity requirements in the p roposal are building on widely used standards, and the standardisation process that will follow would take into account the technical specificities of the products. This means that where needed for a given risk level, security controls would be adapted. Furthermore, the envisaged horizontal rules would only foresee third-party assessment for critical products. This would only include a narrow share of the market for products with digital elements . The impact on SMEs would depend on their presence in the market of the se specific product categories. Regarding the proportionality of the costs for conformity assessment, notified bodies conducting the third party assessments would take the size of the undertaking into account when setting their fees. A reasonable transition period of 2 4 months to prepare the implementation would also be provided , giving time to the relevant markets to prepare, while providing a clear direction for R&D investments. Any compliance costs for businesses would be outweighed by the benefits brought by a higher level of security of products with digital elements and ultimately an increase of trust of users in these products. • Choice of the instrument A regulatory intervention would entail the adoption of a regulation and not a directive. This is because, for this particular type of product legislation, a regulation would more effectively address the problems identified and meet the objectives formulated, since it is an intervention that is conditioning the placing on the internal market of a very wide category of products. The transposition process in the case of a directive for such intervention could leave too much room for discretion at national level, potentially leading to lack of uniformity of certain essential cybersecurity requirements, legal uncertainty, further fragmentation or even discriminatory situations cross-border, even more taking account of the fact that the products covered could be of multiple purpose or use and that manufacturers can produce multiple categories of such products. 3. RESULTS OF EX-POST EVALUATIONS, STAKEHOLDER CONSULTATIONS AND IMPACT ASSESSMENTS • Stakeholder consultations The Commission has consulted a broad range of stakeholders. Member States and stakeholders were invited to participate in the o pen p ublic c onsultation and in the surveys and workshops organised in the context of a study conducted by a consortium supporting the Commission ’s preparatory work for the impact assessment: Wavestone, the Centre for European Policy Studies ( CEPS ) and ICF . The consulted stakeholders included national market surveillance authorities, Union bodies dealing with cybersecurity, hardware and software manufacturers, importers and distributors of hardware and software, trade associations, consumer organisations and users of products with digital elements and citizens, researchers and academia, notified bodies and accreditation bodies, and cybersecurity industry professionals. Consultation activities included: A first study conducted b y a consortium consisting of ICF , Wavestone, Carsa and CEPS , which was published in December 2021 . The study identified several market failures and assessed possible regulatory interventions. An Open Public Consultation that targeted citizens, stakeholders and cybersecurity experts. 176 replies were submitted. These contributed to the collection of diverse opinions and experiences from all stakeholder groups. Workshops organised by the study supporting the Commission’s preparatory work for a Cyber Resilience Act gathered around 100 representatives from all 27 Member States representing a variety of stakeholders. Expert interviews were conducted to gain a deeper understanding of current cybersecurity challenges related to products with digital elements , and to discuss policy options for a potential regulatory intervention. Bilateral discussions were held with national cybersecurity authorities, the private sector, and consumer organisations. Targeted outreach was done to key SME stakeholders. • Collection and use of expertise The consultation activities aimed to obtain input on the five main evaluation criteria based on the EU Better Regulation Guidelines (effectiveness, efficiency, relevance, coherence, EU-added value) as well as the potential impacts of possible options for the future. The contractor has not only reached out to the stakeholders that would be directly affected by the proposed Regulation, but has also consulted with a wide range of experts in the field of cybersecurity. • Impact assessment The Commission conducted an impact assessment for this proposal examined by the Commission's Regulatory Scrutiny Board (RSB) . A meeting with the RSB w as held on July 6 th 2022 and was followed by a positive opinion. The Impact Assessment was adjusted to address the recommendations and comments of the RSB. The Commission ex amined different policy options to achieve the general objective of the proposal : Soft law approach and voluntary measures (option 1): In this option, t here would be no mandatory regulatory intervention. Instead, the Commission would issue communications, guidance, recommendations and potentially codes of conduct to encourage voluntary measures. National schemes, voluntary or mandatory, would continue to be developed to compensate for the lack of EU horizontal rules. Ad-hoc regulatory intervention for cybersecurity of tangible products with digital elements and respective embedded software (option 2): This option would entail an ad-hoc product-specific regulatory intervention that would be limited to adding and/or amending the cybersecurity requirements in the already existing legislation or introducing new legislation as new risks emerge, including potentially on non-embedded software. The options 3 and 4 entail a horizontal regulatory intervention varying in scope, largely following the New Legislative Framework (NLF). This framework sets out essential requirements as a condition for the placement of certain products on the internal market. The NLF also typically provides for conformity assessment, the process conducted by the manufacturer to demonstrate whether specified requirements relating to a product have been fulfilled. Mixed approach, including horizontal mandatory rules for cybersecurity of tangible products with digital elements and respective embedded software and a staggered approach for non-embedded software (option 3): This option would entail a regulation introducing horizontal cybersecurity requirements for all tangible products with digital elements and the software embedded within these, as a condition for placement on the market , and would include two sub-options with and without mandatory third-party assessment (3i and 3ii) . Non-embedded software would not be regulated. A horizontal regulatory intervention introducing cybersecurity requirements for a broad scope of tangible and non-tangible products with digital elements , including non-embedded software (option 4) : This option resembles option 3, apart from the scope. Option 4 would include non-embedded software ( with two sub-options respectively including only critical (4a) or all software (4b) ) in the scope of a potential regulation. For each sub-option, the same sub-options related to conformity assessment as for option 3 would be considered . Option 4 (with sub-options covering all software and involving mandatory third-party assessment for critical products) emerged as the preferred option based on the assessment of effectiveness against the specific objectives and efficiency of costs versus benefits. This option would ensure the setting out of specific horizontal cybersecurity requirements for all products with digital elements being placed or made available o n the internal market, and would be the only option covering the entire digital supply chain. Non-embedded software, often exposed to vulnerabilities, would also be covered by such regulatory intervention, thus ensuring a coherent approach towards all products with digital elements , with a clear share of responsibilities of various economic operators. This policy option also brings added value by covering duty of care and whole life cycle aspects after the placement of the products with digital elements on the market, to ensure, among others, appropriate information on security support and provision of security updates. This policy option would also come to most effectively complement the recent review of the NIS framework, by ensuring the prerequisites for a strengthened supply chain security. The preferred option would bring significant benefits to the various stakeholders. For businesses, it would prevent divergent security rules for products with digital elements and decrease compliance costs for related cybersecurity legislation. It would reduce the number of cyber incidents, incident handling costs and reputational damage. For the whole EU, it is estimated that the initiative could lead to a costs reduction from incidents affecting companies by roughly EUR 180 to 290 billion annually. It would lead to an increased turnover due to uptake of products with digital elements demand. It would improve the companies’ global reputation leading to a demand uptake also outside the EU. For users, the preferred option would enhance the transparency of the security properties and facilitate the use of products with digital elements . Consumers and citizens would also benefit from better protection of their fundamental rights, such as privacy and data protection. When asked to rate the effectiveness of the policy interventions, the public consultation respondents agreed that option 4 would be the most effective measure (4.08 on a scale from 1 to 5). This includes consumer organisations (5.00), respondents identifying themselves as users (4.22), notified bodies (4.17), market surveillance authorities (5.00) and producers of products with digital elements (3.85), including those of small and medium size (4.05). • Regulatory fitness and simplification This proposal lays down requirements that will apply to manufactures of sof tware and hardware . There is a need to ensure legal certainty and avoid further market fragmentation of product-related requirements on cybersecurity on the internal market, which has been demonstrated by the broad support of various stakeholders for a horizontal intervention. The proposal will minimise the regulatory burden put on manufacturers by several product safety acts . The alignment to the NLF means a better functioning of the intervention and its enforcement. The proposal streamlines the process of safeguard procedures, by involving manufacturers and Member States before the Commission is notified. A large part of manufacturers in the scope of the proposal is already familiar with the workings of the NLF, which will contribute to its understanding and implementation. For consumers and companies the Proposal will promote trust in products with digital elements . • Fundamental rights All policy options are expected to enhance to a certain extent the protection of fundamental rights and freedoms such as privacy, protection of personal data, freedom to conduct business and protection of property or personal dignity and integrity. In particular the preferred policy option 4 consisting of horizontal regulatory interventions and a broad policy scope, would be the most effective in this regard , as it is more likely to help decrease the number and severity of incidents, including personal data breaches . It would also increase the legal certainty and achiev e a level playing field for economic operators, raise trust among users and the attractiveness of EU products with digital elements as a whole , thus protecting the property and improving the conditions for economic operators to conduct business . The horizontal cybersecurity requirements would contribute to the security of personal data by protecting the confidentiality, integrity and availability of information in products with digital elements . Compliance with those requirements will facilitate compliance with the requirement of security of processing of personal data under Regulation (EU) 2016/679 on the G eneral D ata P rotection R egulation ( GDPR ) . The proposal would enhance the transparency and information to users, including those that might be less equipped with cybersecurity skills. Users would also be better informed about the risks, capabilities and limitations of the products with digital elements , which would place them in a better position to take the necessary preventive and mitigating measures to reduce the residual risks . 4. BUDGETARY IMPLICATIONS In order to meet the tasks allocated to the European Union Agency for Cybersecurity (ENISA) under this Regulation, ENISA will have to re-allocate resources of approximately 4.5 FTEs. The Commission would need to allocate 7 FTEs to meet its respons i bilities related to enforcement under this Regulation. A detailed overview of the costs involved is provided in the ‘financial statement’ linked to this proposal. 5. OTHER ELEMENTS • Implementation plans and monitoring, evaluation and reporting arrangements The Commission will monitor the implementation, the ap plication and the compliance to these new provisions with a view to assessing their effectivene ss. The regulation will request a Commission’s evaluation and review and the submission of a public report in this respect to the European Parliament and to the Council by 3 6 months after the date of application and every four years thereafter . • Detailed explanation of the specific provisions of the proposal General provisions ( Chapter I ) This proposed Regulation lays down (a) rules for the placing on the market of products with digital elements to ensure the cybersecurity of such products; (b) essential requirements for the design , development and production of products with digital elements , and obligations for economic operators in relation to these products with respect to cybersecurity ; (c) essential requirements for the vulnerability handling processes put in place by manufacturers to ensure the cybersecurity of products with digital elements during the whole life cycle , and obligations for economic operators in relation to these processes ; (d) rules on market surveillance and enforcement of the above-mentioned rules and requirements . The proposed R egulation will apply to all products with digital elements whose intended and reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. The proposed R egulation will not apply to products with digital elements within the scope of Regulation (EU) 2017/745 [medical devices for human use an d accessories for such devices] and Regulation (EU) 2017/746 [in vitro diagnostic medical devices for human use and accessories for such devices] , as both R egulations contain requirements regarding devices, including on software and general obligations on manufacturers, covering the whole life cycle of products, as well as conformity assessment procedures . This Regulation will not apply to products with digital elements that have been certified in accordance with Regulation 2018/1139 [high uniform level of civil aviation safety ], nor to products to which Regulation (EU) 2019/2144 applies [on type-approval requirements for motor vehicles and their trailers, and systems, components and separate technical units intended for such vehicles]. Critical products with digital elements shall be subject to specific conformity assessment procedures and shall be divided into class I and class II as set out in Annex III , reflecting their cybersecurity risk level, with class II representing a greater risk . A product with digital elements is considered critical and therefore included in Annex III taking into account the impact of potential cybersecurity vulnerabilities included in th e product with digital elements . The cybersecurity-related functionality of the product with digital elements and the intended use in sensitive environments such as an industrial setting , amongst others, is taken into account in the determination of cybersecurity risk. The Commission is also empowered to adopt delegated acts to supplement this Regulation by specifying categories of highly critical products with digital elements for which the manufacturers shall be required to obtain a European cybersecurity certificate under a European cybersecurity certification scheme to demonstrate conformity with the essential requirements set out in Annex I , or parts thereof . When determining such categor ies of highly critical product s with digital elements, t he Commission shall take into account the level of cybersecurity risk related to the category of products with digital elements, in light of one or several of the criteria considered for the listing of critical products with digital elements in Annex III as well as in view of the assessment of whether that category of products is used or relied upon by the essential entities of the type referred to in Annex [Annex I] to the Directive [Directive XXX/ XXXX ( NIS2 ) ] or will have potential future significance for the activities of these entities; or relevant for the resilience of the overall supply chain of products with digital elements against disruptive events. Obligations of economic operators (Chapter II) The proposal incorporates obligations for manufacturers, importers and distributors based on the reference provisions foreseen in Decision 768/2008 /EC . The essential cybersecurity requirements and obligations mandate that all products with digital elements shall only be made available on the market if, where dully supplied, properly installed, maintained and used for their intended purpose or under conditions, which can be reasonably foreseen, they meet the essential cybersecurity requirements set out in this Regulation . The essential requirements and obligations would mandate manufacturers to factor in cybersecurity in the design and development and production of the products with digital elements , exercise due diligence on security aspects when designing and developing their products, be transparent on cybersecurity aspects that need to be made known to customers , ensure security support (updates) in a proportionate way , and comply with vulnerability handling requirements . O bligations would be set up for economic operators, starting from manufacturers, up to distributors and importers, in relation to the placement on the market of products with digital elements , as adequate for their role and responsibilities on the supply chain. Conformity of the product with digital elements (Chapter III) The product with digital elements , which is in conformity with harmonised standards or parts thereof , the references of which have been published in the Official Journal of the European Union , shall be presumed to be in conformity with the essential requirements of this proposed Regulation. Where harmonised standards do not exist or are insufficient or where there undue delays in the standardisation procedure or where the request by the Commission has not been accepted by the European standardisation organisations , the Commission may , by the means of implementing acts, adopt common specifications. In addition, products with digital elements that have been certified or for which a n EU statement of conformity or certificate has been issued under a European cybersecurity certification scheme pursuant to Regulation (EU) 2019/881 , and for which the Commission specified via implementing act that it can provide presumption of conformity for this Regulation , shall be presumed to be in conformity with the essential requirements of this Regulation , or parts thereof, in so far as the EU statement of conformity or cybersecurity certificat e , or parts thereof, cover those requirements . Furthermore, in order to avoid undue administrative burden for manufacturers, where applicable, the Commission should specify if a cybersecurity certificate issued under such a European cybersecurity certification scheme eliminates the obligation for manufacturers to carry out a third-party conformity assessment as provided by this Regulation for corresponding requirements. The manufacturer shall perform a conformity assessment of the product with digital elements and the vulnerability handling processes it has put in place to demonstrate conformity with the essential requirements set out in Annex I by following one of the procedures set out in Annex VI . Manufactures of critical products of class I and II shall use the respective modules necessary for the compliance. Manufacturers of critical product of class II have to involve a third-party in their conformity assessment. Notification of conformity assessment bodies (Chapter IV ) Proper functioning of notified bodies is crucial for ensuring a high level of cybersecurity and for the confidence of all interested parties in the New Approach system. Therefore, in line with the Decision 768/2008 /EC , the proposal sets out requirements for national authorities responsible for conformity assessment bodies (notified bodies). It leaves the ultimate responsibility for designating and monitoring notified bodies with the Member State s . Member States shall designate a notifying authority that shall be responsible for setting up and carrying out the necessary procedures for the assessment and notification of conformity assessment bodies and the monitoring of notified bodies. Market surveillance and enforcement (Chapter V) In accordance with Regulation (EU) 2019/1020, national market surveillance authorities carry out market surveillance in the territory of that Member State. Member States may choose to designate any existing or new authority to act as market surveillance authority, including national competent authorities established referred to in Article [Art icle X ] of Directive [Directive XXX/XXXX ( NIS2 ) ] or designated national cybersecurity certification authorities referred to in Article 58 of Regulation (EU) 2019/881. Economic operators are asked to fully cooperate with market surveillance authorities and other competent authorities. Delegated powers and committee procedures (Chapter VI ) In order to ensure that the regulatory framework can be adapted where necessary, the power to adopt acts in accordance with Article 290 TFEU is delegated to the Commission for updating the list of critical products of class I and II and specifying the definitions of these products ; specifying whether a limitation or exclusion is necessary for products with digital elements covered by other Union rules laying down requirements achieving the same level of protection as this Regulation ; mandating the certification of certain highly critical products with digital elements based on cri t eria set out in this Regulation ; specifying the minimum content of the EU declaration of conformity and supplementing the elements to be included in the technical documentation. The Commission is also empowered to adopt implementing acts to : specify the format or elements of the repo r ting obligations and of the software bill of materials ; specify the European cybersecurity certification schemes that can be used to demonstrate conformity with the essential requirements or parts there o f as set out in this Regulation; adopt common specifications ; lay down technical specifications for the affixing of CE marking ; adopt corrective or restrictive measures at Union level in exceptional circumstances which justify an immediate intervention to preserve the good functioning of the internal market . Confidentiality and p enalties (Chapter VII ) All parties that apply this Regulation shall respect the confidentiality of information and data obtained in carrying out their tasks and activities. In order to ensure effective enforcement of the obligations laid down in this Regulation, each market surveillance authority should have the power to impose or request the imposition of administrative fines. In the same v e in, this Regulation establishes maximum levels for administrative fines that should be provided in national laws for non-compliance with the obligations laid down in this Regulation. Transitional and final provisions (Chapter VIII ) T o allow manufacturers, notified bodies and Member States time to adapt to the new requirements , t he proposed Regulation will become applicable [ 24 months ] after its entry into force , except for the reporting obligation on manufacturers, which would apply from [12 months] after the date of entry into force . 2022/0272 (COD) Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on horizontal cybersecurity requirements for products with digital elements and amending Regulation (EU) 2019/1020 (Text with EEA relevance) THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION, Having regard to the Treaty on the Functioning of the European Un ion, and in particular Article 114 thereof, Having regard to the proposal from the European Commission, After transmission of the draft legislative act to the national parliaments, Having regard to the opinion of the European Economic and Social Committee , Having regard to the opinion of the Committee of the Regions , Acting in accordance with the ordinary legislative procedure, Whereas: (1) It is necessary to improve the functioning of the internal market by laying down a uniform legal framework for essential cybersecurity requirements for plac ing products with digital elements on the Union market . T wo major problems adding costs for users and society should be addressed : a low level of cybersecurity of products with digital elements , reflected by widespread vulnerabilities and the insufficient and inconsistent provision of security updates to address them, and an insufficient understanding and access to information by users, preventing them from choosing products with adequate cybersecurity properties or using them in a secure manner. (2) This Regulation aim s to set the boundary conditions for the development of secure products with digital elements by ensuring that hardware and software products are placed on the market with fewer vulnerabilities and that manufactures take security seriously th roughout a product’s life cycle. It also aims to create conditions allowing users to take cybersecurity into account when selecting and using products with digital elements . (3) The relevant Union legislation that is currently in force comprises several sets of horizontal rules that address certain aspects linked to cybersecurity from different angles, including measures to improve the security of the digital supply chain. However, the existing U nion legislation related to cybersec urity, including [Directive XXX/XXXX ( NIS2 ) ] and Regulation (EU) 2019/881 of the European Parliament and of the Council does not directly cover mandatory requirements for the security of products with digital elements . (4) While the existing Union legislation applies to certain products with digital elements, there is no horizontal U nion regulatory framework establishing comprehensive cybersecurity requirements for all products with digital elements. The various acts and initiatives taken thus far at U nion and national levels only partially address the identified cybersecurity-related problems and risk s, creating a legislative patchwork within the internal market, increasing legal uncertainty for both manufacturers and users of th o se products and adding an unnecessary burden on companies to comply with a number of requirements for similar types of products. T he cybersecuri ty of these products has a particularly strong cross-border dimension, as products manufactured in one country are often used by organisations and consumers across the entire internal market. This makes it necessary to regulate the field at Union level. The Union regulatory landscape should be harm o nised by introducing cyberse curity requirements for products with digital elements . I n addition, certainty for operators and users should be ensured across the Union, as well as a better harmonisation of the single market, creating more viable conditions for operators aiming at entering the U nion market. (5) At U nion level, v arious programmatic and political documents , such as t he EU’s Cybersecurity Strategy for the Digital Decade , the Council Conclusions of 2 December 2020 and of 23 May 2022 or the Resolution of the European Parliament of 10 June 2021, have called for specific U nion cybersecurity requirements for digital or connected products , with several countries around the world introducing measures to address this issue on their own initiative . In the final report of the Conference on the Future of Europe , citizens call ed for “a stronger role for the EU in countering cybersecurity threats ”. (6) T o increase the overall level of cybersecurity of all products with digital elements placed on the internal market , it is necessary to introduce objective-oriented and technology-neutral essential cybersecurity requirements for these products that apply horizontally . (7) Under certain conditions, all products with digital elements integrated in or connected to a larger electronic information system can serve as an attack vector for malicious actors. As a result , even hardware and software considered as less critical can facilitate the initial compromise of a device or network, enabling malicious actors to gain privileged access to a system or move laterally across systems. Manufacturers should therefore ensure that all connectable products with digital elements are designed and developed in accordance with essential requirements laid down in this Regulation . This includes both products that can be connected physically via hardware interfaces and products that are connected logically, such as via network sockets, pipes, files, application programming interfaces or any other types of software interface. As cyber security threats can propagate through various products with digital elements before reaching a certain target, for example by chaining together multiple vulnerability exploits, manufacturers should also ensure the cyber security of those products that are only indirectly connected to other devices or networks. (8) By setting cybersecurity requirements for plac ing on the market products with digital elements , the cyber security of these products for consumers and for businesses alike will be enhanced . T his also includes requirements for placing on the market consumer products with digital elements intended for vulnerable consumers, such as toys and baby monitors. (9) This Regulation ensures a high level of cybersecurity of products with digital elements . It does not regulate services , such as Software-as-a-Service (SaaS) , except for remote data processing solutions relating to a product with digital elements understood as any data processing at a distance for which the software is designed and developed by the manufacturer of the product concerned or under the responsibility of that manufacturer, and the absence of which would prevent such a product with digital elements from performing one of its functions . [ Directive XXX/XXXX ( NIS2 )] puts in place cybersecurity and incident reporting requirements for essential and important entities, such as critical infrastructure, with a view to increasing the resilience of the services they provide. [Directive XXX/XXXX ( NIS2 ) ] applies to cloud computing service s and cloud service models , such as SaaS . A ll entities providing cloud computing services in the Union that meet or exceed the threshold for medium-sized enterprises fall in the scope of that Directive . (10) In order not to hamper innovation or research, free and open-source software developed or supplied outside the course of a commercial activity should not be covered by this Regulation . This is in particular the case for software, including its source code and modified versions, that is openly shared and freely accessible, usable, modifiable and redistributable. In the context of software, a commercial activity might be characterized not only by charging a price for a product, but also by charging a price for technical support services , by provi di ng a software platform through which the manufacturer monetises other services, or by the use of personal data for reasons other than exclusively for improving the security, compatibility or interoperability of the software. (11) A secure Internet is indispensable for the functioning of critical infrastructures and for society as a whole. [Directive XXX/XXXX (NIS2)] aims at ensuring a high level of cybersecurity of services provided by essential and important entities, including digital infrastructure providers that support core functions of the open Internet, ensure Internet access and Internet services. It is therefore important that the products with digital elements necessary for digital infrastructure providers to ensure the functioning of the Internet are developed in a secure manner and that they comply with well-established Internet security standards. This Regulation, which applies to all connectable hardware and software products, also aims at facilitating the compliance of digital infrastructure providers with the supply chain requirements under the [Directive XXX/XXXX (NIS2)] by ensuring that the products with digital elements that they use for the provision of their services are developed in a secure manner and that they have access to timely security updates for such products. (12) Regulation (EU) 2017/745 of the European Parliament and of the Council lays down rules on medical devices and Regulation (EU) 2017/746 of the European Parliament and of the Council lays down rules on in vitro diagnostic medical devices. Both Regulations address cybersecurity risks and follow particular approaches that are also addressed in this Regulation. More specifically, Regulation s (EU) 2017/745 and (EU) 2017/746 lay down essential requirements for medical devices that function through an electronic system or that are software themselves. Certain non-embedded software and the whole life cycle approach are also covered by those Regulations . These requirements mandate manufacturers to develop and build their products by applying risk management principles and by setting out requirements concerning IT security measures , as well as corresponding conformity assessment procedures. Furthermore, specific guidance on cybersecurity for medical devices is in place since December 2019 , providing manufacturers of medical devices, including in vitro diagnostic devices, with guidance on how to fulfil all the relevant essential requirements of Annex I to those R egulations with regard to cybersecurity. Products with digital elements to which either of those Regulations apply should therefore not be subject to this Regulation. (13) Regulation (EU) 2019/2144 of the European Parliament and of the Council establishes requirements for the type-approval of vehicles, and of their systems and components , i ntroduc ing certain cybersecurity requirements, including on the operation of a certified cybersecurity management system, on software updates, covering organisations policies and processes for cyber risks related to the entire lifecycle of vehicles, equipment and services in compliance with the applicable United Nations regulations on technical specifications and cybersecurity , and providing for specific conformity assessment procedures . In the area of aviation, the principal objective of Regulation (EU) 2018/1139 of the European Parliament and of the Council is to establish and maintain a high uniform level of civil aviation safety in the Union. It creates a framework for essential requirements for airworthiness for aeronautical products, parts, equipment, including software that take into account obligations to protect against information security threats . Products with digital elements to which Regulation (EU) 2019/2144 appl ies and those products certified in accordance with Regulation (EU) 2018/1139 are therefore not subject to the essential requirements and conformity assessment procedures set out in this Regulation . , T he certification process under Regulation (EU) 2018/1139 ensures the level of assurance aimed for by this Regulation. (14) This Regulation lays down horizontal cybersecurity rules which are not specific to sectors or certain products with digital elements . Nevertheless, sectoral or product-specific Union rules could be introduced, laying down requirements that address all or some of the risks covered by the essential requirements laid down by this Regulation. In such cases, the application of this Regulation to products with digital elements covered by other Union rules laying down requirements that address all or some of the risks covered by the essential requirements set out in Annex I of this Regulation may be limited or excluded where s uch limitation or exclusion is consistent with the overall regulatory framework applying to those products and where the sectoral rules achieve the same level of protection as the one provided for by this Regulation. The Commission is empowered to adopt delegated acts to amend this Regulation by identifying such products and rules. For existing Union legislation where such limitation s or exclusion s should appl y , this Regulation contains sp ecific provisions to clarify its relation with that Union legislation . (15) Delegated Regulation (EU) 2022/30 specifies that the essential requirements set out in Article 3(3), point (d) (network harm and misuse of network resources), point (e) (personal data and privacy) and point (f) (fraud) of Directive 2014/53/EU appl y to certain radio equipment. [ Commission implementation decision XXX/2022 on a standardisation request to the European Standardisation Organisations ] lays down requirements for the development of specific standards further specifying how these three essential requirements should be addressed. The essential requirements laid down by this Regulation include all the elements of the essential requirements referred to in Article 3(3), points (d), (e) and (f) of Directive 2014/53/EU. Further, t he essential requirements laid down in this Regulation are aligned with the objectives of the requirements for specific standards included in that standardisation request. T herefore, if the Commission repeals or amends Delegated Regulation (EU) 2022/30 with the consequence that it ceases to apply to certain products subject to this Regulation , the Commission and the European Standardisation Organisations should take into account the standardisation work carried out in the context of Commission I mplementing D ecision C(2022)5637 on a standardisation request for the RED Delegated Regulation 2022/30 in the preparation and development of harmonised standards to facilitate the implementation of this Regulation . (16) Directive 85/374/EEC is complementary to this Regulation. Th at Directive sets out liability rules for defective products so that injured persons can claim compensation when a damage has been caused by defective products. It establishes the principle that the manufacturer of a product is liable for damages caused by a lack of safety in their product irrespective of fault (‘strict liability’). Where such a lack of safety consists in a lack of security updates after placing the product on the market, and this causes damage, the liability of the manufacturer could be triggered. O bligations for manufacturers that concern the provision of such security updates should be laid down in this Regulation . (17) This Regulation should be without prejudice to Regulation (EU) 2016/679 of the European Parliament and of the Council , including to provisions for the establishment of data protection certification mechanisms and of data protection seals and marks, for the purpose of demonstrating compliance of processing operations by controllers and processors with that Regulation. Such operations could be embedded in a product with digital elements. Data protection by design and by default, and cybersecurity in general, are key elements of Regulation (EU) 2016/679 . By protecting consumers and organisations from cybersecurity risks , t he essential cybersecurity requirements laid down in this Regulation, are also to contribute to enhanc ing the protection of personal data and privacy of individuals . Syn ergies on both standardisation and certification on cybersecurity aspects should be considered through the cooperation between the Commission, the European Standardisation Organisations, the European Union Agency for Cybersecurity (ENISA), the European Data Protection Board (EDPB) established by Regulation (EU) 2016/679 , and the national data protection supervisory authorities . Synergies between this Regulation and the Union data protection law should also be created in the area of market surveillance and enforcement . To this end, national market surveillance authorities appointed under this Regulation should cooperate with a uthorities supervising Union data protection law . The latter should also have access to information relevant for accomplishing their tasks. (18) To the extent that their products fall within the scope of this Regulation, i ssuers of European Digital Identity Wallets as referred to in Article [ A rticle 6a ( 2 ) of Regulation (EU) No 910/2014, as amended by Proposal for a Regulation amending Regulation (EU) No 910/2014 as regards establishing a framework for a European Digital Identity ], should comply with both the horizontal essential requirements established by this Regulation and the specific security requirements established by Article [Article 6a of Regulation (EU) No 910/2014, as amended by Proposal for a Regulation amending Regulation (EU) No 910/2014 as regards establishing a framework for a European Digital Identity ]. In order to facilitate compliance, wallet issuers should be able to demonstrate the compliance of European Digital Identity Wallets with the requirements set out respectively in both acts by certifying their products under a European cybersecurity certification scheme established under Regulation (EU) 2019/881 and for which the Commission specified via implementing act a presumption of conformity for this Regulation , in so far as the certificate , or parts thereof, covers those requirements . (19) Certain tasks provided for in this Regulation should be carried out by ENISA, in accordance with Art icle 3(2) of Regulation (EU) 2019/881 . In particular, ENISA should r eceive notifications from manufacturers of actively exploited vulnerabil ities contained in product s with digital elements, as well as incidents having an impact on the security of th o se products . ENISA should also forward these notification s to the relevant Computer Security Incident Response Teams ( CSIRTs ) or, respectively, to the relevant single point s of contact of the Member States designated in accordance with Article [ Article X ] of Directive [Directive XX X / XXXX (NIS2) ] , and inform the relevant market surveillance authorities about the notified vulnerability . On the basis of the information it gathers , ENISA should prepare a biennial technical report on emerging trends regarding cybersecurity risks in products with digital elements and submit it to the Cooperation Group referred to in Directive [Directive XX X / XXXX (NIS2)] . Furthermore, considering its expertise and mandate , ENISA should be able to support the process for implementation of this Regulation . In particular, it should be able to propose joint acti vities to be conducted by market surveillance authorities based on indications or information regarding potential non-compliance with this Regulation of products with digital elements across several Member States or identify categories of products for which simultaneous coordinated control actions should be organised. In exceptional circumstance s , at the request of the Commission, ENISA should be able to conduct evaluations in respect of specific products with digital elements that present a significant cybersecurity risk , where an immediate intervention is required to preserve the good functioning of the internal market . (20) Products with digital elements should bear the CE marking to indicate their conformity with this Regulation so that they can move freely within the internal market. Member States should not create unjustified obstacles to the placing on the market of products with digital elements that comply with the requirements laid down in this Regulation and bear the CE marking. (21) In order to ensure that manufacturers can release software for testing purposes before subjecting their products to conformity assessment, Member States should not prevent the making available of unfinished software, such as alpha version s , beta versions or release candidates, as long as the version is only made available for the time necessary to test it and gather feedback. Manufacturers should ensure that software made available under these conditions is only released following a risk assessment and that it complies to the extent possible with the security requirements relating to the properties of products with digital elements imposed by this Regulation. Manufacturers should also implement the vulnerability handling requirements to the extent possible. Manufacturers should not force users to upgrade to versions only released for testing purposes. (22) In order to ensure that products with digital elements , when placed on the market, d o not pose cybersecurity risks to persons and organisations , essential requirements should be set out for such products. Whe n the products are subsequently modified, by physical or digital means, in a way that is not foreseen by the manufacturer and that may imply that they no longer meet the relevant essential requirements, the modification should be considered as substantial. For example, s oftware updates or repairs could be assimilated to maintenance operations provided that they do not modify a product already placed on the market in such a way that compliance with the applicable requirements may be affected , or that the intended use for which the product has been assessed may be changed . As is the case for physical repairs or modifications, a product with digital elements should be considered as substantially modified by a software change where the software update modifies the original intended functions, type or performance of the product and these changes were not foreseen in the initial risk assessment , or the nature of the hazard has changed or the level of risk has increased because of the software update . (23) In line with the commonly established notion of substantial modification for products regulated by Union harmonisation legislation, whenever a substantial modification occurs that may affect the compliance of a product with this R egulation or when the intended purpose of that product changes , it is appropriate that the compliance of the product with digital elements is verified and that, where applicable, it undergoes a ne w conformity assessment . Where applicable, i f the manufacturer under takes a conformity assessment involving a third party, changes that might lead to substantial modifications should be notified to the third party. (24) Refurbishing, maintaining and repairing of a product with digital elements, as defined in the Regulation [Eco-design Regulation], does not necessarily lead to a substantial modification of the product, for instance if the intended use and functionalities are not changed and the level of risk remains unaffected. However, upgrading a product by the manufacturer might lead to changes in the design and development of the product and therefore might affect the intended use and the compliance of the product with the requirements set out in th is Regulation. (25) Products with digital elements sh ould be considered critical if the negative impact of the exploitation of potential cybersecurity vulnerabilities in the product can be severe due to , amongst others, the cybersecurity-related functionality, or the intended use. In particular, vulnerabilities in products with digital elements that have a cybersecurity -related functionality , such as secure elements, can lead to a propagation of security issues throughout the supply chain . The severity of the impact of a cybersecurity incident may also increase when taking into account the intended use of the product, such as in an industrial setting or in the context of a n essential entity of the type referred to in Annex [Annex I ] to Directive [ Directive XXX/ XXXX ( NIS2 ) ] , or for the performance of critical or sensitive functions, such as processing of personal data. (26) C ritical product s with digital elements should be subject to stricter conformity assessment procedures , while keeping a proportionate approach . For this purpose, critical products with digital elements should be divided into two classe s , reflecting the level of cybersecurity risk linked to these categories of products . A potential cyber incident involving products in class II might lead to greater negative impacts than an incident involving products in class I, for instance due to the nature of their cybersecurity-related function or intended use in sensitive environments , and therefore should undergo a stricter conformity assessment procedure. (27) The categories of critical products with digital elements referred to in Annex III of this Regulation should be understood as the products which have the core functionality of the type that is listed in Annex III to this Regulation . For example, Annex III to this Regulation lists products which are defined by their core functionality as general purpose microprocessors in class II . As a result, general purpose microprocessors are subject to mandatory third-party conformity assessment. T his is not the case for other products not explicitly referred to in Annex III to this Regulation which may integrate a general purpose microprocessor . The Commission should adopt delegated acts [by 12 months since the entry into force of this Regulation] to specify the definition s of the product categories covered under class I and class II as set out in Annex III. (28) This Regulation addresses cybersecurity risks in a targeted manner. Products with digital elements might, however, pose other safety risks, that are not related to cybersecurity. Those risks should continue to be regulated by other relevant Union product legislation. If no other Union harmonisation legislation is applicable, they should be subject to Regulation [G eneral Product Safety Regulation ]. Therefore, in light of the targeted nature of this Regulation, as a derogation from Article 2(1), third subparagraph, point (b), of Regulation [G eneral Product Safety Regulation ], Chapter III, Section 1, Chapters V and VII, and Chapters IX to XI of Regulation [G eneral Product Safety Regulation ] should apply to products with digital elements with respect to safety risks not covered by this Regulation, if those products are not subject to specific requirements imposed by other Union harmonisation legislation within the meaning of [Article 3, point (25) of the General Product Safety Regulation ] . (29) Products with digital elements classified as high-risk AI systems according to Article 6 of Regulation [the AI Regulation] which fall within the scope of this Regulation should comply with the essential requirements set out in this Regulation. When those high-risk AI systems fulfil the essential requirements of this Regulation, they should be deemed compliant with the cybersecurity requirements set out in Article [ Article 15 ] of Regulation [the AI Regulation] in so far as those requirements are covered by the EU declaration of conformity or parts thereof issued under this Regulation . As regards the conformity assessment procedures relating to the essential cybersecurity requirements of a product with digital elements covered by this Regulation and classified as a high-risk AI system, the relevant provisions of Article 43 of Regulation [the AI Regulation] should apply as a rule instead of the respective provisions of this Regulation. However, this rule should not result in reducing the necessary level of assurance for critical products with digital elements covered by this Regulation. Therefore, by way of derogation from this rule, high-risk AI systems that fall within the scope of the Regulation [the AI Regulation] and are also qualified as critical products with digital elements pursuant to this Regulation and to which the conformity assessment procedure based on internal control referred to in Annex VI of the Regulation [the AI Regulation] applies, should be subject to the conformity assessment provisions of this Regulation in so far as the essential requirements of this Regulation are concerned. In this case, for all the other aspects covered by Regulation [the AI Regulation] the respective provisions on conformity assessment based on internal control set out in Annex VI to Regulation [the AI Regulation] should apply . (30) The machinery products falling within the scope of Regulation [Machinery Regulation proposal] which are products with digital elements within the meaning of this Regulation and for which a declaration of conformity has been issued on the basis of this Regulation should be deemed to be in conformity with the essential health and safety requirements set out in [ Annex III, sections 1.1.9 and 1.2.1 ] of the Regulation [Machinery Regulation proposal], as regards protection against corruption and safety and reliability of control systems in so far as the compliance with those requirements is demonstrated by the EU declaration of conformity issued under this Regulation. (31) Regulation [European Health Data Space Regulation proposal] complements the essential requirements laid down in this Regulation. The electronic health record systems (‘EHR systems’) falling under the scope of Regulation [European Health Data Space Regulation proposal] which are products with digital elements within the meaning of this Regulation should therefore also comply with the essential requirements set out in this Regulation . T heir manufacturers should demonstrate conformity as required by Regulation [European Health Data Space Regulation proposal] . To facilitate compliance, manufacturers may draw up a single technical documentation containing the elements required by both legal acts. As this Regulation does not cover SaaS as such , EHR systems offered through the SaaS licensing and delivery model are not within the scope of this Regulation. Similarly, EHR systems that are developed and used in-house are not within the scope of this Regulation, as they are not placed on the market. (32) In order to ensure that products with digital elements are secure both at the time of their placing on the market as well as throughout their life-cycle, it is necessary to lay down essential requirements for vulnerability handling and essential cybersecurity requirements relating to the properties of products with digital elements. While manufacturers should comply with all essential requirements related to vulnerability handling and ensure that all their products are delivered without any known exploitable vulnerabilit ies , they should determine which other essential requirements related to the product properties are relevant for the concerned type of product. For this purpose, manufacturers should under take an assessment of the cybersecurity risks associated with a product with digital elements to identify relevant risks and relevant essential requirements and in order to appropriately apply suitable harmonised standards or common specifications. (33) In order to improve the security of products with digital elements placed on the internal market it is necessary to lay down essential requirements . These essential requirements should be without prejudice to the EU coordinated risk assessments of critical supply chains established by [Article X ] of Directive [Directive XXX/XXXX(NIS2)] , which take into account both technical and, where relevant, non-technical risk factors, such as undue influence by a third country on suppliers. Furthermore, it should be without prejudice to the Member States’ prerogatives to lay down additional requirements that take account of non-technical factors for the purpose of ensuring a high level of resilience, including those defined in Recommendation (EU) 2019/534, in the U nion- wide coordinated risk assessment of 5G networks security and in the EU Toolbox on 5G cybersecurity agreed by the NIS Cooperation Group as referred to in [Directive XXX/XXXX (NIS2)]. (34) To ensure that the national CSIRTs and the single point of contact s designated in accordance with Article [Article X ] of Directive [ Directive XX/XXXX (NIS2) ] are provided with the information necessary to fulfil their tasks and rais e the overall level of cybersecurity of essential and important entities, and to ensure the effective functioning of market surveillance authorities, manufacturers of products with digital elements should notify to ENISA vulnerabilities that are being actively exploited. As most products with digital elements are marketed across the entire internal market, any exploit ed vulnerability in a product with digital elements should be considered a threat to the functioning of the internal market. Manufacturers should also consider disclosing fixed vulnerabilities to the European vulnerability database established under Directive [ Directive XX/XXXX (NIS2) ] and managed by ENISA or under any other publicly accessible vulnerability database . (35) M anufacturers should also report to ENISA any incident having an impact on the security of the product with digital elements . Notwithstanding the incident reporting obligations in Directive [ Directive XXX/XXXX ( NIS2 ) ] for essential and important entities, it is crucial for ENISA, the single point s of contact designated by the Member States in accordance with Article [ Article X ] of Directive [ Directive XX X /XXXX (NIS2) ] and the market surveillance authorities to receive information from the manufacturers of products with digital elements allowing them to assess the security of these products . In order to ensure that users can react quickly to incidents having an impact on the security of their products with digital elements, m anufacturers should also inform their users about any such incident and, where applicable , about any corrective measures that the users can deploy to mitigate the impact of the incident, for example by publishing relevant information on their website s or, where the manufacturer is able to contact the users and where justified by the risks, by reaching out to the users directly. (36) Manufacturers of products with digital elements should put in place coordinated vulnerability disclosure policies to facilitate the reporting of vulnerabilities by individual s or entities. A c oordinated vulnerability disclosure polic y should specify a structured process through which vulnerabilities are reported to a manufacturer in a manner allowing the manufacturer to diagnose and remedy such vulnerabilit ies before detailed vulnerability information is disclosed to third parties or to the public. Given the fact that information about exploitable vulnerabilities in widely used products with digital elements can be sold at high prices on the black market, m anufacturers of such products should be able to use programmes, as part of their coordinated vulnerability disclosure policies , to incentivise the reporting of vulnerabilities by ensuring that individuals or entities receive recognition and compensation for their efforts (so-called ‘ bug bounty programmes ’ ) . (37) In order to facilitate vulnerability analysis, m anufacturers should identify and document components contained in the product s with digital elements , including by drawing up a software bill of materials. A software bill of materials can provide those who manufacture, purchase, and operate software with information that enhances their understanding of the supply chain, which has multiple benefits, most notably it helps manufacturers and users to track known newly emerged vulnerabilities and risks. It is of particular importance for manufacturers to ensure that their products do not contain vulnerable components developed by third parties. (38) In order to facilitate assessment of conformity with the requirements laid down by this Regulation, there should be a presumption of conformity for product s with digital elements which are in conformity with harmonised standards , which translate the essential requirements of this Regulation into detailed technical specifications, and which are adopted in accordance with Regulation (EU) No 1025/2012 of the European Parliament and of the Council . Regulation (EU) No 1025/2012 provides for a procedure for objections to harmonised standards where those standards do not entirely satisfy the requirements of this Regulation . (39) Regulation (EU) 2019/881 establishes a voluntary E uropean cybersecurity certification framework for ICT products, processes and services . European cybersecurity certification schemes can cover products with digital elements covered by this Regulation. T his Regulation should create synergies with Regulation (EU) 2019/881 . In order to facilitate the assessment of conformity with the requirements laid down in this Regulation, p roducts with digital elements that are certified or for which a statement of conformity has been issued under a cybersecurity scheme pursuant to Regulation (EU) 2019/88 1 and which has been identified by the Commission in an implementing act, shall be presumed to be in compliance with the essential requirements of this Regulation in so far as the cybersecurity certificate or statement of conformity or parts thereof cover those requirements . The need for new European cybersecurity certification schemes for products with digital elements should be assessed in the light of this Regulation . Such future European cybersecurity certification schemes covering products with digital elements should take into account the essential requirements as set out in this Regulation and facilitate compliance with this Regulation. The Commission should be empowered to specify , by means of implementing acts, the European cybersecurity certification schemes that can be use d to demonstrate conformity with the essential requirements set out in this Regulation . Furthermore, in order to avoid undue administrative burden for manufacturers, where applicable, the Commission sh ould specif y if a cybersecurity certificate issued under such Euro pean cybersecurity certification scheme s eliminates the obligation for manufactu r ers to carry out a third-party conformity assessment as provided by this Regulation for corresponding requirements . (40) U pon entry into force of th e implementing act setting out t he [Commission Implementing Regulation (EU) No …/... of XXX on the European Common Criteria-based cybersecurity certification scheme ] (EUCC) which concerns hardware products covered by this Regulation, such as hardware security modules and micropr ocessors, the Commission may specify , by means of an implementing act, how the EUCC provides a presumption of conformity with the essential requirements as referred to in Annex I of this Regulation or parts thereof . Furthermore, such implementing act may specify how a certificate issued under the EUCC eliminate s the obligation for manufacturers to carry out a third-party assessment as requested by this Regulation for corresponding requirements. (41) Where no harmonised standards are adopted or where the harmonised standards do not sufficiently address the essential requirements of this Regulation, the Commission should be able to adopt common specifications by means of implementing act s . Reasons for developing such common specifications, instead of relying on harmonised standards, might include a refusal of the standardisation request by any of the European standardisation organisations, undue delays in the establishment of appropriate harmonised standards, or a lack of compliance of developed standards with the requirements of this Regulation or with a request o f the Commission. In order to facilitate assessment of conformity with the essential requirements laid down by this Regulation, there should be a presumption of conformity for produc ts with digital elements that are in conformity with the common specifications adopted by the Commission according to th is Regulation for the purpose of expressing detailed technical specifications of those requirements. (42) Manufacturers should draw up an EU declaration of conformity to provide information required under this Regulation on the conformity of products with digital elements with the essential requirements of this Regulation and , where applicable, of the other relevant Union harmonisation legislation by which the product is covered . Manufacturers may also be required to draw up an EU declaration of conformity by other Union legislation. To ensure effective access to information for market surveillance purposes, a single EU declaration of conformity should be drawn up in respect of compliance with all relevant Union acts. In order to reduce the administrative burden on economic operators, it should be possible for that single EU declaration of conformity to be a dossier made up of relevant individual declarations of conformity. (43) The CE marking, indicating the conformity of a product, is the visible consequence of a whole process comprising conformity assessment in a broad sense. The general principles governing the CE marking are set out in Regulation (EC) No 765/2008 of the European Parliament and of the Council . Rules governing the affixing of the CE marking on products with digital elements should be laid down in this Regulation. The CE marking should be the only marking which guarantees that products with digital elements comply with the requirements of this Regulation . (44) In order to allow economic operators to demonstrate conformity with the essential requirements laid down in this Regulation and to allow market surveillance authorities to ensure that product s with digital elements made available on the market comply with the se requirements, it is necessary to provide for conformity assessment procedures. Decision No 768/2008/EC of the European Parliament and of the Council establishes modules for conformity assessment procedures in proportion to the level of risk involved and the level of security required. In order to ensure inter-sectoral coherence and to avoid ad-hoc variants, conformity assessment procedures adequate for verifying the conformity of products with digital elements with the essential requirements set out in this Regulation have been based on those modules. The conformity assessment procedures should examine and verify both product and process-related requirements covering the whole life cycle of product s with digital elements, including planning, design, development or production , testing and maintenance of the product. (45) As a general rule the conformity assessment of products with digital elements should be carried out by the manufacturer under its own responsibility following the procedure based on Module A of Decision 7 68/2008/EC . The manufacturer should retain flexibility to choose a strict er conformity assessment procedure involving a third-party. If the product is classified as a critical product of class I, additional assurance is required to demonstrate conformity with the essential requirements set out in this Regulation. T he manufacturer should apply harmonised standards, common specifications or cybersecurity certification schemes under Regulation (EU) 2019/88 1 which have been identified by the Commission in an implementing act , if it wants to carry out the conformity assessment under its own responsibility (module A) . If the manufacturer does not apply such harmonised standards, common specification s or cybersecurity certification schemes , the manufacturer should undergo conformity assessment invol ving a third party . Taking into account the administrative burden on manufacturers and the fact that cybersecurity plays an important role in the design and development phase of tangible and intangible product s with digital elements , conformity assessment procedures respectively based on modules B+C or module H of Decision 7 68/2008/EC have been chosen as most appropriate for assessing the compliance of critical products with digital elements in a proportionate and effective manner . The manufacturer that carries out the third-party conformity assessment can choose the procedure that suits best its design and production process . G iven the even greater cybersecurity risk linked with the use of product s classified as critical class II product s , the conformity assessment should always involve a third party. (46) While the creation of tangible products with digital elements usually requires manufacturers to make substantial efforts throughout the design , development and production phases, the creation of products with digital elements in the form of software almost exclusively focuses on design and development , while the production phase plays a minor role. Nonetheless, in many cases software products still need to be compiled, built, packaged, made available for download or copied onto physical media before being placed on the market. These activities should be considered as activities amounting to production when applying the relevant conformity assessment modules to verify the compliance of the product with the essential requirements of this Regulation across the design , development and production phases. (47) In order to carry out third-party conformity assessment for products with digital elements, conformity assessment bodies should be notified by the national notifying authorities to the Commission and the other Member States , provided they are compliant with a set of requirements, notably on independence, competence and absence of conflicts of interests. (48) In order to ensure a consistent level of quality in the performance of conformity assessment of products with digital elements, it is also necessary to lay down requirements for notifying authorities and other bodies involved in the assessment, notification and monitoring of notified bodies. The system set out in this Regulation should be complemented by the accreditation system provided for in Regulation (EC) No 765/2008. Since accreditation is an essential means of verifying the competence of conformity assessment bodies, it should also be used for the purposes of notification. (49) Transparent accreditation as provided for in Regulation (EC) No 765/2008, ensuring the necessary level of confidence in certificates of conformity, should be considered by the national public authorities throughout the Union as the preferred means of demonstrating the technical competence of conformity assessment bodies. However, national authorities may consider that they possess the appropriate means of carrying out that evaluation themselves. In such cases, in order to ensure the appropriate level of credibility of evaluations carried out by other national authorities, they should provide the Commission and the other Member States with the necessary documentary evidence demonstrating the compliance of the conformity assessment bodies evaluated with the relevant regulatory requirements. (50) Conformity assessment bodies frequently subcontract parts of their activities linked to the assessment of conformity or have recourse to a subsidiary. In order to safeguard the level of protection required for the product with digital elements to be placed on the market, it is essential that conformity assessment subcontractors and subsidiaries fulfil the same requirements as notified bodies in relation to the performance of conformity assessment tasks. (51) The notification of a conformity assessment body should be sent by the notifying authority to the Commission and the other Member States via the New Approach Notified and Designated Organisations (NANDO ) information system . NANDO is the electronic notification tool developed and managed by the Commission where a list of all notified bodies can be found. (52) Since notified bodies may offer their services throughout the Union, it is appropriate to give the other Member States and the Commission the opportunity to raise objections concerning a notified body. It is therefore important to provide for a period during which any doubts or concerns as to the competence of conformity assessment bodies can be clarified before they start operating as notified bodies. (53) In the interests of competitiveness, it is crucial that notified bodies apply the conformity assessment procedures without creating unnecessary burden for economic operators. For the same reason, and to ensure equal treatment of economic operators, consistency in the technical application of the conformity assessment procedures needs to be ensured. That should be best achieved through appropriate coordination and cooperation between notified bodies. (54) Market surveillance is an essential instrument in ensur ing the proper and uniform application of Union legislation. It is therefore appropriate to put in place a legal framework within which market surveillance can be carried out in an appropriate manner. R ules on Union market surveillance and control of products entering the Union market provided for in Regulation ( EU) 2019/1020 of the European Parliament and of the Council apply to products with digital elements covered by this Regulation. (55) In accordance with Regulation (EU) 2019/1020, market surveillance authorities carry out market surveillance in the territory of that Member State. This Regulation should not prevent Member States from choosing the competent authorities to carry out those tasks. Each Member State should designate one or more market surveillance authorities in its territory. Member States may choose to designate any existing or new authority to act as market surveillance authority, including national competent authorities referred to in Article [ Art icle X ] of Directive [Directive XXX/XXXX ( NIS2 ) ] or designated national cybersecurity certification authorities referred to in Article 58 of Regulation (EU) 2019/881. Economic operators should fully cooperate with market surveillance authorities and other competent authorities. Each Member State sh ould inform the Commission and the other Member States of its market surveillance authorities and the areas of competence of each of those authorities and should ensure the necessary resources and skills to carry out the surveillance tasks relating to this Regulation. As per Article 10(2) and (3) of Regulation (EU) 2019/1020, each Member State should appoint a single liaison office that should be responsible, among others, for representing the coordinated position of the market surveillance authorities and assisting in the cooperation between market surveillance authorities in different Member States. (56) A dedicated administrative cooperation group (ADCO) should be established for the uniform application of this Regulation, pursuant to Article 30(2) of Regulation (EU) 2019/1020. This ADCO should be composed of representatives of the designated market surveillance authorities and, if appropriate, representatives of the single liaison offices. The Commission should support and encourage cooperation between market surveillance authorities through the Union Product Compliance Network , established on the basis of Article 29 of Regulation (EU) 2019/1020 and comprising representatives from each Member State, including a representative of each single liaison office referred to in Article 10 of Regulation (EU) 2019/1020 and an optional national expert, the chairs of ADCOs, and representatives from the Commission. The Commission should participate in the meetings of the Network, its sub-groups and this respective A DCO. It should also assist this ADCO by means of an executive secretariat that provides technical and logistic support. (57) In order to ensure timely, proportionate and effective measures in relation to products with digital elements presenting a significant cybersecurity risk , a Union safeguard procedure should be foreseen under which interested parties are informed of measures intended to be taken with regard to such products . This should also allow market surveillance authorities, in cooperation with the relevant economic operators, to act at an earlier stage where necessary . Where the Member States and the Commission agree as to the justification of a measure taken by a Member State, no further involvement of the Commission should be required, except where non-compliance can be attributed to shortcomings of a harmonised standard. (58) In certain cases , a product with digital elements which complies with this Regulation, may nonetheless present a significant cybersecurity risk or pose a risk to the health or safety of persons, to compliance with obligations under Union or national law intended to protect fundamental rights, the availability , authenticity, integrity or confidentiality of services offered using an electronic information system by essential entities of the type referred to in [Annex I to Directive XX X /XXXX (NIS2) ] or to other aspects of public interest protection . Therefore it is necessary to establish rules which ensure mitigation of those risks. As a result, market surveillance authorities should take measures to require the economic operator to ensure that the product no longer presents that risk, to recall it or to withdraw it, depending on the risk. As soon as a market surveillance authority restricts or forbids the free movement of a product in such way, the Member State should notify without delay the Commission and the other Member States of the provisional measures, indicating the reasons and justification for the decision. Where a market surveillance authority adopts such measures against products presenting a risk, the Commission should enter into consultation with the Member States and the relevant economic operator or operators without delay and should evaluate the national measure. On the basis of the results of this evaluation, the Commission should decide whether the national measure is justified or not. The Commission should address its decision to all Member States and immediately communicate it to them and the relevant economic operator or operators. If the measure is considered justified, the Commission may also consider adopting proposals to revise the respective Union legislation. (59) For products with digital elements presenting a significant cybersecurity risk , and where there is reason to believe that these are not compliant with this Regulation , or for products that are compliant with this Regulation, but that present other important risks, such as risks to the health or safety of persons, fundamental rights or the provision of the services by essential entities of the type referred to in [Annex I of Directive XX X / XXXX (NIS2) ], the Commission may request ENISA to carry out an evaluation. Based on that evaluation, the Commission may adopt , through implementing acts, c orrective or restrictive measures at Union level, including ordering withdrawal from the market, or recalling of the respective products , within a reasonable period, commensurate with the nature of the risk. The Commission may have rec ourse to such intervention only in exceptional circumstances that justify an immediate intervention to preserve the good functioning of the internal market , and only where no effective measures have been taken by surveillance authorities to remedy the situation. Such exceptional circumstances may be emergency situations where, for example, a non-compliant product is widely made available by the manufacturer throughout several Member States, used also in key sectors by entities under the scope of [Directive XX X / XXXX (NIS2)], w hile contain ing known vulnerabilities that are being exploited by malicious actors and for which the manufacturer does not provide available patches . The Commission may intervene in such emergency situation s only for the duration of the exceptional circumstances and if the non-compliance with this Regulation or the important risks presented persist. (60) In cases where there are indications of non-compliance with this Regulation in several Member States, m arket surveillance authorities should be able to carry out joint activities with other authorities, with a view to verifying compliance and identifying cybersecurity risks of products with digital elements . (61) Simultaneous coordinated control actions (‘sweeps’) are specific enforcement actions by market surveillance authorities that can further enhance product security. S weeps should , in particular, be conducted where market trends, consumer complaints or other indications suggest that certain product categories are often found to present cybersecurity risk s . ENISA should submit proposals for categories of products for which sweeps could be organised to the market surveillance authorities , based, among others, on the notifications of product vulnerabilities and incidents it receives. (62) In order to ensure that the regulatory framework can be adapted where necessary, the power to adopt acts in accordance with Article 290 of the Treaty should be delegated to the Commission in respect of updates to the list of critical products in Annex III and specifying the definitions of the these product categories . Power to adopt acts in accordance with that Article should be delegated to the Commission to identify products with digital elements covered by other Union rules which achiev e the same level of protection as this Regulation , specifying whether a limitation or exclusion from the scope of this Regulation would be necessary as well as the scope of th at limitation , if applicable . Power to adopt acts in accordance with that Article should also be delegated to the Commission in respect of the potential mandating of certification of certain highly critical products with digital elements based on criticality crieria set out in this Regulation, as well as for specifying the minimum content of the EU declaration of conformity and supplementing the elements to be included in the technical documentation. It is of particular importance that the Commission carry out appropriate consultations during its preparatory work, including at expert level, and that those consultations be conducted in accordance with the principles laid down in the Inter-institutional Agreement of 13 April 2016 on Better Law-Making . In particular, to ensure equal participation in the preparation of delegated acts, the European Parliament and the Council receive all documents at the same time as Member States’ experts, and their experts systematically have access to meetings of Commission expert groups dealing with the preparation of delegated acts. (63) In order to ensure uniform conditions for the implementation of this Regulation, implementing powers should be conferred on the Commission to: specify the format and elements of the software bill of materials , specify further the type of information, format and procedure of the notifications on actively exploited vulnerabilities and incidents submitted to ENISA by the manufacturers, specify the European cybersecurity certification schemes adopted pursuant to Regulation (EU) 2019/881 that can be used to demonstrate conformity with the essential requirements or parts therefore as set out in Annex I of this Regulation, adopt common specifications in respect of the essential requirements set out in Annex I , lay down technical specifications for pictograms or any other marks related to the security of the products with digital elements, and mechanisms to promote their use , decide on corrective or restrictive measures at Union lev el in exceptional circumstances which justify an immediate intervention to preserve the good functioning of the internal market . Those powers should be exercised in accordance with Regulation (EU) No 182/2011 of the European Parliament and of the Council . (64) In order to ensure trustful and constructive cooperation of market surveillance authorities at Union and national level, all parties involved in the application of this Regulation should respect the confidentiality of information and data obtained in carrying out their tasks. (65) In order to ensure effective enforcement of the obligations laid down in this Regulation, each market surveillance authority should have the power to impose or request the imposition of administrative fines. M aximum levels for administrative fines to be provided for in national laws for non-compliance with the obligations laid down in this Regulation should therefore be established . When deciding on the amount of the administrative fine in each individual case, all relevant circumstances of the specific situation should be taken into account and as a minimum those explicitly established in this Regulation, including whether administrative fines have been already applied by other market surveillance authorities to the same operator for similar infringements. Such circumstances can be either aggravating, in situations where the infringement by the same operator persists on the territory of other Member States than the one where an administrative fine has already been applied, or mitigating, in ensuring that any other administrative fine considered by another market surveillance authority for the same economic operator or the same type of breach should already take account, along with other relevant specific circumstances, of a penalty and the quantum thereof imposed in other Member States. In all such cases, the cumulative administrative fine that could be applied by market surveillance authorities of several Member States to the same economic operator for the same type of infringement should ensure the respect of the principle of proportionality. (66) Where administrative fines are imposed on persons that are not an undertaking, the competent authority should take account of the general level of income in the Member State as well as the economic situation of the person when considering the appropriate amount of the fine. It should be for the Member States to determine whether and to what extent public authorities should be subject to administrative fines. (67) In its relationships with third countries, the EU endeavours to promote international trade in regulated products. A broad variety of measures can be applied in order to facilitate trade, including several legal instruments such as bilateral (inter-governmental) Mutual Recognition Agreements (MRAs) for conformity assessment and marking of regulated products. MRAs are established between the Union and third countries, which are on a comparable level of technical development and have a compatible approach concerning conformity assessment. These agreements are based on the mutual acceptance of certificates, marks of conformity and test reports issued by the conformity assessment bodies of either party in conformity with the legislation of the other party. Currently MRAs are in place for several countries. The agreements are concluded in a number of specific sectors, which might vary from one country to another. In order to further facilitate trade, and recognising th at supply chains of products with digital elements are global, MRAs concerning conformity assessment may be concluded for products regulated under this Regulation by the Union in accordance with Article 218 TFEU. Cooperation with partner countries is also important , in order to strengthen cyber resilience globally, as i n the long term this will contribute to a strengthened cyber security framework both within and outside of the EU . (68) The Commission should periodically review this Regulation, in consultation with interested parties, in particular with a view to determining the need for modification in the light of changes to societal, political, technological or market conditions. (69) Economic operators should be provided with a sufficient time to adapt to the requirements of this Regulation. T his Regulation should apply [24 months] from its entry into force , with the exception of the reporting obligations concerning actively exploited vulnerabilities and incidents, which should apply [12 months] from the entry into force of this Regulation . (70) Since the objective of this Regulation cannot be sufficiently achieved by the Member States but can rather, by reason of the effects of the action, be better achieved at Union level, the Union may adopt measures, in accordance with the principle of subsidiarity as set out in Article 5 of the Treaty on European Union. In accordance with the principle of proportionality as set out in that Article, this Regulation does not go beyond what is necessary in order to achieve that objective. (71) The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 of the European Parliament and of the Council and delivered its opinion on […] , HAVE ADOPTED THIS REGULATION: CHAPTER I GENERAL PROVISIONS Article 1 Subject matter This Regulation lay s down: (a) rules for the placing on the market of products with digital elements to ensure the cybersecurity of such products ; (b) essential requirements for the design , development and production of products with digital elements , and obligations for economic operators in relation to these products with respect to cybersecurity ; (c) essential requirements for the vulnerability handling processes put in place by manufacturers to ensure the cybersecurity of products with digital elements during the whole life cycle , and obligations for economic operators in relation to these processes ; (d) rules on market surveillance and enforcement of the above-mentioned rules and requirements . Article 2 Scope 1. This Regulation applies to products with digital elements whose intended or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. 2. Thi s Regulation does not apply to products with digital elements to which the following Union acts apply : (a) Regulation (EU) 2017/745; (b) Regulation (EU) 2017/746 ; (c) Regulation (EU) 2019/2144 . 3. This Regulation does not apply to products with digital elements that have been certified in accordance with Regulation (EU) 2018/1139. 4. The application of this Regulation to products with digital elements covered by other Union rules laying down requirements that address all or some of the risks covered by the essential requirements set out in Annex I may be limited or excluded, where: (a) such limitation or exclusion is consistent with the overall regulatory framework applying to those products; and (b) the sectoral rules achieve the same level of protection as the one provided for by this Regulation. The Commission is empowered to adopt delegated acts in accordance with Article 50 to amend this Regulation specifying whether such limitation or exclusion is necessary, the concerned products and rules, as well as the scope of the limitation, if relevant. 5. This Regulation does not apply to p roducts with digital elements developed exclusively for national security or military purposes or to product s specifically designed to process classified information . Article 3 Definitions For the purposes of this Regulation, the following definitions apply: (1) ‘ product with digital elements ’ mean s any software or hardware product and its remote data processing solutions , including software or hardware components to be placed on the market separately ; (2) ‘ remote data processing ’ means any data processing at a distance for which the software is designed and developed by the manufacturer or under the responsibility of the manufacturer, and the absence of which would prevent the product with digital elements from performing one of its functions ; (3) ‘ critical product with digital elements ’ means a product with digital elements that presents a cybersecurity risk in accordance with the criteria laid down in Article 6(2) and whose core functionality is set out in Annex III ; (4) ‘ highly critical product with digital elements ’ means a product with digital elements that presents a cybersecurity risk in accordance with the criteria laid down in Article 6(5) ; (5) ‘ operational technology ’ means programmable digital systems or devices that interact with the physical environment or manage devices that interact with the physical environment ; (6) ‘ s oftware’ mean s the part of an electronic information system which consists of computer code ; (7) ‘ h ardware’ mean s a physical electronic information system , or parts thereof capable of processing , storing or transmitting of digital data ; (8) ‘component’ means software or hardware intended for integration into an electronic information system; (9) ‘electronic information system’ means any system , including electrical or electronic equipment , capable of processing , storing or transmitting digital data; (10) ‘logical connection’ means a virtual representation of a data connection implemented through a software interface; (11) ‘physical connection’ means any connection between electronic information systems or components implemented using physical means, including through electrical or mechanical interfaces, wires or radio waves; (12) ‘indirect connectio n’ means a connection to a device or network, which does not take place directly but rather as part of a larger system that is directly connectable to such device or network; (13) ‘privilege’ means a n access right granted to particular users or programmes to perform security - relevant operations within an electronic information system; (14) ‘ elevated privilege ’ means an access right granted to particular users or programmes to perform an extended set of security-relevant operations within an electronic information system that , if misused or compromised , could allow a malicious actor to gain wider access to the resources of a system or organisation ; (15) ‘endpoint’ means any device that is connected to a network and serves as an entry point to that network; (16) ‘networking or computing resources’ means data or hardware or software functionality that is accessible either locally or through a network or an other connected device; (17) ‘economic operator’ means the manufacturer, the authorised representative, the importer, the distributor, or any other natural or legal person who is subject to obligations laid down by this Regulation; (18) ‘manufacturer’ means any natural or legal person who develops or manufactures products with digital elements or has products with digital elements designed, developed or manufactured, and markets them under his or her name or trademark , whether for payment or free of charge; (19) ‘ a uthorised representative’ mean s any natural or legal person established within the Union who has received a written mandate from a manufacturer to act on his or her behalf in relation to specified tasks; (20) ‘ i mporter’ mean s any natural or legal person established in the Union who places on the market a product with digital elements that bears the name or trademark of a natural or legal person established outside the Union; (21) ‘ d istributor’ mean s any natural or legal person in the supply chain, other than the manufacturer or the importer, that makes a product with digital elements available on the Union market without affecting its properties; (22) ‘ p lacing on the market’ mean s the first making available of a product with digital elements on the Union market; (23) ‘ m aking available on the market’ mean s any supply of a product with digital elements for distribution or use on the Union market in the course of a commercial activity, whether in return for payment or free of charge; (24) ‘ i ntended purpose ’ mean s the use for which a product with digital elements is intended by the manufacturer , including the specific context and conditions of use, as specified in the information supplied by the manufacturer in the instructions for use, promotional or sales materials and statements, as well as in the technical documentation; (25) ‘reasonably foreseeable use’ means use that is not necessarily the intended purpose supplied by the manufacturer in the instructions for use, promotional or sales materials and statements, as well as in the technical documentation, but which is likely to result from reasonably foreseeable human behaviour or technical operations or interactions; (26) ‘reasonably foreseeable misuse’ means the use of a product with digital elements in a way that is not in accordance with its intended purpose, but which may result from reasonably foreseeable human behaviour or interaction with other systems; (27) ‘ n otifying authority ’ mean s the national authority responsible for setting up and carrying out the necessary procedures for the assessment, designation and notification of conformity assessment bodies and for their monitoring; (28) ‘ c onformity assessment’ mean s the process of verifying whether the essential requirements set out in Annex I have been fulfilled; (29) ‘ c onformity assessment body ’ mean s a body defined in A rticle 2(13) of Regulation (EU) No 765/2008 ; (30) ‘ n otified body’ mean s a conformity assessment body designated in accordance with Article 33 of this Regulation and other relevant Union harmonisation legislation; (31) ‘ s ubstantial modification ’ mean s a change to the product with digital elements following its placing o n the market, which affects the compliance of the product with digital elements with the essential requirements set out in Section 1 of Annex I or results in a modification to the intended use for which the product with digital elements has been assessed; (32) ‘CE marking’ mean s a marking by which a manufacturer indicates that a product with digital elements and the processes put in place by the manufacturer are in conformity with the essential requirements set out in Annex I and other applicable Union legislation harmonising the conditions for the marketing of products (‘Union harmonisation legislation’) providing for its affixing; (33) ‘ m arket surveillance authority ’ mean s the authority as defined in Article 3, point (4) of Regulation (EU) 2019/1020; (34) ‘ h armonised standard ’ mean s a harmonised standard as defined in Article 2 , point (1)(c) , of Regulation (EU) No 1025/2012; (35) ‘ cybersecurity risk’ means risk as defined in Article [Article X ] of Directive [Directive XXX/XXXX ( NIS2 ) ] ; (36) ‘significant cybersecurity risk’ means a cybersecurity risk which, based on its technical characteristics, can be assumed to have a high likelihood of an incident that could lead to a severe negative impact , including by causing considerable material or non-material loss or disruption ; (37) ‘so ftware bill of materials’ mean s a formal record containing details and supply chain relationships of components included in the software elements of a product with digital elements ; (38) ‘vulnerability’ means a vulnerability as defined in Article [ Article X ] of Directive [Directive X XX/XXXX (NIS2) ] ; (39) ‘actively exploited vulnerability’ means a vulnerability for which there is reliable evidence that execution of malicious code was performed by an actor on a system without permission of the system owner ; (40) ‘personal data’ means data as defined in Article 4(1) of Regulation (EU) 2016/679. Article 4 Free movement 1. Member States shall not impede, for the matters covered by this Regulation, the making available on the market of products with digital elements which comply with this Regulation. 2. At trade fairs, exhibitions and demonstrations or similar events, Member States shall not prevent the presentation and use of a product with digital elements which does not comply with this Regulation. 3. Member States shall not prevent the making available of unfinished software which does not comply with this Regulation provided that the software is only made available for a limited period required for testing purposes and that a visible sign clearly indicates that it does not comply with this Regulation and will not be available on the market for purposes other than testing . Article 5 Requirements for products with digital elements Products with digital elements shall only be made available on the market where : (1) they meet the essential requirements set out in Section 1 of Annex I , under the condition that they a re properly inst alled, maintained , used for their intended purpose or under conditions which can reasonably be foreseen , and, where applicable, updated, and (2) the processes put in place by the manufacturer comply with the essential requirements set out in Section 2 of Annex I . Article 6 C ritical products with digital elements 1. P roducts with digital elements that belong to a category which is listed in Annex III shall be considered c ritical products with digital elements . Products which have the core functionality of a category that is listed in Annex III to this Regulation shall be considered as fall ing into th at category . Categories of c ritical products with digital elements shall be divi ded into class I and class II as set out in Annex III , reflecting the level of cybersecurity risk related to these products . 2. The Commission is empowered to adopt delegated acts in accordance with Article 50 to amend Annex III by including in the list of categories of critical product s with digital elements a new category or withdrawing an existing one from that list . When assessing the need to amend the list in Annex III, the Commission shall tak e into account the level of cybersecurity risk related to the category of products with digital elements . In determining the level of cybersecurity risk, one or several of the following criteria shall be taken into account: (a) t he cybersecurity-related functionality of the product with digital elements , and whether the product with digital elements has at least one of following attributes: (i) i t is designed to run with elevated privilege or manage privileges; (ii) i t has direct or privileged access to networking or computing resources; (iii) i t is designed to control access to data or operational technology; (iv) i t performs a function critical to trust, in particular security functions such as network control, endpoint security, and network protection . (b) t he i ntended use in sensitive environments , including in industrial settings or by essential entities of the type referred to in the Annex [Annex I] to the Directive [ Directive XXX/XXXX ( NIS2 ) ] ; (c) t he intended use of performing critical or sensitive functions, such as processing of personal data ; (d) t he potential extent of an adverse impact, in particular in terms of its intensity and its ability to affect a plurality of persons ; (e) t he extent to which the use of product s with digital elements has already caused material or non-material loss or disruption or has given rise to significant concerns in relation to the materialisation of an adverse impact . 3. The Commission is empowered to adopt a delegated act in accordance with Article 50 to supplement this Regulation by specifying the definitions of the product categories under class I and class II as set out in Annex III. The delegated act shall be adopted [by 12 months since the entry into force of this Regulation] . 4. Critical products with digital elements shall be subject to the conformity assessment procedures referred to in Article 2 4 (2) and ( 3 ) . 5. The Commission is empowered to adopt delegated acts in accordance with Article 50 to supplement this Regulation by specifying categories of highly critical products with digital elements for which the manufacturers shall be required to obtain a European cybersecurity certificate under a European cybersecurity certification scheme pursuant to Regulation (EU) 2019/881 to demonstrate conformity with the essential requirements set out in Annex I , or parts thereof . When determining such categor ies of highly critical product s with digital elements , t he Commission shall take into account the level of cybersecurity risk related to the category of products with digital elements , in light of one or several of the criteria listed in paragraph 2 , as well as in view of the assessment of whether that category of products is: (a) used or relied upon by the essential entities of the type referred to in Annex [Annex I ] to the Directive [ Directive XXX/ XXXX ( NIS2 ) ] or will have potential future significance for the activities of these entities; or (b) relevant for the resilience of the overall supply chain of products with digital elements against disruptive events. Article 7 General product safety By way of derogation from Article 2(1), third subparagraph, point (b), of Regulation [ General Product Safety Regulation ] where product s with digital elements are not subject to specific requirements laid down in other Union harmonisation legislation within the meaning of [Article 3, point (25) of the General Product Safety Regulation ], Chapter III, Section 1, Chapters V and VII, and Chapters IX to XI of Regulation [ General Product Safety Regulation ] shall apply to th ose product s with respect to safety risks not covered by this Regulation . Article 8 H igh-risk AI systems 1. Products with digital elements classified as high-risk AI systems in accordance with Article [ Article 6 ] of Regulation [the AI Regulation] which fall within the scope of this Regulation , and fulfil the essential requirements set out in S ection 1 of Annex I of this Regulation , and where the processes put in place by the manufacturer are compliant with the essential requirements set out in Section 2 of Annex I , shall be deemed in compliance with the requirements related to cybersecurity set out in Article [Article 1 5 ] of Regulation [the AI Regulation ] , without prejudice to the other requirements related to accuracy and robustness included in the aforementioned Article, and in so far as the achievement of the level of protection required by those requirements is demonstrated by the EU declaration of conformity issued under this Regulation. 2. For the products and cybersecurity requirements referred to in paragraph 1, the relevant conformity assessment procedure as required by Article [Article 43 ] of Regu l a tion [AI Regulation] shall apply. For the purpose of that assessment, notified bodies which are entitled to control the conformity of the high-risk AI systems under the Regulation [AI Regulation] shall be also entitled to control the conformity of the high-risk AI systems within the scope of this Regulation with the requirements set out in Annex I to this Regulation , provided that the compliance of those notified bodies with the requirement s laid down in Article 29 of this Regulation ha ve been assessed in the context of the notification procedure under Regulation [AI Regulation]. 3. By derogation from paragraph 2, critical products with digital elements listed in Annex III of this Regulation , which have to apply the conformity assessment procedures referred to in Article s 2 4 ( 2 )(a) , 2 4 (2) (b) , 2 4 ( 3 )(a) and 2 4 (3) (b) under this Regulation and which are also classified as high-risk AI systems according to Article [ Article 6 ] of the Regulation [ AI Regulation] and to which the conformity assessment procedure based on internal control referred to in Annex [Annex VI ] to Regulation [the AI Regulation] applies, shall be subject to the conformity assessment procedures as requir ed by this Regulation in so far as the essential requirements of this Regulation are concerned. Article 9 M achinery products M achinery products under the scope of Regulation [Machinery Regulation proposal] which are products with digital elements within the meaning of this Regulation and for which a n EU declaration of conformity ha s been issued on the basis of this Regulation shall be deemed to be in conformity with the essential health and safety requirements set out in Annex [ Annex III, S ections 1.1.9 and 1.2.1 ] to Regulation [Machinery Regulation proposal], as regards protection against corruption and safety and reliability of control systems , and in so far as the achievement of the level of protection required by those requirements is demonstrated in the EU declaration of conformity issued under this Regulation . CHAPTER II OBLIGATIONS OF ECONOMIC OPERATORS Article 10 Obligations of manufacturers 1. When placing a product with digital elements on the market, manufacturers shall ensure that it has been designed, developed and produced in accordance with the essential requirements set out in S ection 1 of Annex I . 2. F or the purposes of co mplying with the obligation laid down in para graph 1, m anufacturers shall undertake an assessment of the cybersecurity risks associated with a product with digital elements and take the outcome of that assessment into account during the planning, design, development, production , delivery and maintenance phases of the product with digital elements with a view to minimising cybersecurity risks, preventing security incidents and minimising the impacts of such incidents , including in relation to the health and safety of users . 3. When placing a product with digital elements on the market, the manufacturer shall include a cybersecurity risk assessment in the technical documentation as set out in Article 2 3 and Annex V. For products with digital elements referred to in Articles 8 and 2 4 (4) that are also subject to other Union acts, the cybersecurity risk assessment may be part of the risk assessment required by those respective Union acts. Where certain essential requirements are not applicable to the marketed product with digital elements, the manufacturer shall include a clear justification in that documentation . 4. F or the purposes of co mplying with the obligation laid down in para graph 1, m anufacturers shall exercise due diligence when integrating components sourced from third parties in products with digital elements. They shall ensur e that such components do not compromise the security of the product with digital elements . 5. T he manufacturer shall systematically document, in a manner that is proportionate to the nature and the cybersecurity risks, relevant cybersecurity aspects concerning the product with digital elements , including vulnerabilities they become aware of and any relevant information provided by third parties , and , where applicable , update the risk assessment of the product . 6. When placing a product with digital elements on the market, and for the expected product lifetime or for a period of five years from the placing of the product on the market , whichever is shorter, manufacturers shall ensure that vulnerabilities of that product are handled effectively and in accordance with the essential requirements set out in S ection 2 of Annex I . Man ufacturers shall have appropriate policies and procedures, including coordinated vulnerability disclosure policies, referred to in S ection 2, point ( 5 ) , of Annex I , to process and remediate potential vulnerabilities in the product with digital elements reported from internal or external sources. 7. Before placing a product with digital elements on the market, manufacturers shall draw up the technical documentation referred to in Article 2 3 . They shall carry out the chosen conformity assessment procedures referred to in Article 2 4 or have them carried out. Where compliance of the product with digital elements with the essential requirements set out in Section 1 of Annex I and of the processes put in place by the manufacturer with the essential requirements set out in Section 2 of Annex I has been demonstrated by that conformity assessment procedure, manufacturers shall draw up the EU declaration of conformity in accordance with Article 20 and affix the CE marking in accordance with Article 2 2 . 8. Manufacturers shall keep the technical documentation and the EU declaration of conformity, where relevant, at the disposal of the market surveillance authorities for ten years after the product with digital elements has been placed on the market. 9. Manufacturers shall ensure that procedures are in place for products with digital elements that are part of a series of production to remain in conformity. The manufacturer shall adequately take into account c hanges in the development and production process or in the design or characteristics of the product with digital elements and changes in the harmonised standards , European cybersecurity certification scheme s or the common specifications referred to in Article 1 9 by reference to which the conformity of the product with digital elements is declared or by application of which its conformity is verified. 10. Manufacturers shall ensure that products with digital elements are accompanied by the information and instructions set out in Annex II , in an electronic or physical form . Such information and instructions shall be in a language which can be easily understood by users . They shall be clear, understandable, intelligible and legible. They shall allow for a secure installation, operation and use of the products with digital elements . 11. Manufacturers shall either provide the EU declaration of conformity with the product with digital elements or include in the instructions and information set out in Annex II the internet address at which the EU declaration of conformity can be accessed . 12. F rom the plac ing on the market and for the expected product lifetime or f or a period of five years after the placing on the market of a product with digital elements , whichever is shorter, m anufacturers who know or have reason to believe that the product with digital elements or the processes put in place by the manufacturer are not in conformity with the essential requirements set out in Annex I shall immediately take the corrective measures necessary to bring that product with digital elements or the manufacturer’s processes into conformity, to withdraw or to recall the product , as appropriate. 13. Manufacturers shall , further to a reasoned request from a market surveillance authority, provide that authority , in a language which can be easily understood by it, with all the information and documentation, in paper or electronic form, necessary to demonstrate the conformity of the product with digital elements and of the processes put in place by the manufacturer with the essential requirements set out in Annex I . They shall cooperate with that authority, at its request, on any measures taken to eliminate the cybersecurity risks posed by the product with digital elements , which they have placed on the market. 14. A manufacturer that ceases its operations and, as a result, is not able to comply with the obligations laid down in this Regulation shall inform , before the cease of operation takes effect , the relevant market surveillance authorities about this situation, as well as, by any means available and to the extent possible, the users of the concerned products with digital elements placed on the market. 15. The Commission may , by means of implementing acts , specify the format and elements of the software bill of materials set out in S ection 2, point ( 1 ) , of Annex I . Those implementing acts shall be adopted in accordance with the e xamination procedure referred to in Article 5 1 (2) . Article 1 1 Reporting obligations of manufacturers 1. The m anufac turer shall , without undue delay and in any event within 24 hou rs of becoming aware of it , notify to ENISA any a ctively exploited vulnerability contained in the product with digital elements . The notification shall include details concerning th at vulnerability and , where applicable, any corrective or mitigating measures taken. ENISA shall , without undue delay, unless for justified cybersecurity risk-related grounds , forward the notification to the CSIRT designated for the purposes of coordinated vulnerability disclosure in accordance with Article [ A rticle X ] of Directive [Directive XXX /XXXX (NIS2) ] of Member State s concerned upon receipt and inform the market surveillance authori ty about the notified vulnerability. 2. The m anufac turer shall , without undue delay and in any event within 24 hours of becoming aware of it, notify to ENISA any incident having impact on the security of the product with digital elements . ENISA shall , without undue delay , unless for justified cybersecurity risk-related grounds , forward the notifications to the single point of contact designated in accordance with Article [ Article X ] of Directive [ Directive XX X /XXXX (NIS2) ] of the Member State s concerned and inform the market surveillance authority about the notified incidents . The incident notification shall include information on the severity and impact of the incident and , where applicable, indicate whether the manufacturer suspects the incident to be caused by unlawful or malicious acts or considers it to have a cross-border impact . 3. ENISA shall submit to the European cyber crisis liaison organisation network (EU-CyCLONe) established by Article [Article X ] of Directive [ Directive XXX/XXXX (NIS2 )] information notified pursuant to paragraphs 1 and 2 if such information is relevant for the coordinated management of large-scale cybersecurity incidents and crises at an operational level. 4. T he manufacturer shall inform , without undue delay and after becoming aware , the users of the product with digital elements about the incident and , where necessary, about corre ctive measures that the user can deploy to mitigate the impact of the incident . 5. The Commission may , by means of implementing acts , specify further the type of information, format and procedure of the notifications submitted pursuant to paragraph s 1 and 2. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 5 1 (2) . 6. ENISA , on the basis o f the notifications received pursuant to paragraph s 1 and 2, shall prepare a biennial technical report on emerging trends regarding cybersecurity risks in products with digital elements and submit it to the Cooperation Group referred to in Article [ Article X ] of Directive [ Directive XXX/XXXX ( NIS2 ) ] . T he first such report shall be submitted within 24 months after the obligations laid down in paragraphs 1 and 2 start applying . 7. Manufacturers shall, upon identifying a vulnerability in a component, including in an open source component, which is integrated in the product with digital elements , report the vulnerability to the person or entity maintaining the component. Article 1 2 Authorised representatives 1. A manufacturer may appoint an authorised representative by a written mandate . 2. The obligations laid down in Article 10 ( 1 ) to ( 7 ) first indent and (9) shall not form part of the authorised representative's mandate. 3. An authorised representative shall perform the tasks specified in the mandate received from the manufacturer. The mandate shall allow the authorised representative to do at least the following: (a) keep the EU declaration of conformity referred to in Article 20 and the technical documentation referred to in Article 2 3 at the disposal of the market surveillance authorities for ten years after the product with digital elements has been placed on the market; (b) further to a reasoned request from a market surveillance authority, provide that authority with all the information and documentation necessary to demonstrate the conformity of the product with digital elements ; (c) cooperate with the market surveillance authorities, at their request, on any action taken to eliminate the risks posed by a product with digital elements covered by the authorised representative's mandate. Article 1 3 Obligations of importers 1. Importers shall only place on the market products with digital elements that comply with the essential requirements set out in Section 1 of Annex I and where the processes put in place by the manufacturer are compliant with the essential requirements set out in Section 2 of Annex I . 2. Before placing a product with digital elements on the market, importers shall ensure that : (a) the appropriate conformity assessment procedure s referred to in Article 2 4 ha ve been carried out by the manufacturer; (b) the manufacturer has drawn up the technical documentation ; (c) t he product with digital elements bears the CE marking referred to in Article 2 2 and is accompanied by the information and instruction s for use as set out in Annex II . 3. Where an importer considers or has reason to believe that a product with digital elements or the processes put in place by the manufacturer are not in conformity with the essential requirements set out in Annex I , the importer shall not place the product on the market until that product or the processes put in place by the manufacturer ha ve been brought into conformity with the essential requirements set out in Annex I . Furthermore, where the product with digital elements presents a significant cybersecurity risk, the importer shall inform the manufacturer and the market surveillance authorities to that effect. 4. Importers shall indicate their name, registered trade name or registered trademark, the postal address and the email address at which they can be contacted on the product with digital elements or, where that is not possible, on its packaging or in a document accompanying the product with digital elements . The contact details shall be in a language easily understood by users and market surveillance authorities. 5. Importers shall ensure that the product with digital elements is accompanied by the instructions and i nformation set out in Annex II in a language which can be easily understood by users. 6. I mporters who know or have reason to believe that a product with digital elements , which they have placed on the market, or the processes put in place by its manufacturer , are not in conformity with the essential requirements set out in Annex I shall immediately take the corrective measures necessary to bring that product with digital elements or the processes put in place by its manufacturer into conformity with the essential requirements set out in Annex I , or to withdraw or recall the product , if appropriate. U pon identifying a vulnerability in the product with digital elements , importer s shall inform the manufacturer without undue delay about that vulnerability. Furthermore, where the product with digital elements presents a significant cybersecurity risk, importers shall immediately inform the market surveillance authorities of the Member States in which they made the product with digital elements available on the market to that effect, giving details, in particular, of the non-conformity and of any corrective measures taken. 7. Importers shall, for ten years after the product with digital elements has been placed on the market, keep a copy of the EU declaration of conformity at the disposal of the market surveillance authorities and ensure that the technical documentation can be made available to those authorities , upon request . 8. Importers shall, further to a reasoned request from a market surveillance authority, provide it with all the information and documentation, in paper or electronic form, necessary to demonstrate the conformity of the product with digital elements with the essential requirements set out in Section 1 of Annex I as well as of the processes put in place by the manufacturer with the essential requirements set out in Section 2 of Annex I in a language that can be easily understood by that authority. They shall cooperate with that authority, at its request, on any measures taken to eliminate the cybersecurity risks posed by a product with digital elements , which they have placed on the market. 9. When the importer of a product with digital elements becomes aware that the manufacturer of that product ceased its operations and, as result, is not able to comply with the obligations laid down in this Regulation, the importer shall inform the relevant market surveillance authorities about this situation, as well as, by any means available and to the extent possible, the users of the products with digital elements placed on the market. Article 1 4 Obligations of distributors 1. When making a product with digital elements available on the market, distributors shall act with due care in relation to the requirements of this Regulation. 2. Before making a product with digital elements available on the market, distributors shall verify that: (a) the product with digital elements bears the CE marking; (b) the manufacturer and the importer have complied with the obligations set out respectively in Article s 10 ( 10 ) , 10 (11) and 1 3 (4) . 3. Where a distributor considers or has reason to believe that a product with digital elements or the processes put in place by the manufacturer are not in conformity with the essential requirements set out in Annex I , the distributor shall not make the product with digital elements available on the market until that product or the processes put in place by the manufacturer have been brought into conformity. Furthermore, where the product with digital elements poses a significant cybersecurity risk, the distributor shall inform the manufacturer and the market surveillance authorities to that effect. 4. Distributors who know or have reason to believe that a product with digital elements , which they have made available on the market, or the processes put in place by its manufacturer are not in conformity with the essential requirements set out in Annex I shall make sure that the corrective measures necessary to bring that product with digital elements or the processes put in place by its manufacturer into conformity are taken , or to withdraw or recall the product , if appropriate. U pon identifying a vulnerability in the product with digital elements , distributors shall inform the manufacturer without undue delay about that vulnerability. Furthermore, where the product with digital elements presents a significant cybersecurity risk, distributo rs shall immediately inform the market surveillance authorities of the Member States in which they have made the product with digital elements available on the market to that effect, giving details, in particular, of the non-conformity and of any corrective measures taken. 5. Distributors shall, further to a reasoned request from a market surveillance authority, provide it with all the information and documentation, in paper or electronic form, necessary to demonstrate the conformity of the product with digital elements and the processes put in place by its manufacturer with the essential requirements set out in Annex I in a language that can be easily understood by that authority. They shall cooperate with that authority, at its request, on any measures taken to eliminate the cybersecurity risks posed by a product with digital elements , which they have made available on the market. 6. When the distributor of a product with digital elements becomes aware that the manufacturer of that product ceased its operations and, as result, is not able to comply with the obligations laid down in this Regulation, the distributor shall inform the relevant market surveillance authorities about this situation, as well as, by any means available and to the extent possible, the users of the products with digital elements placed on the market. Article 1 5 Cases in which obligations of manufacturers apply to importers and distributors An importer or distributor shall be considered a manufacturer for the purposes of this Regulation and shall be subject to the obligations of the manufacturer set out in Article s 10 and 1 1 (1), (2), (4) and (7) where that importer or distributor places a product with digital elements on the market under his or her name or trademark or carries out a substantial modification of the product with digital elements already placed on the market. Article 1 6 Other cases in which obligations of manufacturers apply A natural or legal person, other than the manufacturer, the importer or the distributor, that carries out a substantial modification of the product with digital elements shall be considered a manufacturer for the purposes of this Regulation . That person shall be subject to the obligations of the manufacturer set out in Article s 10 and 1 1 (1), (2), (4) and (7) , for the part of the product that is affected by the substantial modification or, if the substantial modification has an impact on the cybersecurity of the product with digital elements as a whole, for the entire product. Article 1 7 Identification of economic operators 1. Economic operators shall, on request and where the information is available , provide to the market surveillance authorities the following information : (a) name and address of any economic operator who has supplied them with a product with digital elements ; (b) name and address of any economic operator to whom they have supplied a product with digital elements ; 2. Economic operators shall be able to present the information referred to in paragraph 1 for ten years after they have been supplied with the product with digital elements and for ten years after they have supplied the product with digital elements . CHAPTER II I Conformity of the product with digital elements Article 1 8 Presumption of conformity 1. Products with digital elements and processes put in place by the manufacturer which are in conformity with harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union shall be presumed to be in conformity with the essential requirements covered by those standards or parts thereof , set out in Annex I . 2. Products with digital elements and processes put in place by the manufacturer , which are in conformity with the common specifications referred to in Article 1 9 shall be presumed to be in conformity with the essential requirements set out in Annex I , to the extent those common specifications cover those requirements. 3. Products with digital elements and processes put in place by the manufacturer for which a n EU statement of conformity or certificate has been issued under a European cybersecurity certification scheme adopted as per Regulation (EU) 2019/881 and specified as per paragraph 4, shall be presumed to be in conformity with the essential requirements set out in Annex I in so far as the EU statement of conformity or cybersecurity certificat e , or parts thereof, cover those requirements. 4. The Commission is empowered , by means of implementing acts, to specify the European cybersecurity certification schemes adopted pursuant to Regulation (EU) 2019/881 that can be used to demonstrate conformity with the essential requirements or parts there o f as set out in Annex I . Furthermor e, where applicable, the Commis s i on shall specify if a cybersecurity certificate issued under such scheme s eliminate s the obligation of a manufacturer to carry out a third-party conformity assessment for the corresponding requirements, as set out in Article 2 4 ( 2)(a), (b), (3) (a) and (b) . Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 5 1 (2) . Article 1 9 Common specifications Where harmonised standards referred to in Article 1 8 do not exist or where the Commission considers that the relevant harmonised standards are insufficient to satisfy the requirements of this Regulation or to comply with the standardisation request of the Commission, or where there are undue delays in the standardisation procedure or where the request for harmonised standards by the Commission has not been accepted by the European standardisation organisations , the Commission is empowered , by means of implementing acts, to adopt common specifications in respect of the essential requirements set out in Annex I . Those implementing acts shall be adopted in accordance with the examination proc edure referred to in Article 5 1 (2) . Article 20 EU declaration of conformity 1. The EU declaration of conformity shall be drawn up by manufacture rs in accordance with Article 10 (7) and state that the fulfilment of the applicab le essential requirements set out in Annex I has been demonstrated. 2. The EU declaration of conformity shall have the model structure set out in Annex IV and shall contain the elements specified in the relevant conformity assessment procedures set out in Annex VI. Such a declaration shall be continuously updated . It shall be made available in the language or languages required by the Member State in which the product with digital elements is placed on the market or made available. 3. Where a product with digital elements is subject to more than one Union act requiring an EU declaration of conformity, a single EU declaration of conformity shall be drawn up in respect of all such Union acts. That declaration shall contain the identification of the Union acts concerned, including their publication references. 4. By drawing up the EU declaration of conformity, the manufacturer shall assume responsibility for the compliance of the product . 5. The Commission is empowered to adopt delegated acts in accordance with Article 50 to supplement this Regulation by adding elements to the minimum content of the EU declaration of conformity set out in Annex IV to take account of technological developments. Article 2 1 General principles of the CE marking The CE marking as defined in Article 3(32) shall be subject to the general principles set out in Article 30 of Regulation (EC) No 765/2008. Article 2 2 Rules and conditions for affixing the CE marking 1. The CE marking shall be affixed visibly, l egibly and indelibly to the product with digital elements . Where that is not possible or not warranted on account of the nature of the product with digital elements , it shall be affixed to the packaging and to th e EU declaration of conformity referred to in Article 20 accompanying the product with digital elements . For products with digital elements which are in the form of software , the CE marking shall be affixed either to the EU declaration of conformity referred to in Article 20 or on the website accompanying the software product. 2. On account of the nature of the product with digital elements , the height of the CE marking affixed to the product with digital elements may be lower than 5 mm, provided that it remains visible and legible. 3. The CE marking shall be affixed before the product with digital elements is placed on the market. It may be followed by a pictogram or any other mark i ndicating a special risk or use set out in implementing acts referred to in paragraph 6 . 4. The CE marking shall be followed by the identification number of the notified bod y , where that body is involved in the conformity assessment procedure based on full quality assurance (based on module H) referred to in Article 2 4 . The identification number of the notified body shall be affixed by the body itself or, under its instructions, by the manufacturer or the manufacturer’s authorised representative. 5. Member States shall build upon existing mechanisms to ensure correct application of the regime governing the CE marking and shall take appropriate action in the event of improper use of that marking. Where the product with digital elements is subject to other Union legislation which also provides for the affixing of the CE marking, the CE marking shall indicate that th e product also fulfil s the requirements of that other legislation. 6. The C ommission may , by means of implementing acts , lay down technical specification s for pictograms or any other marks related to the security of the products with digital elements , and mechanisms to promote their use . Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 5 1 (2) . Article 2 3 Technical documentation 1. The technical documentation shall contain all relevant data or details of the means used by the manufacturer to ensure that the product with digital elements and the processes put in place by the manufacturer compl y with the essential requirements set out in Annex I. It shall at least contain the elements set out in Annex V. 2. The technical documentation shall be drawn up before the product with digital elements is placed on the market and shall be continuously updated , where appropriate, during the expected product lifetime or during a period of five years after the placing on the market of a product with digital elements , whichever is shorter. 3. For products with digital elements referred to in Articles 8 and 2 4 (4) that are also subject to other Union acts , one single technical documentation shall be drawn up containing the information referred to in Annex V of this Regulation and the information required by those respective Union acts. 4. The technical documentation and correspondence relating to any conformity assessment procedure shall be drawn up in an official language of the Member State in which the notified body is established or in a language acceptable to that body. 5. T he Commission is empowered to adopt delegated acts in accordance with Article 50 to supplement this Regulation by the elements to be included in the technical documentation set out in Annex V to take account of technological developments, as well as developments encountered in the implementation process of this Regulation . Article 2 4 Conformity assessment procedures for products with digital elements 1. The manufacturer shall perform a conformity assessment of the product with digital elements and the processes put in place by the manufacturer to determine whether the essential requirements set out in Annex I are met . The m anufacturer or the manufacturer’s authorised representative shall demonstrate conformity with the essential requirements by using one of the following procedures: (a) the internal control procedure ( based on module A) set out in Annex VI ; or (b) the EU-type examination procedure ( based on module B) set out in Annex VI followed by c onformity to EU-type based on internal production control ( based on module C ) set out in Annex VI ; or (c) c onformity assessment based on full quality assurance ( based on module H) set out in Annex VI. 2. Where, in assessing the compliance of the critical product with digital elements of class I as set out in Annex III and the processes put in place by its manufacturer with the essential requirements set out in Annex I , the manufacturer or the manufacturer’s authorised representative has not applied or has applied only in part harmonised standards , common specifications or E uropean cybersecurity certification schemes as referred to in Article 1 8 , or where such harmonised standards , common specifications or European cybersecurity certification scheme s do n ot exist, the product with digital elements concerned and the processes put in place by the manufacturer shall be submitted with regard to those essential requirements to either of the following procedures: (a) EU-type examination procedure ( based on module B) provided for in Annex VI followed by c onformity to EU-type based on internal production control ( based on module C ) set out in Annex VI ; or (b) c onformity assessment based on full quality assurance ( based on module H) set out in Annex VI . 3. Where the product is a critical product with digital elements of class II as set out in Annex III , the manufacturer or the manufacturer’s authorised representative shall demonstrate conformity with the essential requirements set out in Annex I by using one of the following procedures: (a) EU-type examination procedure ( based on module B) set out in Annex VI followed by c onformity to EU-type based on internal production control ( based on module C ) set out in Annex VI ; or (b) c onformity assessment based on full quality assurance ( based on module H) set out in Annex VI . 4. Manufacturers of products with digital elements that are classified as EHR systems under the scope of Regulation [ the European Health Data Space Regulation] shall demonstrate conformity with the essential requirements laid down in Annex I of this Regulation using the relevant conformity assessment procedure as required by Regulation [ Chapter III of the European Health Data Space Regulation]. 5. Notified bodies shall take into account the specific interests and needs of small and medium sized enterprises (SMEs) when setting the fees for conformity assessment procedures and reduce those fees proportionately to their specific interests and needs. CHAPTER IV NOTIF ICATION OF CONFORMITY ASSESSMENT BODIES Article 2 5 Notification Member States shall notify the Commission and the other Member States of conformity assessment bodies authorised to carry out conformity assessments in accordance with this Regulation. Article 2 6 Notifying authorities 1. Member States shall designate a notifying authority that shall be responsible for setting up and carrying out the necessary procedures for the assessment and notification of conformity assessment bodies and the monitoring of notified bodies, including compliance with Article 3 1 . 2. Member States may decide that the assessment and monitoring referred to in paragraph 1 shall be carried out by a national accreditation body within the meaning of and in accordance with Regulation (EC) No 765/2008. Article 2 7 Requirements relating to notifying authorities A notifying authority shall be established in such a way that no conflict of interest with conformity assessment bodies occurs. A notifying authority shall be organised and shall function so as to safeguard the objectivity and impartiality of its activities. A notifying authority shall be organised in such a way that each decision relating to notification of a conformity assessment body is taken by competent persons different from those who carried out the assessment. A notifying authority shall not offer or provide any activities that conformity assessment bodies perform or consultancy services on commercial or competitive basis. A notifying authority shall safeguard the confidentiality of the information it obtains. A notifying authority shall have a sufficient number of competen t personnel at its disposal for the proper performance of its tasks. Article 2 8 Information obligation on notifying authorities 1. Member States shall inform the Commiss ion of their procedures for the assessment and notification of conformity assessment bodies and the monitoring of notified bodies, and of any changes thereto. 2. The Commission shall make that information publicly available. Article 2 9 Requirements relating to notified bodies 1. For the purposes of notification, a conformity assessment body shall meet the requirements laid down in paragraphs 2 to 1 2 . 2. A conformity assessment body shall be established under national law and have legal personality. 3. A conformity assessment body shall be a third-party body independent of the organisation or the product it assesses. A body belonging to a business association or professional federation representing undertakings involved in the design, development, production , provision, assembly, use or maintenance of products with digital elements which it assesses, may, on condition that its independence and the absence of any conflict of interest are demonstrated, be considered such a body. 4. A conformity assessment body, its top level management and the personnel responsible for carrying out the conformity assessment tasks shall not be the designer, developer, manufacturer, supplier, installer, purchaser, owner, user or maintainer of the products with digital elements which they assess, nor the authorised representative of any of those parties. This shall not preclude the use of assessed products that are necessary for the operations of the conformity assessment body or the use of such products for personal purposes. A conformity assessment body, its top level management and the personnel responsible for carrying out the conformity assessment tasks shall not be directly involved in the design, development, production , the marketing, installation, use or maintenance of those products, or represent the parties engaged in those activities. They shall not engage in any activity that may conflict with their independence of judgement or integrity in relation to conformity assessment activities for which they are notified. This shall in particular apply to consultancy services. Conformity assessment bodies shall ensure that the activities of their subsidiaries or subcontractors do not affect the confidentiality, objectivity or impartiality of their conformity assessment activities. 5. Conformity assessment bodies and their personnel shall carry out the conformity assessment activities with the highest degree of professional integrity and the requisite technical competence in the specific field and shall be free from all pressures and inducements, particularly financial, which might influence their judgement or the results of their conformity assessment activities, especially as regards persons or groups of persons with an interest in the results of those activities. 6. A conformity assessment body shall be capable of carrying out all the conformity assessment tasks referred to in Annex VI and in relation to which it has been notified, regardless of whether those tasks are carried out by the conformity assessment body itself or on its behalf and under its responsibility . At all times and for each conformity assessment procedure and each kind or category of products with digital elements in relation to which it has been notified, a conformity assessment body shall have at its disposal the necessary: (a) staff with technical knowledge and sufficient and appropriate experience to perform the conformity assessment tasks; (b) descriptions of procedures in accordance with which conformity assessment is carried out, ensuring the transparency and the ability of reproduction of those procedures. It shall have appropriate policies and procedures in place that distinguish between tasks it carries out as a notified body and other activities; (c) procedures for the performance of activities which take due account of the size of an undertaking, the sector in which it operates, its structure, the degree of complexity of the product technology in question and the mass or serial nature of the production process. It shall have the means necessary to perform the technical and administrative tasks connected with the conformity assessment activities in an appropriate manner and shall have access to all necessary equipment or facilities. 7. The personnel responsible for carrying out conformity assessmen t activities shall have the following: (a) sound technical and vocational training covering all the conformity assessment activities in relation to which the conformity assessment body has been notified; (b) satisfactory knowledge of the requirements of the assessments they carry out and adequate authority to carry out those assessments; (c) appropriate knowledge and understanding of the essential requirements, of the applicable harmonised standards and of the relevant provisions of Union harmonisation legislation and of its implementing acts ; (d) the ability to draw up certificates, records and reports demonstrating that assessments have been carried out. 8. The impartiality of the conformity assessment bodies, their top level management and of the assessment personnel shall be guaranteed. The remuneration of the top level management and assessment personnel of a conformity assessment body shall not depend on the number of assessments carried out or on the results of those assessments. 9. Conformity assessment bodies shall take out liability insurance unless liability is assumed by the State in accordance with national law, or the Member State itself is directly responsible for the conformity assessment. 10. The personnel of a conformity assessment body shall observe professional secrecy with regard to all information obtained in carrying out their tasks under Annex VI or any provision of national law giving effect to it, except in relation to the market surveillance authorities of the Member State in which its activities are carried out. Proprietary rights shall be protected. The conformity assessment body shall have documented procedures ensuring compliance with this paragraph . 11. Conformity assessment bodies shall participate in, or ensure that their assessment personnel are informed of, the relevant standardisation activities and the activities of the notified body coordination group established under Article 40 and apply as general guidance the administrative decisions and documents produced as a result of the work of that group. 12. Conformity assessment bodies shall operate in accordance with a set of consistent, fair and reasonable terms and conditions, in particular taking into account the interests of SMEs in relation to fees. Article 30 Presumption of conformity of notified bodies Where a conformity assessment body demonstrates its conformity with the criteria laid down in the relevan t harmonised standards or parts thereof the references of which have been published in the Official Journal of the European Union it shall be presumed to comply with the requirements set out in Article 2 9 in so far as the applicable harmonised standards cover those requirements . Article 3 1 Subsidiaries of and subcontracting by notified bodies 1. Where a notified body subcontracts specific tasks connected with conformity assessment or has recourse to a subsidiary, it shall ensure that the subcontractor or the subsidiary meets the requirements set out in Article 2 9 and shall inform the notifying authority accordingly. 2. Notified bodies shall take full responsibility for the tasks performed by subcontractors or subsidiaries wherever these are established. 3. Activities may be subcontracted or carried out by a subsidiary only with the agreement of the manufacturer . 4. Notified bodies shall keep at the disposal of the notifying authority the relevant documents concerning the assessment of the qualifications of the subcontractor or the subsidiary and the work carried out by them under this Regulation. Article 3 2 Application for notification 1. A conformity assessment body shall submit an application for notification to the notifying authority of the Member State in which it is established. 2. That application shall be accompanied by a description of the conformity assessment activities, the conformity assessment procedure or procedure s and the product or products for which that body claims to be competent, as well as by an accreditation certificate, where one exists, issued by a national accreditation body attesting that the conformity assessment body fulfils the requirements laid down in Article 2 9 . 3. Where the conformity assessment body concerned cannot provide an accreditation certificate, it shall provide the notifying authority with all the documentary evidence necessary for the verification, recognition and regular monitoring of its compliance with the requirements laid down in Article 2 9 . Article 3 3 Notification procedure 1. Notifying authorities may notify only conformity assessment bodies , which have satisfied the requirements laid down in Article 2 9 . 2. The notifying authority shall notify the Commission and the other Member States using the New Approach Notified and Designated Organisations (NANDO) information system developed and managed by the Commission. 3. The notification shall include full details of the conformity assessment activities, the conformity assessment module or modules and product or products concerned and the relevant attestation of competence. 4. Where a notification is not based on an accreditation certificate as referred to in Article 3 2 (2) , the notifying authority shall provide the Commission and the other Member States with documentary evidence which attests to the conformity assessment body's competence and the arrangements in place to ensure that that body will be monitored regularly and will continue to satisfy the requirements laid down in Article 2 9 . 5. The body concerned may perform the activities of a notified body only where no objections are raised by the Commission or the other Member States within two weeks of a notification where an accreditation certificate is used or within two months of a notification where accreditation is not used. Only such a body shall be considered a notified body for the purposes of this Regulation . 6. The Commission and the other Mem ber States shall be notified of any subsequent relevant changes to the notification. Article 3 4 Identification numbers and lists of notified bodies 1. The Commission shall assign an identification number to a no tified body. It shall assign a single such number even where the body is notified under several Union acts. 2. The Commission shall make publicly available the list of the bodies notified under this Regulation, including the identification numbers that have been allocated to them and the activities for which they have been notified. The Commission shall ensure that that list is kept up to date. Article 3 5 Changes to notifications 1. Where a notifying authority has ascertained or has been informed that a notified body no longer meets the requirements laid down in Article 2 9 , or that it is failing to fulfil its obligations, the notifying authority shall restrict, suspend or withdraw notification as appropriate, depending on the seriousness of the failure to meet those requirements or fulfil those obligations. It shall immediately inform the Commission and the other Member States accordingly. 2. In the event of restriction, suspension or withdrawal of notification, or where the notified body has ceased its activity, the notifying Member State shall take appropriate steps to ensure that the files of that body are either processed by another notified body or kept available for the responsible notifying and market surveillance authorities at their request. Article 3 6 Challenge of the competence of notified bodies 1. The Commission shall investigate all cases where it doubts, or doubt is brought to its attention regarding the competence of a notified body or the continued fulfilment by a notified body of the requirements and responsibilities to which it is subject. 2. The notifying Member State shall provide the Commission, on request, with all information relating to the basis for the notification or the maintenance of the competence of the body concerned. 3. The Commission shall ensure that all sensitive information obtained in the course of its investigations is treated confidentially. 4. Where the Commission ascertains that a notified body does not meet or no longer meets the requirements for its notification, it shall inform the notifying Member State accordingly and request it to take the necessary corrective measures, including de-notification if necessary. Article 3 7 Operational obligations of notified bodies 1. Notified bodies shall carry out conformity assessments in accordance with the conformity assess ment procedures provided for in Article 2 4 and Annex VI . 2. Conformity assessments shall be carried out in a proportionate manner, avoiding unnecessary burdens for economic operators. Conformity assessment bodies shall perf orm their activities taking due account of the size of an undertaking, the s ector in which it operates, its structure, the degree of complexity of the product technology in question and the mass or serial na ture of the production process. 3. Notified bodies shall however respect the degree of rigour and the level of protection required for the compliance of the product with the provisions of Regulation . 4. Where a notified body finds that r equirements laid down in Annex I or in cor responding harmonised standards or in common specifications as referred to in Article 1 9 have not been met by a manufacturer, it shall require that manufacturer to take appropriate corrective measures and shall not issue a conformity certificate. 5. Where, in the course of the monitoring o f conformity following the issuance of a certificate, a notified body finds that a product no longer complies with t he requirements laid down in this Regulation , it shall require the manufacturer to take appropriate corrective measures and shall suspend or withdraw the certificate if necessary. 6. Where corrective measures are not taken or do not have the required effect, the notified body shall restrict, suspend or withdraw any certificates, as appropriate. Article 3 8 Information obligation on notified bodies 1. Notified bodies shall inform the notifying authority of the following: (a) any refusal, restriction, suspension or withdrawal of a certificate; (b) any circumstances affecting the scope of and conditions for notification; (c) any request for information which they have received from market surveillance authorities regarding conformity assessment activities; (d) on request, conformity assessment activities performed within the scope of their notification and any other activity performed, including cross-border activities and subcontracting. 2. Notified bodies shall provide the other bodies notified under this Regulation carrying out similar conformity assessment activities covering the same products with relevant information on issues relating to negative and, on request, positive conformity assessment results. Article 3 9 Exchange of experience The Commission shall provide for the organisation of exchange of experience between the Member States' national authorities responsible for notification policy. Article 40 Coordination of notified bodies 1. The Commission shall ensure that appropriate coordination and cooperation between notified bodies are put in place and properly operated in the form of a cross-sectoral group of notified bodies. 2. Member States shall ensure that the bodies notified by them participate in the work of that group, directly or by means of designated representatives. CHAPTER V MARKET SURVEILLANCE AND ENFORCEMENT Article 4 1 Market surveillance and control of products with digital elements in the Union market 1. Regulation (EU) 2019/1020 shall apply to the products with digital elements with in the scope of this Regulation. 2. Each Member State shall designate one or more market surveillance authorities for the purpose of ensuring the effective implementation of this Regulation. Member States may designate an existing or new authority to act as market surveillance authority for this Regulation. 3. Where relevant, t he market surveillance authorities shall cooperate with the national cybersecurity certification authorities designated under Article 58 of Regulation (EU) 201 9/881 and exchange information on a regular basis. With respect to the supervision of the implementation of the reporting obligations pursuant to Article 1 1 of this Regulation , the designated market surveillance authorities shall cooperate with ENISA. 4. Where relevant, the market surveillance authorities shall cooperate with other market surveillance authorities designated on the basis of other Union harmonisation legislation for other products , and exchange information on a regular basis. 5. M arket surveillance authorities shall cooperate, as appropriate, with the authorities supervising Union data protection law. Such cooperation includes informing these authorities of any finding relevant for the fulfilment of their competences , including when issuing guidance and advice pursuant to paragraph 8 of this Article if such guidance and advice concerns the processing of personal data . Authorities supervising Union data protection law shall have the power to request and access any documentation created or maintained under this Regulation when access to that documentation is necessary for the fulfilment of their tasks . They shall inform the designated market surveillance authorit ies of the Member State concerned of any such request . 6. Member States shall ensure that the designated market surveillance authorities are provided with adequate financial and human resources to fulfil their tasks under this Regulation. 7. The Commission shall facilitate the exchange of experience between designated market surveillance authorities. 8. M arket surveillance authorities may provide guidance and advice to economic operators on the implementation of this Regulation, with the support of the Commission . 9. The market surveillance authorit ies shall report to the Commission on a n annual basis the outcomes of relevant market surveillance activities. The designated market surveillance authorit ies shall report, without delay, to the Commission and relevant national competition authorities any information identified in the course of market surveillance activities that may be of potential interest for the application of Union competition law. 10. For p roducts with digital elements in the scope of this Regulation classified as high-risk AI systems according to Article [ Article 6 ] of the Regulation [ the AI Regulation] , t he market surveillance authorities designated for the purposes of the Regulation [ the AI Regulation ] shall be the authorities responsible for market surveillance activities required under this Regulation. The market surveillance authorities designated pursuant to Regulation [ the AI Regulation] shall cooperate, as appropriate, with the market surveillance authorities designated pursuant to this Regulation and, with respect to the supervision of the implementation of the reporting obligations pursuan t to Article 1 1 , with ENISA . Market surveillance authori ties designated pursuant to Regulation [ the AI Regulation] shall in particular inform market surveillance authorities designated pursuant to this Regulation of any finding relevant for the fulfilment of their tasks in relation to the implementation of this Regulation . 11. A dedicated administrative cooperation group (ADCO) sh all be established for the uniform application of this Regulation, pursuant to Article 30(2) of Regulation (EU) 2019/1020. This ADCO sh all be composed of representatives of the designated market surveillance authorities and, if appr opriate, representatives of single liaison offices. Article 4 2 Access to data and documentation Where necessary to assess the conformity of products with digital elements and the processes put in place by their manufacturer s with the essential requirements set out in Annex I and upon a reasoned request, the market surveillance authorities shall be granted access to the data required to assess the design, development , production and vulnerability handling of such products, including related internal documentation of the respective economic operator . Article 4 3 Procedure at national level concerning products with digital elements presenting a significant cybersecurity risk 1. Where the market surveillance authorit y of a Member State has sufficient reasons to consider that a product with digital elements , including its vulnerability handling, presents a significant cybersecurity risk, it shall carry out an evaluation of the product with digital elements concerned in respect of its compliance with all the requirements laid down in this Regulation. The relevant economic operators shall cooperate as necessary with the market surveillance authorit y . Where, in the course of that evaluation, the market surveillance authorit y finds that the product with digital elements does not comply with the requirements laid down in this Regulation, it shall without delay require the relevant operator to take all appropriate corrective actions to bring the product into compliance with those requirements , to withdraw it from the market, or to recall it within a reasonable period, commensurate with the nature of the risk, as it may prescribe. The market surveillance authorit y shall inform the relevant notified body accordingly. Article 18 of Regulation (EU) 2019/1020 shall apply to the appropriate corrective actions . 2. Where the market surveillance authorit y consider s that non-compliance is not restricted to its national territory, it shall inform the Commission and the other Member States of the results of the evaluation and of the actions which it has required the operator to take. 3. The manufacturer shall ensure that all appropriate corrective action is taken in respect of all the products with digital elements concerned that it has made available on the market throughout the Union. 4. Where the manufacture r of a product with digital elements does not take adequate corrective action within the period referred to in paragraph 1 , second subparagraph, the market surveillance authorit y shall take all appropriate provisional meas ures to prohibit or restrict that product being made available on its national market, to withdraw it from that market or to recall it. That authorit y shall inform the Commission and the other Member States, without delay, of those measures. 5. The information referred to in paragraph 4 shall include all available details, in particular the data necessary for the identification of the non-compliant products with digital elements , the origin of the product with digital elements , the nature of the alleged non-compliance and the risk involved, the nature and duration of the national measures taken and the arguments put forward by the relevant operator. In particular, the market surveillance authorit y shall indicate whether the non-compliance is due to one or more of the following: (a) a failure of the product or of the processes put in place by the manufacturer to meet the essential requirements set out in Annex I ; (b) shortcomings in the harmonised standards , cybersecurity certification scheme s , or common specifications , referred to in Article 1 8 . 6. The market surveillance authorities of the Member States other than the market surveillance authority of the Member State initiating the procedure shall without delay inform the Commission and the other Member States of any measures adopted and of any additional information at their disposal relating to the non-compliance of the product concerned, and, in the event of disagreement with the notified national measure, of their objections. 7. Where, within three months of receipt of the information referred to in paragraph 4 , no objection has been raised by either a Member State or the Commission in respect of a provisional measure taken by a Member State, that measure shall be deemed justified. This is without prejudice to the procedural rights of the operator concerned in accordance with Article 18 of Regulation (EU) 2019/1020. 8. The market surveillance authorities of all Member States shall ensure that appropriate restrictive measures are taken in respect of the product concerned, such as withdrawal of the product from their market, without delay. Article 4 4 Union safeguard procedure 1. Where, within three months of receipt of the notification referred to in Article 4 3 ( 4 ), objections are raised by a Member State against a measure taken by another Member State, or where the Commission considers the measure to be contrary to Union l egislation , the Commission shall without delay enter into consultation with the relevant Member State and the economic operator or operators and shall evaluate the national measure. On the basis of the results of that evaluation, the Commission shall decide whether the national measure is justified or not within nine months from the notification referred to in Article 4 3 (4) and notify such decision to the Member State concerned. 2. If the national measure is considered justified, all Member States shall take the measures necessary to ensure that the non-compliant product with digital elements is withdrawn from their market, and shall inform the Commission accordingly. If the national measure is considered unjustified, the Member State concerned shall withdraw the measure. 3. Where the national measure is considered justified and the non-compliance of the product with digital elements is attributed to shortcomings in the harmonised standards , the Commission shall apply the procedure provided for in Article 1 0 of Regulation (EU) No 1025/2012. 4. Where the national measure is considered justified and the non-compliance of the product with digital elements is attributed to shortcomings in a European cybersecurity certification scheme as referred to in Article 1 8 , the Commission shall consider whether to amend or repeal the implementing act as referred to in Article 1 8 (4) that specifies the presumption of conformity concerning that certification scheme . 5. Where the national measure is considered justified and the non-compliance of the product with digital elements is attributed to shortcomings in common specifications as referred to in Article 1 9 , the Commission shall consider whether to amend or repeal the implementing act referred to in Article 1 9 setting out those common specifications. Article 4 5 Procedure at EU level concerning products with digital elements presenting a significant cybersecurity risk 1. Where the Commission has sufficient reasons to consider, including based on information provided by ENISA, that a product with digital elements that presents a significant cybersecurity risk is non-compliant with the requirements laid down in this Regulation, it may request the relevant market surveillance authorities to carry out an evaluation of compliance and follow the procedures referred to in Article 4 3 . 2. In exceptional circumstances which justify an immediate intervention to preserve the good functioning of the internal market and where the Commission has sufficient reasons to consider that the product referred to in paragraph 1 remains non-compliant with the requirements laid down in this Regulation and no effective measures have been taken by the relevant market surveillance authorities, the Commission may request ENISA to carry out an evaluation of compliance . The Commission shall inform the relevant market surveillance authorities accordingly. The relevant economic operators shall cooperate as necessary with ENISA. 3. Based on ENISA’s evaluation, the Commission may decide that a corrective or restrictive measure is necessary at Union level. To this end, it shall without delay consult the Member States concerned and the relevant economic operator or operators. 4. On the basis of the consultation referred to in paragraph 3 , the Commission may adopt implementing acts to decide on corrective or restrictive measures at Union level, including ordering withdrawal from the market, or recalling, within a reasonable period, commensurate with the nature of the risk. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 5 1 (2) . 5. The Commission shall immediately communicate the decision referred to in paragraph 4 to the relevant economic operator or operators. Member States shall implement the acts referred to in paragraph 4 without delay and shall inform the Commission accordingly. 6. Paragraphs 2 to 5 are applicable for the duration of the exceptional situation that justified the Commission’s intervention and for as long as the respective product is not brought in compliance with this Regulation. Article 4 6 Compliant products with digital elements which present a significant cybersecurity risk 1. Where, having performed an evaluation under Article 4 3 , the market surveillance authority of a Member State finds that although a product with digital elements and the processes put in place by the manufacturer are in compliance with this Regulation, they present a significant cybersecurity risk and , in addition, they pose a risk to the health or safety of persons, to the compliance with obligations under Union or national law intended to protect fundamental rights , the availability authenticity, integrity or confidentiality of services offered using an electronic information system by essential entities of the type referred to in [Annex I to Directive XX X / XXXX ( NIS2 ) ] or to other aspects of public interest protection , it shall require the relevant operator to take all appropriate measures to ensure that the product with digital elements and the processes put in place by the manufacturer concerned, when placed on the market, no longer present that risk, to withdraw the product with digital elements from the market or to recall it within a reasonable period, commensurate with the nature of the risk. 2. The manufacturer or other relevant operators shall ensure that corrective action is taken in respect of the products with digital elements concerned that they have made available on the market throughout the Union within the timeline established by the market surveillance authority of the Member State referred to in paragraph 1. 3. The Member State shall immediately inform the Commission and the other Member States about the measures taken pursuant to paragraph 1 . That information shall include all available details, in particular the data necessary for the identification of the products with digital elements concerned, the origin and the supply chain of those products with digital elements , the nature of the risk involved and the nature and duration of the national measures taken. 4. The Commission shall without delay enter into consultation with the Member States and the relevant economic operator and shall evaluate the nation al measures taken. On the basis of the results of that evaluation, the Commission shall decide whether the measure is justified or not and, where necessary, propose appropriate measures. 5. The Commission shall address its decision to the Member States. 6. Where the Commission has sufficient reasons to consider, including based on information provided by ENISA, that a product with digital elements, although compliant with this Regulation, presents the risks referred to in paragraph 1, it may request the relevant market surveillance authority or authorities to carry out an evaluation of compliance and follow the procedures referred to in Article 4 3 and paragraphs 1 , 2 and 3 of this A rticle. 7. In exceptional circumstances which justify an immediate intervention to preserve the good functioning of the internal market and where the Commission has sufficient reasons to consider that the product referred to in paragraph 6 continues to present the risks referred to in paragraph 1 and no effective measures have been taken by the relevant national market surveillance authorities, the Commission may request ENISA to carry out an evaluation of the risks presented by that product and shall inform the relevant market surveillance authorities accordingly. The relevant economic operators shall cooperate as necessary with ENISA. 8. Based on ENISA’s evaluation referred to in paragraph 7, the Commission may establish that a corrective or restrictive measure is necessary at Union level. To this end, it shall without delay consult the Member States concerned and the relevant operator or operators. 9. On the basis of the consultation referred to in paragraph 8, the Commission may adopt implementing acts to decide on corrective or restrictive measures at Union level, including ordering withdrawal from the market, or recalling, within a reasonable period, commensurate with the nature of the risk. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 5 1 (2) . 10. The Commission shall immediately communicate the decision referred to in the paragraph 9 to the relevant operator or operators. Member States shall implement such acts without delay and shall inform the Commission accordingly. 11. Paragraphs 6 to 10 shall appl y for the duration of the exceptional situation that justified the Commission’s intervention and for as long as the respective product continues to present the risks referred to in paragraph 1. Article 4 7 Formal non-compliance 1. Where the market surveillance authority of a Member State makes one of the following findings, it shall require the relevant manufacturer to end to the non-compliance concerned: (a) the conformity marking has been affixed in violation of Article s 2 1 and 2 2 ; (b) the conformity marking has not been affixed; (c) the EU declaration of conformity has not been drawn up; (d) the EU declaration of conformity has not been drawn up correctly; (e) the identification number of the notified body, which is involved in the conformity assessment procedure, where applicable, has not been affixed; (f) the technical documentation is either not available or not complete. 2. Where the non-compliance referred to in paragraph 1 persists, the Member State concerned shall take all appropriate measures to restrict or prohibit the product with digital elements from being made available on the market or ensure that it is recalled or withdrawn from the market. Article 4 8 Joint activities of market surveillance authorities 1. M arket surveillance authorities may agree with other relevant authorities to carry out joint activities aimed at ensuring cybersecurity and protection of consumers with respect to specific products with digital elements placed or made available on the market, in particular products t hat are often found to present cybersecurity risk s . 2. The Commission or ENISA may propose joint acti vities for checking compliance with this Regulation to be conducted by market surveillance authorities based on indications or information of potential non-compliance across several Member States of products falling in the scope of this Regulation with the requirements laid down by the latter. 3. The market surveillance authorities and the Commission, where applicable, shall ensure that the agreement to carry out joint activities does not lead to unfair competition between economic operators and does not negatively affect the objectivity, independence and impartiality of the parties to the agreement. 4. A market surveillance authority may use any information resulting from the activities carried out as part of any investigation that it undertakes. 5. The market surveillance authority concerned and the Commission , where applicable , shall make the agreement on joint activities, including the names of the parties involved, available to the public. Article 4 9 Sweeps 1. Market surveillance authorities may decide to conduct simultaneous coordinated control actions (“sweeps”) of particular products with digital elements or categories thereof to check compliance with or to detect infringements to this Regulation. 2. Unless otherwise agreed upon by the market surveillance authorities involved , sweeps shall be coordinated by the Commission. The coordinator of the sweep may, where appropriate, make the aggregated results publicly available. 3. ENISA m ay identify , in the performance of its tasks, including based on the notifications received according to Article 1 1 (1) and (2), categories o f products for which sweeps may be organised . The proposal for sweeps shall be submitted to the potential coordinator referred to in paragraph 2 for the consideration of the market surveillance author i ties. 4. When conducting sweeps, the market surveillance authorities involved may use the investigation powers set out Articles 4 1 to 4 7 and any other powers conferred upon them by national law. 5. Market surveillance authorities may invite Commission officials, and other accompanying persons authorised by the Commission, to participate in sweeps. CHAPTER VI DELEGATED POWERS AND COMMITTEE PROCEDURE Article 50 Exercise of the delegation 1. The power to adopt delegated acts is conferred on the Commission subject to the conditions laid down in this Article. 2. The power to adopt delegated acts referred to in Article 2( 4 ), Article 6(2), Article 6( 3), Article 6( 5 ) , Article 20 (5) and Article 2 3 (5) shall be conferred on the Commission . 3. The delegation of power referred to in Article 2( 4 ), Article 6(2), Article 6(3), Article 6( 5 ) , Article 20 (5) and Article 2 3 (5) may be revoked at any time by the European Parliament or by the Council. A decision to revoke shall put an end to the delegation of the power specified in that decision. It shall take effect the day following the publication of the decision in the Official Journal of the European Union or at a later date specified therein. It shall not affect the validity of any delegated acts already in force. 4. Before adopting a delegated act, the Commission shall consult experts designated by each Member State in accordance with principles laid down in the Inter-institutional Agreement of 13 April 2016 on Better Law-Making . 5. As soon as it adopts a delegated act, the Commission shall notify it simultaneously to the European Parliament and to the Council. 6. A delegated act adopted pursuant to Article 2( 4 ), Article 6(2), Article 6( 3), Article 6( 5 ) , Article 20 (5) and Article 2 3 (5) shall enter into force only if no objection has been expressed either by the European Parliament or by the Council within a period of two months of notification of that act to the European Parliament and to the Council or if, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object. That period shall be extended by two months at the initiative of the European Parliament or of the Council. Article 5 1 Committee procedure 1. The Commission shall be assisted by a committee. That committee shall be a committee within the meaning of Regulation (EU) No 182/2011. 2. Where reference is made to this paragraph, Article 5 of Regulatio n (EU) No 182/2011 shall apply. 3. Where the opinion of the committee is to be obtained by written procedure, that procedure shall be terminated without result when, within the time-limit for delivery of the opinion, the chair of the committee so decides or a committee member so requests. CHAPTER VII CONFIDENTIALITY AND PENALTIES Article 5 2 Confidentiality 1. All parties involved in the application of this Regulation shall respect the confidentiality of information and data obtained in carrying out their tasks and activities in such a manner as to protect, in particular : (a) intellectual property rights, and confidential business information or trade secrets of a natural or legal person, including source code, except the cases referred to in Article 5 of Directive 2016/943 of the European Parliament and of the Council ; (b) the effective implementation of this Regulation, in particular for the purpose of inspections, investigations or audits; (c) public and national security interests; (d) integrity of criminal or administrative proceedings. 2. Without prejudice to paragraph 1, information exchanged on a confidential basis between the market surveillance authorities and between market surveillance authorities and the Commission shall not be disclosed without the prior agreement of the originating market surveillance authority. 3. Paragraphs 1 and 2 shall not affect the rights and obligations of the Commissi on, Member States and notified bodies with regard to the exchange of information and the dissemination of warnings, nor the obligations of the persons concerned to provide information under criminal law of the Member States . 4. The Commission and Member States may exchange , where necessary, sensitive information with re levant authorities of third countries with which they have concluded bilateral or multilateral confidentiality arrangements guaranteeing an adequate level of protection . Article 5 3 Penalties 1. Member States shall lay down the rules on penalties applicable to infringements by economic operators of this Regulation and shall take all measures necessary to ensure that they are enforced. The penalties provided for shall be effective, proportionate and dissuasive. 2. Member States shall , without delay, notify the Commission of those rules and of those measures and shall notify it without delay of any subsequent amendment affecting them. 3. The non-compliance with the essential cybersecurity requirements laid down in Annex I and the obligations set out in Articles 10 and 1 1 shall be subject to administrative fines of up to 15 000 000 EUR or , if the offender is a n undertaking , up to 2.5 % of the its total worldwide annual turnover for the preceding financial year, whichever is higher. 4. The non-compliance with any other obligations under this Regulation shall be subject to administrative fines of up to 10 000 000 EUR or , if the offender is a n undertaking , up to 2 % of its total worldwide annual turnover for the preceding financial year, whichever is higher. 5. The supply of incorrect, incomplete or misleading information to notified bodies and market surveillance authorities in reply to a request shall be subject to administrative fines of up to 5 000 000 EUR or, if th e offender is a n undertaking , up to 1 % of its total worldwide annual turnover for the preceding financial year, whichever is higher. 6. When deciding on the amount of the administrative fine in each individual case, all relevant circumstances of the specific situation shall be taken into account and due regard shall be given to the following: (a) the nature, gravity and duration of the infringement and of its consequences; (b) whether administrative fines have been already applied by other market surveillance authorities to the same operator for a similar infringement ; (c) the size and market share of the operator committing the infringement . 7. M arket surveillance authorities that apply administrative fines shall share this information with the market surveillance authorities of other Member States through the information and communication system referred to in Article 34 of Regulation (EU) 2019/1020. 8. Each Member State shall lay down rules on whether and to what extent administrative fines may be imposed on public authorities and bodies established in that Member State. 9. Depending on the legal system of the Member States, the rules on administrative fines may be applied in such a manner that the fines are imposed by competent national courts o r other bodies according to the competences established at national level in those Member States. The application of such rules in those Member States shall have an equivalent effect. 10. Administrative fines may be imposed , depending on the circumstances of each individual case, in addition to any other corrective or restrictive measures applied by the market surveillance authorities for the same infringement. CHAPTER VIII TRANSITIONAL AND FINAL PROVISIONS Article 5 4 Amendment to Regulation ( EU) 2019/1020 In Annex I to Regulation (EU) 2019/1020 the following point is added: ’71. [Regulation XXX][C yber R esilience A ct ] ’ . Article 5 5 Transitional provisions 1. E U type-examination certificates and approval decisions issued regarding cybersecurity requirements for products with digital elements that are subject to other Union harmonisation legislation shall remain valid until [ 42 months after the date of entry into force of this Regulation], unless they expire before that date , or unless otherwise specified in other Union legislation, in which case they shall remain valid as referred to in that Union legislation . 2. P roducts with digital elements that have been placed on the market before [date of application of this Regulation referred to in Article 5 7 ], shall be subject to requirements of this Regulation only if, from that date, those products are subject to substantial modification s in their design or intended purpose . 3. By way of derogation from paragraph 2, the obligations laid down in Article 1 1 shall apply to all products with digital elements within the scope of this Regulation that have been placed on the market before [date of application of this Regulation referred to in Article 5 7 ]. Article 5 6 Evaluation and review By [ 36 months after the date of application of this Regulation] and every four years thereafter, the Commission shall submit a report on the evaluation and review of this Regulation to the European Parliament and to the Council. The reports shall be made public. Article 5 7 Entry into force and application This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union . It shall apply from [ 24 months after the date of entry into force of this Regulation ] . However Article 1 1 shall apply from [ 12 months after the date of entry into force of this Regulation ] . This Regulation shall be binding in its entirety and directly applicable in all Member States. Done at Brussels, For the European Parliament For the Council The President The President LEGISLATIVE FINANCIAL STATEMENT 1. FRAMEWORK OF THE PROPOSAL/INITIATIVE 1.1. Title of the proposal/initiative 1.2. Policy area(s) concerned 1.3. The proposal/initiative relates to: 1.4. Objective(s) 1.4.1. General objective(s) 1.4.2. Specific objective(s) 1.4.3. Expected result(s) and impact 1.4.4. Indicators of performance 1.5. Grounds for the proposal/initiative 1.5.1. Requirement(s) to be met in the short or long term including a detailed timeline for roll-out of the implementation of the initiative 1.5.2. Added value of Union involvement (it may result from different factors, e.g. coordination gains, legal certainty, greater effectiveness or complementarities). For the purposes of this point 'added value of Union involvement' is the value resulting from Union intervention which is additional to the value that would have been otherwise created by Member States alone. 1.5.3. Lessons learned from similar experiences in the past 1.5.4. Compatibility with the Multiannual Financial Framework and possible synergies with other appropriate instruments 1.5.5. Assessment of the different available financing options, including scope for redeployment 1.6. Duration and financial impact of the proposal/initiative 1.7. Management mode(s) planned 2. MANAGEMENT MEASURES 2.1. Monitoring and reporting rules 2.2. Management and control system(s) 2.2.1. Justification of the management mode(s), the funding implementation mechanism(s), the payment modalities and the control strategy proposed 2.2.2. Information concerning the risks identified and the internal control system(s) set up to mitigate them 2.2.3. Estimation and justification of the cost-effectiveness of the controls (ratio of "control costs ÷ value of the related funds managed"), and assessment of the expected levels of risk of error (at payment & at closure) 2.3. Measures to prevent fraud and irregularities 3. ESTIMATED FINANCIAL IMPACT OF THE PROPOSAL/INITIATIVE 3.1. Heading(s) of the multiannual financial framework and expenditure budget line(s) affected 3.2. Estimated financial impact of the proposal on appropriations 3.2.1. Summary of estimated impact on operational appropriations 3.2.2. Estimated output funded with operational appropriations 3.2.3. Summary of estimated impact on administrative appropriations 3.2.4. Compatibility with the current multiannual financial framework 3.2.5. Third-party contributions 3.3. Estimated impact on revenue LEGISLATIVE FINANCIAL STATEMENT 1. FRAMEWORK OF THE PROPOSAL/INITIATIVE 1.1. Title of the proposal/initiative Proposal for a Regulation on horizontal cybersecurity requirements for products with digital elements ( Cyber Resilience Act ) 1.2. Policy area(s) concerned Communications Networks, Content and Technology 1.3. The proposal/initiative relates to: × a new action a new action following a pilot project/preparatory action the extension of an existing action a merger or redirection of one or more actions towards another/a new action 1.4. Objective(s) 1.4.1. General objective(s) The proposal has two main objectives aiming to ensure the proper functioning of the internal market: (1) create conditions for the development of secure products with digital elements by ensuring that hardware and software products are placed on the market with fewer vulnerabilities and that manufactures take security seriously throughout a product’s life cycle; and (2) create conditions allowing users to take cybersecurity into account when selecting and using products with digital elements . 1.4.2. Specific objective(s) Four specific objectives were set out for the proposal : (i) to ensure that manufacturers improve the security of products with digital elements since the design and development phase and throughout the whole life cycle; (ii) to ensure a coherent cybersecurity framework, facilitating compliance for hardware and software producers; (iii) to enhance the transparency of security properties of products with digital elements , and (iv) to enable businesses and consumers to use products with digital elements securely . Expected result(s) and impact Specify the effects which the proposal/initiative should have on the beneficiaries/groups targeted. The proposal would bring significant benefits to the various stakeholders. For businesses, it would prevent divergent security rules for products with digital elements and decrease compliance costs for related cybersecurity legislation. It would reduce the number of cyber incidents, incident handling costs and reputational damage. For the whole EU, it is estimated that the initiative could lead to a costs reduction from incidents affecting companies by approximately EUR 180 billion to EUR 290 billion annually . It would lead to an increased turnover due to uptake of products with digital elements demand. It would improve the companies’ global reputation leading to a demand uptake also outside the EU. For users, the preferred option would enhance the transparency of the security properties and facilitate the use of products with digital elements . Consumers and citizens would also benefit from better protection of their fundamental rights, such as privacy and data protection. At the same time, the proposal would add compliance and enforcement costs for businesses, notified bodies and public authorities, including accreditation and market surveillance authorities. For software developers and hardware manufacturers, it will add direct compliance costs for new security requirements, conformity assessment, documentation and reporting obligations, leading to aggregated compliance costs amounting to up to roughly EUR 29 billion for an estimated market value of EUR 1485 billion in turnover . U sers, including business users, consumers and citizens may face higher prices of products with digital elements . However, they should be seen against the background of the significant benefits as described above. 1.4.3. Indicators of performance Specify the indicators for monitoring progress and achievements. In order to test if manufacturers improve the security of their products with digital elements since the design and development phase and throughout the whole life cycle of those products, several indicators could be taken into account. These could be the number of s ignificant incidents in the Union caused by vulnerabilities , the share of hardware and software manufacturers that follow a systematic secure development life cycle, a qualitative analysis of the security of products with digital elements , a quantitative and qualitative assessment of vulnerability databases, the frequency of security patches made available by manufacturers or the average number of days between vulnerability discovery and the provision of security patches. An indicator for a coherent cybersecurity framework could be the a bsence of targeted product-specific national cybersecurity legislation . An indicator for an enhanced transparency regard ing the security properties of products with digital elements could be the s hare of products with digital elements that are shipped with information on security properties . Moreover, the share of products with digital elements that are shipped with user instructions on secure use could be used as an indicator whether organisations and consumers are being enabled to use products with digital elements securely . As regards the monitoring of the impact of the regulation, certain indicators would be considered for this purpose, to be assessed by the Commission, where appropriate with the support of ENISA. Depending on the operational objective to be reached, some of the monitoring indicators based on which the success of the horizontal cybersecurity requirements would be assessed are as follows: For assessing the level of cybersecurity of products with digital elements: - Statistics and qualitative analysis on incidents affecting products with digital elements and the way these were handled. These could be gathered and assessed by the Commission, with support from ENISA. - Records of known vulnerabilities and analyses of how these were handled. Such analysis could be conducted by ENISA, based on the European vulnerability database set up based on [Directive XXX/ XXXX (NIS2)] . - Surveys amongst manufacturers of hardware and software to monitor progress. For assessing the level of information on security features, security support, end-of-life and duty of care : results of surveys to be conducted by the Commission, with support from ENISA for both users and businesses. For assessing the implementation , the Commission would aim to ensure that the conformity assessments are effectively performed. To this end, a standardization request will be issued and its implementation followed. The Commission will also verify the capacity of the notified bodies and, if applicable, of the certification bodies. As regards the application , by means of the reports of Member States, the Commission will verify that national initiatives do not concern aspects covered by the regulation. 1.5. Grounds for the proposal/initiative 1.5.1. Requirement(s) to be met in the short or long term including a detailed timeline for roll-out of the implementation of the initiative The Regulation should be fully applicable 24 months after its entry into force. However, elements of the governance structure should be in place before then. In particular, Member States shall have appointed exis t i ng authorities and/or established new authorities performing the tasks set out in the legislation. 1.5.2. Added value of Union involvement (it may result from different factors, e.g. coordination gains, legal certainty, greater effectiveness or complementarities). For the purposes of this point 'added value of Union involvement' is the value resulting from Union intervention which is additional to the value that would have been otherwise created by Member States alone. The strong cross-border nature of cybersecurity and the growing incidents with spill-over effects across borders, sectors and products, mean that the objectives cannot effectively be achieved by Member States alone. Given the global nature of product with digital elements markets, Member States face the same risks for the same product with digital elements on their territory. An emerging patchy framework of potentially diverging national rules also risks hampering an open and competitive single market for products with digital elements . Joint action at EU level is thus necessary to increase the level of trust among users and the attractiveness of EU products with digital elements . It would also benefit the internal market by providing legal certainty and achieving a level playing field for vendors of products with digital elements . 1.5.3. Lessons learned from similar experiences in the past The Cyber Resilience Act is the first regulation of its kind, introducing cybersecurity requierements for the placement on the market of products with digital elements. It builds however on the setting of the New Legislative Framework and the lessons learnt in the implementation process of existing Union harmonisation legislation of a variety of products, notably as regards the preparation for implementation, including aspects such as preparation of harmonised standards. 1.5.4. Compatibility with the Multiannual Financial Framework and possible synergies with other appropriate instruments The Regulation on horizontal cybersecurity requirements for products with digital elements defines new cybersecurity requirements for all products with digital elements placed on the EU market, going beyond any requirements provided by existing legislation. At the same time, the proposal is building on the existing setting of the NLF legislation. Theref o re, it would build on existing NLF structures and procedures such as the cooperation of notified bodies and market surveillance , conformity assessment modules , development of harmonised standards . The new proposal would also rely on some structures developed according to other cybersecurity legislation such as the Directive 2016/1148 (NIS Directive), respectively the [ Directive XXX/ XXXX (NIS2)] , or Regulation 2019/881 (the Cybersecurity Act). 1.5.5. Assessment of the different available financing options, including scope for redeployment The management of the action areas assigned to ENISA fit s its existing mandate and general tasks . These action areas may require specific profiles or new assignments, but these would not be notable and can be absorbed by the existing resources of ENISA and resolved through reallocation or linking of various assignments . For example, one of the main action areas assigned to ENISA concerns the gathering and processing of notifications from manufacturers on exploited product vulnerabilities. [ Directive XXX/ XXXX (NIS2)] has already tasked ENISA to establish a European vulnerability database where publicly known vulnerabilities can be disclosed and registered, on a voluntary basis, for the purpose of allowing users to take appropriate mitigating measures. Resources allocated for that purpose could also be used for the new above-mentioned assignments relating to notifications of product vulnerabilities. That could ensure an effective use of existing resources and would also create the necessary synergies between such assignments that can better inform ENISA’s analyses of cybersecurity risks and threats. 1.6. Duration and financial impact of the proposal/initiative limited duration in effect from [DD/MM]YYYY to [DD/MM]YYYY Financial impact from YYYY to YYYY for commitment appropriations and from YYYY to YYYY for payment appropriations. × unlimited duration Implementation with a start-up period from 2025 . followed by full-scale operation. 1.7. Management mode(s) planned Direct management by the Commission × by its departments, including by its staff in the Union delegations; by the executive agencies Shared management with the Member States Indirect management by entrusting budget implementation tasks to: third countries or the bodies they have designated; international organisations and their agencies (to be specified); the EIB and the European Investment Fund; bodies referred to in Articles 70 and 71 of the Financial Regulation; public law bodies; bodies governed by private law with a public service mission to the extent that they are provided with adequate financial guarantees; bodies governed by the private law of a Member State that are entrusted with the implementation of a public-private partnership and that are provided with adequate financial guarantees; persons entrusted with the implementation of specific actions in the CFSP pursuant to Title V of the TEU, and identified in the relevant basic act. If more than one management mode is indicated, please provide details in the ‘Comments’ section. Comments This Regulation assigns certain actions to ENISA, in line with its existing mandate, and in particular Art 3(2) of Regulation 2019/881 establishi n g that ENISA should carry out the tasks assigned to it by Union legal acts that set out measures for approximating Member State laws, regulations and administrative provisions which are related to cybersecurity. In particular, ENISA is tasked to r eceive notifications from manufacturers of actively exploited vulnerabilities contained in the products with digital elements, as well as incidents having an impact on the security of these products. ENISA should also forward these notification s to the relevant CSIRTs or, respectively, to the relevant single point of contact designated in accordance with Article [Article X ] of Directive [ Directive XX X /XXXX (NIS2)] of the Member States, as well as inform the market surveillance authorities. Based on the information it gathers, ENISA should prepare a biennial technical report on emerging trends regarding cybersecurity risks in products with digital elements and submit it to the NIS Cooperation Group. Furthermore, considering ENISA’s expertise, information gathered and threat analyses, ENISA may support the implementation process of this Regulation by proposing joint acti vities to be conducted by national market surveillance authorities based on indications or information of potential non-compliance with this Regulation of products with digital elements across several Member States or identify categories of products for which simultaneous coordinated control actions may be organised. ENISA may be requested by the Commission to conduct evaluations for specific products in exceptional circumstances in relation to products with digital elements that present a significant cybersecurity risk and where an immediate intervention is required to preserve the good functioning of the internal market . All these assignments are estimated to about 4.5 FTEs from the existing resources of ENISA, building already on expertise and preparatory work that it is currently done by ENISA, among others in support of the upcoming implementation of [Directive XXX/ XXXX (NIS2) ] for which ENISA’s resources were supplemented. 2. MANAGEMENT MEASURES 2.1. Monitoring and reporting rules Specify frequency and conditions. By 36 months after the date of application of this R egulation and every four years thereafter, the Commission will submit a report on its evaluation and review to the European Parliament and to the Council. The reports shall be made public. 2.2. Management and control system(s) 2.2.1. Justification of the management mode(s), the funding implementation mechanism(s), the payment modalities and the control strategy proposed This Regulation establishes a new policy with regard to harmonised cybersecurity requirements for products with digital elements pl a ced on the internal market throughour their whole life cycle. The legal act will be followed by requests by the Commission to the European standardisation bodies to develop standards. In order to face these new tasks, it is necessary to appropriately resource the Commission’s services. The enforcement of the new Regulation is estimated to require 7 FTEs (of which one END) to cover the following tasks: Preparation of the standardisation request and/or common specifications via implementing acts absent successful standardisation process; Preparing a delegate d act [within 12 months since the entry into force of the Regulation] specifying the definitions of the critical products with digital elements; Potential preparation of delegated acts for updating the list of critical products of class I and II; specifying whether a limitation or exclusion is necessary for products with digital elements covered by other Union rules laying down requirements achieving the same level of protection as this Regulation; mandating the certification of certain highly critical products with digital elements based on criteria set out in this Regulation; specifying the minimum content of the EU declaration of conformity and supplementing the elements to be included in the technical documentation ; Potential preparation of implementing acts relating to the format or elements of the reporting obligations, software bill of materials, common specifications or affixing of CE marking; Potentially preparing an immediate intervention for imposing corrective or restrictive measures in exceptional circumstances to preserve the good functioning of the internal market, including the preparation of an implementing act; Organisation and coordination of the notifications by Member States of notified bodies and coordination of the Notified Bodies; Supporting the coordination of Member States’ market surveillance authorities. 2.2.2. Information concerning the risks identified and the internal control system(s) set up to mitigate them In order to ensure that notified bodies and market surveillance authorities exchange information and cooperate well, the Commission is in charge of their coordination. For the technical and market expertise, an expert group would be created. 2.2.3. Estimation and justification of the cost-effectiveness of the controls (ratio of "control costs ÷ value of the related funds managed"), and assessment of the expected levels of risk of error (at payment & at closure) 2.3. For the meeting expenditures, given the low value per transaction (e.g. refunding travel costs for a delegate for a meeting), standard control procedures seem sufficient. Measures to prevent fraud and irregularities Specify existing or envisaged prevention and protection measures, e.g. from the Anti-Fraud Strategy. The existing fraud prevention measures applicable to the Commission will cover the additional appropriations necessary for this Regulation. 3. ESTIMATED FINANCIAL IMPACT OF THE PROPOSAL/INITIATIVE 3.1. Heading(s) of the multiannual financial framework and expenditure budget line(s) affected Existing budget lines Schema New budget lines requested N/A 3.2. Estimated financial impact of the proposal on appropriations 3.2.1. Summary of estimated impact on operational appropriations The proposal/initiative does not require the use of operational appropriations The proposal/initiative requires the use of operational appropriations, as explained below: EUR million (to three decimal places) Heading of multiannual financial framework Number DG: <…….> Year N Year N+1 Year N+2 Year N+3 Enter as many years as necessary to show the duration of the impact (see point 1.6) TOTAL Operational appropriations Budget line Commitments (1a) Payments (2a) Budget line Commitments (1b) Payments (2b) Appropriations of an administrative nature financed from the envelope of specific programmes Budget line (3) TOTAL appropriations for DG <…….> Commitments =1a+1b +3 Payments =2a+2b +3 TOTAL operational appropriations Commitments (4) Payments (5) TOTAL appropriations of an administrative nature financed from the envelope for specific programmes (6) TOTAL appropriations under HEADING <….> of the multiannual financial framework Commitments =4+ 6 Payments =5+ 6 If more than one operational heading is affected by the proposal / initiative, repeat the section above: TOTAL operational appropriations (all operational headings) Commitments (4) Payments (5) TOTAL appropriations of an administrative nature financed from the envelope for specific programmes (all operational headings) (6) TOTAL appropriations under HEADINGS 1 to 6 of the multiannual financial framework (Reference amount) Commitments =4+ 6 Payments =5+ 6 Heading of multiannual financial framework 7 ‘Administrative expenditure’ This section should be filled in using the 'budget data of an administrative nature' to be firstly introduced in the Annex to the Legislative Financial Statement (Annex V to the internal rules), which is uploaded to DECIDE for interservice consultation purposes. EUR million (to three decimal places) Year 2024 Year 2025 Year 2026 Year 2027 TOTAL DG: CNECT Human resources 1.030 1.030 1.030 1.030 4.1 20 Other administrative expenditure 0.22 2 0.22 2 0.22 2 0.22 2 0.888 TOTAL DG CNECT Appropriations 1. 252 1. 252 1. 252 1. 252 5.008 TOTAL appropriations under HEADING 7 of the multiannual financial framework (Total commitments = Total payments) 1. 2 5 2 1. 252 1. 252 1. 252 5.008 EUR million (to three decimal places) Year 2024 Year 2025 Year 2026 Year 2027 TOTAL TOTAL appropriations under HEADINGS 1 to 7 of the multiannual financial framework Commitments 1. 252 1. 252 1. 252 1. 252 5.008 Payments 1. 252 1. 252 1. 252 1. 252 5.008 3.2.2. Estimated output funded with operational appropriations Commitment appropriations in EUR million (to three decimal places) Indicate objectives and outputs Year N Year N+1 Year N+2 Year N+3 Enter as many years as necessary to show the duration of the impact (see point 1.6) TOTAL OUTPUTS Type Average cost No Cost No Cost No Cost No Cost No Cost No Cost No Cost Total No Total cost SPECIFIC OBJECTIVE No 1 … - Output - Output - Output Subtotal for specific objective No 1 SPECIFIC OBJECTIVE No 2 ... - Output Subtotal for specific objective No 2 TOTALS 3.2.3. Summary of estimated impact on administrative appropriations The proposal/initiative does not require the use of appropriations of an administrative nature The proposal/initiative requires the use of appropriations of an administrative nature, as explained below: EUR million (to three decimal places) Year 2024 Year 2025 Year 2026 Year 2027 HEADING 7 of the multiannual financial framework Human resources 1.030 1.030 1.030 1.030 4.120 Other administrative expenditure 0. 22 2 0. 22 2 0. 22 2 0. 22 2 0.888 Subtotal HEADING 7 of the multiannual financial framework 1. 252 1. 252 1. 252 1. 252 5.008 Outside HEADING 7 of the multiannual financial framework Human resources Other expenditure of an administrative nature Subtotal outside HEADING 7 of the multiannual financial framework TOTAL 1. 252 1. 252 1. 252 1. 252 5.008 The appropriations required for human resources and other expenditure of an administrative nature will be met by appropriations from the DG that are already assigned to management of the action and/or have been redeployed within the DG, together if necessary with any additional allocation which may be granted to the managing DG under the annual allocation procedure and in the light of budgetary constraints. 3.2.3.1. Estimated requirements of human resources The proposal/initiative does not require the use of human resources. The proposal/initiative requires the use of human resources, as explained below: Estimate to be expressed in full time equivalent units Year 2024 Year 2025 Year 2026 Year 2027 20 01 02 01 (Headquarters and Commission’s Representation Offices) 6 6 6 6 20 01 02 03 (Delegations) 01 01 01 01 (Indirect research) 01 01 01 11 (Direct research) Other budget lines (specify) External staff (in Full Time Equivalent unit: FTE) 20 02 01 (AC, END, INT from the ‘global envelope’) 1 1 1 1 20 02 03 (AC, AL, END, INT and JPD in the delegations) XX 01 xx yy zz - at Headquarters - in Delegations 01 01 01 02 (AC, END, INT - Indirect research) 01 01 01 12 (AC, END, INT - Direct research) Other budget lines (specify) TOTAL 7 7 7 7 XX is the policy area or budget title concerned. The human resources required will be met by staff from the DG who are already assigned to management of the action and/or have been redeployed within the DG, together if necessary with any additional allocation which may be granted to the managing DG under the annual allocation procedure and in the light of budgetary constraints. Description of tasks to be carried out: Officials and temporary staff 6 FTEs x 157.000 €/ year = € 942 .000 As described under 2.2.1: Preparation of the standardisation request and/or common specifications via implementing acts absent successful standardisation process; Preparing a delegate d act [within 12 months since the entry into force of the Regulation] specifying the definitions of the critical products with digital elements; Potential preparation of delegated acts for updating the list of critical products of class I and II; specifying whether a limitation or exclusion is necessary for products with digital elements covered by other Union rules laying down requirements achieving the same level of protection as this Regulation; mandating the certification of certain highly critical products with digital elements based on criteria set out in this Regulation; specifying the minimum content of the EU declaration of conformity and supplementing the elements to be included in the technical documentation ; Potential preparation of implementing acts relating to the format or elements of the reporting obligations, software bill of materials, common specifications or affixing of CE marking; P otentially p reparing an immediate intervention for imposing corrective or restrictive measures in exceptional circumstances to preserve the good functioning of the internal market, including the preparation of an implementing act ; Organisation and coordination of the notifications by Member States of notified bodies and coordination of the Notified Bodies ; Supp o rting the coordination o f Member States’ market surveillance authorities. External staff 1 END x 88.000 €/ year As described under 2.2.1: Preparation of the standardisation request and/or common specifications via implementing acts absent successful standardisation process; Preparing a delegate d act [within 12 months since the entry into force of the Regulation] specifying the definitions of the critical products with digital elements; Potential preparation of delegated acts for updating the list of critical products of class I and II; specifying whether a limitation or exclusion is necessary for products with digital elements covered by other Union rules laying down requirements achieving the same level of protection as this Regulation; mandating the certification of certain highly critical products with digital elements based on criteria set out in this Regulation; specifying the minimum content of the EU declaration of conformity and supplementing the elements to be included in the technical documentation ; Potential preparation of implementing acts relating to the format or elements of the reporting obligations, software bill of materials, common specifications or affixing of CE marking; P otentially p reparing an immediate intervention for imposing corrective or restrictive measures in exceptional circumstances to preserve the good functioning of the internal market, including the preparation of an implementing act ; Organisation and coordination of the notifications by Member States of notified bodies and coordination of the Notified Bodies ; Supp o rting the coordination of Member States’ market surveillance authorities . 3.2.4. Compatibility with the current multiannual financial framework The proposal/initiative: x can be fully financed through redeployment within the relevant heading of the Multiannual Financial Framework (MFF). No reprogramming is required. requires use of the unallocated margin under the relevant heading of the MFF and/or use of the special instruments as defined in the MFF Regulation. - requires a revision of the MFF. - 3.2.5. Third-party contributions The proposal/initiative: x does not provide for co-financing by third parties provides for the co-financing by third parties estimated below: Appropriations in EUR million (to three decimal places) Year N Year N+1 Year N+2 Year N+3 Enter as many years as necessary to show the duration of the impact (see point 1.6) Total Specify the co-financing body TOTAL appropriations co-financed 3.3. Estimated impact on revenue The proposal/initiative has no financial impact on revenue. The proposal/initiative has the following financial impact: on own resources on other revenue please indicate, if the revenue is assigned to expenditure lines EUR million (to three decimal places) Budget revenue line: Appropriations available for the current financial year Impact of the proposal/initiative Year N Year N+1 Year N+2 Year N+3 Enter as many years as necessary to show the duration of the impact (see point 1.6) Article …………. For assigned revenue, specify the budget expenditure line(s) affected. Other remarks (e.g. method/formula used for calculating the impact on revenue or any other information). ANNEX I ESSENTIAL CYBERSECURITY REQUIREMENTS Security r equirements relating to the properties of products with digital element s Products with digital elements shall be designed, developed and produced in such a way that they ensure an appropriate level of cybersecurity based on the risks; P roduct s with digital element s shall be delivered without any known exploitable vulnerabilities ; On the basis of the risk assessment referred to in Article 10 (2) and w here applicable , products with digital elements shall: be delivered with a secure by default configuration , including the possibility to reset the product to its original state ; ensure protection from unauthorised access by appropriate control mechanisms , including but not limited to authentication , identity or access management systems ; protect the confidentiality of stored, transmitted or otherwise processed data , personal or other, such as by encrypting relevant data at rest or in transit by state of the art mechanisms ; protect the integrity of stored, transmitted or otherwise processed data, personal or other, commands , programs and configuration against any manipulation or modification not authorised by the user , as well as report on corruptions; process only data , personal or other, that are adequate, relevant and limited to what is necessary in relation to the intended use of the product (‘minimisation of data’) ; protect the availability of essential functions, including the resilience against and mitigation of deni al of service attacks ; minimise their own negative impact on the availability of services provided by other devices or networks ; be designed, developed and produced to limit attack surfaces , including external interface s ; be designed, developed and produced to reduce the impact of a n incident using appropriate exploitation mitigation mechanisms and techniques ; provide security related information by record ing and /or monitor ing relevant internal activity , including the access to or modification of data, services or functions ; ensure that vulnerabilities can be addressed through security updates , including, where applicable, through automatic updates and the notification of available updates to users . Vulnerability handling requirements M anufacturers of the product s with digital element s shall: identify and document vulnerabilities and components contained in the product , including by drawing up a software bill of materials in a commonly used and machine-readable format covering at the very least the top-level dependencies of the product ; in relation to the risks posed to the product s with digital elements , address and remediate vulnerabilities without delay, including by provi ding security updates ; apply effective and regular tests and reviews of the security of the product with digital elements ; once a security update has been made available, publically disclose information about fixed vulnerabilities, including a description of the vulnerabilities, information allowing users to identify the product with digital element s affected, the impacts of the vulnerabilities, their severity and information helping users to remediate the vulnerabilities ; put in place and enforce a policy on coordinated vulnerability disclosure; take measures to facilitate the sharing of information about potential vulnerabilities in their product with digital element s as well as in third party components contained in th at product , including by providing a contact address for the reporting of the vulnerabilities discovered in the product with digital elements ; provide for mechanisms to securely distribute updates for product s with digital element s to ensure that exploitable vulnerabilities are fixed or mitigated in a timely manner; ensure that , where security patches or updates are available to address identified security issues , they are disseminated without delay and free of charge , accompanied by advisory messages providing users with the relevant information, including on potential action to be taken . ANNEX II INFORMATION AND INSTRUCTIONS TO THE USER As a minimum, the product with digital elements shall be accompanied by: the name, registered trade name or registered trade mark of the manufacturer , and the postal address and the email address at which the manufacturer can be contacted, on the product or, where that is not possible, on its packaging or in a document accompanying the product ; the point of contact where information about cybersecurity vulnerabilities of the product can be reported and received; the correct identification of the type, batch, version or serial number or other element allowing the identification of the product and the corresponding i nstruction s and user information; the intended use, including the security environment provided by the manufacturer , as well as the product ’ s essential functionalities and information about the security properties ; any known or foreseeable circumstance, related to the use of the product with digital elements in accordance with its intended purpose or under conditions of reasonably foreseeable misuse, which may lead to significant cybersecurity risks ; if and, where applicable, where the software bill of materials can be accessed; where applicable, the internet address at which the EU declaration of conformity can be accessed; the type of technical security support offered by the manufacturer and until when it will be provided, at the very least until when users can expect to receive security updates; detailed instructions or an internet address referring to such detailed instructions and information on : the necessary measures during initial commissioning and throughout the life time of the product to ensure its secure use ; how changes to the product can affect the security of data ; how security-relevant updates can be installed ; the secure decommissioning of the product , including information on how user data can be securely removed . ANNEX III CRITICAL PRODUCT S WITH DIGITAL ELEMENTS Class I Identity management systems software and privileged access management software ; Standalone and embedded browsers ; Password managers ; Software that searches for, removes, or quarantines malicious software ; Product s with digital element s with the function of virtual private network (VPN); Network management systems ; Network configuration management tools ; Network traffic monitoring systems ; Management of network resources ; Security information and event management (SIEM) systems ; Update/patch management , including boot managers ; Application configuration management systems ; Remote access/sharing software ; Mobile device management software ; Physical n etwork interfaces ; Operating systems not covered by class II ; Firewalls, intrusion detection and / or prevention systems not covered by class II ; Routers, modems intended for the connection to the internet , and switches , not covered by class II; Micropro cessors not covered by class II; Microcontrollers ; Application s pecific i ntegrated c ircuit s (ASIC) and f ield-programmable gate array s (FPGA) intended for the use by essential entities of the type referred to in [ Annex I to the Directive XXX/XXXX ( NIS2 ) ] ; Industrial Auto mation & Control Systems (IACS) not covered by class II , such as p rogrammable logic controllers (PLC), d istributed control systems (DCS) , c omputerised numeric controllers for machine tools (CNC) and s upervisory control and data acquisition systems (SCADA) ; Industrial I nternet of Things not covered by class II. Class II Operating systems for servers, desktops, and mobile devices ; Hypervisors and container runtime systems that support virtuali s ed execution of operating systems and similar environments ; Public key infrastructure and digital certificate issuers; Firewalls, intrusion detection and / or prevention systems intended for industrial use ; General purp ose microprocessors ; M icroprocessors intended for integration in programmable logic controllers and secure elements ; Routers, modems intended for the connection to the internet , and switches , intended for industrial use ; S ecure elements ; Hardware S ecurity Modules (HSMs) ; Secure cryptoprocessors ; Smartcards, smartcard readers and tokens ; Industrial Auto mation & Control Systems (IACS) intended for the use by essential entities of the type referred to in [Annex I to the Directive XXX/XXXX ( NIS2 ) ] , such as p rogrammable logic controllers (PLC), d istributed control systems (DCS) , c omputerised numeric controllers for machine tools (CNC) and s upervisory control and data acquisition systems (SCADA) ; Industrial I nternet of T hings devices intended for the use by essential entities of the type referred to in [Annex I to the Directive XXX/XXXX ( NIS2 ) ] ; Robot sensing and actuator components and robot controllers; Smart meters . ANNEX IV EU DECLARATION OF CONFORMITY The EU declaration of conformity referred to in Article 20 , shall contain all of the following information: N ame and type and any additional information enabling the unique identification of the product with digital elements ; Name and address of the manufacturer or his authorised representative ; A statement that the EU declaration of conformity is issued under the sole responsibility of the provider ; Object of the declaration (identification of the product allowing traceability. It may include a photograph, where appropriate) ; A statement that the object of the declaration described above is in conformity with the relevant Union harmonisation legislation ; References to any relevant harmonised standards used or any other common specification o r cybersecurity certification in relation to which conformity is declared ; Where applicable, the name and number of the notified body, a description of the conformity assessment procedure performed and identification of the certificate issued ; Additional information: Signed for and on behalf of: ………………………………… (place and date of issue): (name, function) (signature): ANNEX V CONTENTS OF THE TECHNICAL DOCUMENTATION The technical documentation referred to in Article 2 3 shall contain at least the following information, as applicable to the relevant product with digital elements : a general description of the product with digital elements , including: its intended purpose; versions of software affecting compliance with essential requirements; where the product with digital elements is a hardware product, photographs or illustrations showing external features, marking and internal layout; user information and instructions as set out in Annex II; a d escription of the design , development and production of the product and vulnerability handling processes , including: c omplete information on the design and development of the produ ct with digital elements, including, where applicable, drawings and schemes and/or a description of the system architecture explaining how software components build on or feed into each other and integrate into the overall processing ; c omplete information and specifications of the vulnerability handling processes put in place by the manufacturer , including the software bill of materials, the coordinated vulnerability disclosure policy, evidence of the provision of a contact address for the reporting of the vulnerabilities and a description of the technical solution s chosen for the secure distribution of updates ; c omplete informat ion and specifications of the production and monitoring p rocesses of the product with digital elements and the validation of these processes . a n assessment of the cybersecurity risks against which the product with digital elements is designed , developed, produced , deliver ed and maint ained as laid down in Article 10 of this Regulation ; a list of the harmonised standards applied in full or in part the references of which have been published in the Official Journal of the European Union , common specifications as set out in Article 1 9 of this Regulation or cybersecurity certification schemes under Regulation (EU) 2019/881 pursuant to Article 1 8 (3) , and, where those harmonised standards , common specifications or cybersecurity certification schemes have not been applied, descriptions of the solutions adopted to meet the essential requirements set out in Sections 1 and 2 of Annex I , including a list of other relevant technical specifications applied. In the event of partly applied harmonised standards , common specifications or cybersecurity certification s , the technical documentation shall specify the parts which have been applied; reports of the tests carried out to verify the conformity of the product and of the vulnerability handling processes with the applicable essential requirements as set out in Section s 1 and 2 of Annex I ; a copy of the EU declaration of conformity; where applicable, t he software bill of ma terials as define d in Artic le 3 , point (3 6 ) , further to a reasoned request from a market surveillance authority provided that it is necessary in order for this authorit y to be able to check compliance with the essential requirements set out in Annex I . A NNEX VI CONFORMITY ASSESSMENT PROCEDURES Conformity Assessment procedure based on i nternal control ( based on Module A) Internal control is the conformity assessment procedure whereby the manufacturer fulfils the obligations laid down in points 2, 3 and 4, and ensures and declares on its sole responsibility that the products with digital elements satisfy all the essential requirements set out in S ection 1 of Annex I and the manufacturer meets the essential requirements set out in S ection 2 of Annex I . The manufacturer shall draw up the technical documentation described in Annex V. Design, development, p roduction and vulnerability handling of products with digital elements The manufacturer shall take all measures necessary so that the design , development, production and vulnerability handling process es and their monitoring ensure compliance of the manufactured or developed products with digital elements and of the processes put in place by the manufacturer with the essential requirements set out in sections 1 and 2 of Annex I . Conformity marking and declaration of conformity The manufacturer shall affix the CE to each individual product with digital elements that satisfies the applicable requirements of this Regulation. The manufacturer shall draw up a written EU declaration of conformity for each product with digital elements in accordance with Article 20 and keep it together with the technical documentation at the disposal of the national authorities for 10 years after the product with digital elements has been placed on the market. The EU declaration of conformity shall identify the product with digital elements for which it has been drawn up. A copy of the EU declaration of conformity shall be made available to the relevant authorities upon request. Authorised representatives The manufacturer’s obligations set out in point 4 may be fulfilled by his authorised representative, on his behalf and under his responsibility, provided that they are specified in the mandate . E U -type examination ( based on Module B) E U -type examination is the part of a conformity assessment procedure in which a notified body examines the technical design and development of a product and the vulnerability handling processes put in place by the manufacturer , and attests that a product with digital elements meet s the essential requirements set out in S ection 1 of Annex I and that the manufacturer meets the essential requirements set out in S ection 2 of Annex I . EU-type examination shall be carried out by assessment of the adequacy of the technical design and development of the product through examination of the technical documentation and supporting evidence referred to in point 3, plus examination of specimens of one or more critical parts of the product (combination of production type and design type) . The manufacturer shall lodge an application for E U -type examination with a single notified body of his choice. The application shall include: the name and address of the manufacturer and, if the application is lodged by the authorised representative, his name and address as well ; a written declaration that the same application has not been lodged with any other notified body ; the technical documentation , which shall make it possible to assess the product's conformity with the applicable essential requirements as set out in Section 1 of Annex I and the manufacturer's vulnerability handling processes set out in Section 2 of Annex I, and shall include an adequate analysis and assessment of the risk(s). The technical documentation shall specify the applicable requirements and cover, as far as relevant for the assessment, the design, manufacture and opera tion of the product. The technical documentation shall contain, wherever applicable, at least the elements set out in Annex V ; the supporting evidence for the adequacy of the technical design and development solution s and vulnerability handling processes . This supporting evidence shall mention any documents that have been used, in particular where the rele vant harmonised standards and/or technical specifications have not been applied in full. The supporting evidence shall include, where necessary, the results of tests carried out by the appropriate laboratory of the man ufacturer, or by another testing laboratory on his behalf and under his responsibility. The notified body shall : examine the technical documentation and supporting evidence to assess the adequacy of the technical design and development of the product with the essential requirements set out in S ection 1 of Annex I and of the vulnerability handling processes put in place by the manufacturer with the essential requirements set out in S ection 2 of Annex I ; verify that the specimen(s) have been developed or manufactured in conformity with the technical documentation, and identify the elements which have been designed and developed in accordance with the applicable provisions of the relevant harmonised standards and/or technical specifications, as well as the elements which have been designed and developed without applying the relevant provisions of those standards; carry out appropriate examinations and tests, or have them carried out, to check whether, where the manufacturer has chosen to apply the solutions in the relevant harmonised standards and/or technical specifications for the requirements set out in Annex I , these have been applied correctly; carry out appropriate examinations and tests, or have them carried out, to check whether, where the solutions in the relevant harmonised standards and/or technical specifications for the requir ements set out in Annex I have not been applied, the solutions adopted by the manufacturer meet the corre sponding essential requirements ; agree with the manufacturer on a location where the examinations and tests will be carried out. The notified body shall draw up an evaluation report that records the activities undertaken in accordance with point 4 and their outcomes. Without prejudice to its obligations vis- à - vis the notifying authorities, the notified body shall release the content of that report, in full or in part, only with the agreement of the manufacturer. W here the type and the vulnerability handling processes meet the essential requirements set out in Annex I , the notified body shall issue an EU-type examination certificate to the manufacturer. The certificate shall contain the name and address of the manufacturer, the conclusions of the examination, the conditions (if any) for its validity and the necessary data for identification of the approved type and vulnerability handling processes . The certificate may have one or more annexes attached. The certificate and its annexes shall contain all relevant information to allow the conformity of manufactured or developed products with the examined type and vulnerability handling processes to be evaluated and to allow for in-service control. Where the type and the vulnerability handling processes do not satisfy the applicable essential requirements set out in Annex I , the notified body shall refuse to issue an EU-type examination certificate and shall inform the applicant accordingly, giving detailed reasons for its refusal. The notified body shall keep itself apprised of any changes in the generally acknowledged state of the art which indicate that the approved type and the vulnerability handling processes may no longer comply with the applicable essential requirements set out in Annex I to this Regulation , and shall determine whether such changes require further investigation. If so, the notified body shall inform the manufacturer accordingly. T he manufacturer shall inform the notified body that holds the technical documentation relating to the E U -type examination certificate of all modifications to the approved type and the vulnerability handling processes that may affect the conformity with the essential requirements set out in Annex I , or the conditions for validity of the certificate. Such m odifications shall require additional approval in the form of an addition to the original E U -type examination certificate. E ach notified body shall inform its notifying authorities concerning the EU-type examination certificates and/or any additions thereto which it has issued or withdrawn, and shall, periodically or upon request, make available to its notifying authorities the list of certificates and/or any additions thereto refused, suspended or otherwise restricted. Each notified body shall inform the other notified bodies concerning the EU-type examination certificates and/or any additions thereto which it has refused, withdrawn, suspended or otherwise restricted, and, upon request, concerning the certificates and/or additions thereto which it has issued. The Commission, the Member States and the other notified bodies may, on request, obtain a copy of the EU-type examination certificates and/or additions thereto. On request, the Commission and the Member States may obtain a copy of the technical documentation and the results of the examinations carried out by the notified body. The notified body shall keep a copy of the EU-type examination certificate, its annexes and additions, as well as the technical file including the documentation submitted by the manufacturer, until the expiry of the validity of the certificate. The manufacturer shall keep a copy of the EU-type examination certificate, its annexes and additions together with the technical documentation at the disposal of the national authorities for 10 years after the product has been placed on the market. The manufacturer's authorised representative may lodge the application referred to in point 3 and fulfil the obligations set out in points 7 and 9, provided that they are specified in the mandate. Conformity to type based on internal production control ( based on Module C ) Conformity to type based on internal production control is the part of a conformity assessment procedure whereby the manufacturer fulfils the obligations laid down in points 2 and 3, and ensures and declares that the products concerned are in conformity with the type described in the E U -type examination certificate and satisfy the essential requirements set out in Section 1 of Annex I . Production The manufacturer shall take all measures necessary so that the production and its monitoring ensure conformity of the manufactured products with the approved type described in the E U -type examination certificate and with the essential requirements as set out in Section 1 of Annex I . Conformity marking and declaration of conformity The manufacturer shall affix the CE marking to each individual product that is in conformity with the type described in the EU -type examination certificate and satisfies the applicable requirements of the legislative instrument . The manufacturer shall draw up a written declaration of conformity for a product model and keep it at the disposal of the national authorities for 10 years after the product has been placed on the market. The declaration of conformity shall identify the product model for which it has been drawn up. A copy of the declaration of conformity shall be made available to the relevant authorities upon request. Authorised representative The manufacturer's obligations set out in point 3 may be fulfilled by his authorised representative, on his behalf and under his responsibility, provided that they are specified in the mandate. Conformity based on full quality assurance ( based on Module H) Conformity based on full quality assurance is the conformity assessment procedure whereby the manufacturer fulfils the obligations laid down in points 2 and 5, and ensures and declares on his sole responsibility that the products (or product categories) concerned satisfy the essential requirements set out in Section 1 of Annex I , and that the vulnerability handling processes put in place by the manufacturer meet the requirements set out in Section 2 of Annex I. Design, development , production and vulnerability handling of product s with digital elements The manufacturer shall operate an approved quality system as specified in point 3 for the design , development , and production of the products concerned and for handling vulnera bilities , maintain its effectiveness throughout the lifecycle of the products concerned, and shall be subject to surveillance as specified in point 4. Quality system The manufacturer shall lodge an application for assessment of his quality system with the notified body of his choice, for the products concerned. The application shall include: the name and address of the manufacturer and, if the application is lodged by the authorised representative, his name and address as well ; the technical documentation for one model of each category of products intended to be manufactured or developed . The technical documentation shall, wherever applicable, contain at least the elements as set out in Annex V ; the documentation concerning the quality system ; an d a written declaration that the same application has not been lodged with any other notified body. The quality system shall ensure compliance of the products with the essential requirements set out in Section 1 of Annex I and compliance of the vulnerability handling processes put in place by the manufacturer with the requirements set out in Section 2 of Annex I . All the elements, requirements and provisions adopted by the manufacturer shall be documented in a systematic and orderly manner in the form of written policies, procedures and instructions. That quality system documentation shall permit a consistent interpretation of the quality programmes, plans, manuals and records. It shall, in particular, contain an adequate description of: the quality objectives and the organisational structure, responsibilities and powers of the management with regard to design , development, product quality and vulnerability handling ; the technical design and development specifications, including standards, that will be applied and, where the relevant harmonised standards and/or technical specifications will not be applied in full, the means that will be used to ensure that the essential requirements set out in Section 1 of Annex I that apply to the products will be met ; the procedural specifications, including standards, that will be applied and, where the relevant harmonised standards and/or technical specifications will not be applied in full, the means that will be used to ensure that the essential requirements set out in Section 2 of Annex I that apply to the manufacturer will be met ; the design and development control , as well as design and development verification techniques, processes and systematic actions that will be used when designing and developing the products pertaining to the product category covered ; the corresponding production , quality control and quality assurance techniques, processes and systematic actions that will be used ; the examinations and tests that will be carried out before, during and after production , and the frequency with which they will be carried out ; the quality records, such as inspection reports and test data, calibration data, qualification reports on the personnel concerned, etc ; the means of monitoring the achievement of the required design and product quality and the effective operation of the quality system. The notified body shall assess the quality system to determine whether it satisfies the requirements referred to in point 3.2. It shall presume conformity with those requirements in respect of the elements of the quality system that comply with the corresponding specifications of the national standard that implements the relevant harmonised standard and/or technical specification. In addition to experience in quality management systems, the auditing team shall have at least one member experienced as an assessor in the relevant product field and product technology concerned, and knowledge of the applicable requirements of this Regulation . The audit shall include an assessment visit to the manufacturer's premises , where such premises exist . The auditing team shall review the technical documentation referred to in point 3.1, second indent, to verify the manufacturer's ability to identify the applicable requirements of this Regulation and to carry out the necessary examinations with a view to ensuring compliance of the product with those requirements. The manufacturer or his authorised representative shall be notified of the decision. The notification shall contain the conclusions of the audit and the reasoned assessment decision. The manufacturer shall undertake to fulfil the obligations arising out of the quality system as approved and to maintain it so that it remains adequate and efficient. The manufacturer shall keep the notified body that has approved the quality system informed of any intended change to the quality system. The notified body shall evaluate any proposed changes and decide whether the modified quality system will continue to satisfy the requirements referred to in point 3.2 or whether a reassessment is necessary. It shall notify the manufacturer of its decision. The notification shall contain the conclusions of the examination and the reasoned assessment decision. Surveillance under the responsibility of the notified body The purpose of surveillance is to make sure that the manufacturer duly fulfils the obligations arising out of the approved quality system . The manufacturer shall, for assessment purposes, allow the notified body access to the design, development, production , inspection, testing and storage sites, and shall provide it with all necessary information, in particular: t he quality system documentation ; the quality records as provided for by the design part of the quality system, such as results of analyses, calculations, tests, etc. ; the quality records as provided for by the manufacturing part of the quality system, such as inspection reports and test data, calibration data, qualification reports on the personnel concerned, etc. The notified body shall carry out periodic audits to make sure that the manufacturer maintains and applies the quality system and shall provide the manufacturer with an audit report. Conformity marking and declaration of conformity The manufacturer shall affix the CE marking , and, under the responsibility of the notified body referred to in point 3.1, the latter's identification number to each individual product that satisfies the requirements set out in Section 1 of Annex I to th is Regulation . The manufacturer shall draw up a written declaration of conformity for each product model and keep it at the disposal of the national authorities for 10 years after the product has been placed on the market. The declaration of conformity shall identify the product model for which it has been drawn up. A copy of the declaration of conformity shall be made available to the relevant authorities upon request. The manufacturer shall, for a period ending at least 10 years after the product has been placed on the market, keep at the disposal of the national authorities: the technical documentation referred to in point 3.1 ; the documentation concerning the quality system referred to in point 3.1 ; the change referred to in point 3.5, as approved ; the decisions and reports of the notified body referred to in points 3.5, 4.3 and 4.4. Each notified body shall inform its notifying authorities of quality system approvals issued or withdrawn, and shall, periodically or upon request, make available to its notifying authorities the list of quality system approvals refused, suspended or otherwise restricted. Each notified body shall inform the other notified bodies of quality system approvals which it has refused, suspended or withdrawn, and, upon request, of quality system approvals which it has issued. Authorised representative The manufacturer's obligations set out in points 3.1, 3.5, 5 and 6 may be fulfilled by his authorised representative, on his behalf and under his responsibility, provided that they are specified in the mandate. EUROPEAN COMMISSION 8.7.2022 SEC(2022) 321 REGULATORY SCRUTINY BOARD OPINION Proposal of a Regulation for the European Parliament and of the Council on horizontal cybersecurity requirements for products with digital elements and amending Regulation (EU) 2019/1020 {COM(2022) 454} {SWD(2022) 282, 283}  EUROPEAN COMMISSION Regulatory Scrutiny Board Brussels, RSB/ Opinion Title: Impact assessment / European cyber resilience act Overall opinion: POSITIVE WITH RESERVATIONS (A) Policy context The EU cybersecurity framework comprises several pieces of horizontal legislation covering products, services, crisis management, and crimes. The European Cyber Resilience Act aims to introduce cybersecurity requirements for connected products and associated services and to complement the existing cybersecurity framework of the Directive on the security of Network and Information Systems and the Cybersecurity Act. It also complements the Delegated Regulation of 29 October 2021 under the Radio Equipment Directive, by setting up streamlined cybersecurity requirements covering a wide range of digital products and their ancillary services. (B) Summary of findings The Board notes the additional information provided in advance of the meeting and commitments by the DG to make changes to the report. However, the report still contains significant shortcomings. The Board gives a positive opinion with reservations because it expects the DG to rectify the following aspects: (1) The report does not sufficiently place the initiative in the wider context of existing and proposed cybersecurity measures. It does not identify the specific regulatory gaps not already covered by the existing legislation and initiatives and the reasons why the existing measures have not fully succeeded in anticipating and addressing the problems and their drivers. (2) The policy options do not sufficiently address all identified problem drivers and are not adequately explained in terms of content and functioning. The cost and benefit analysis is incomplete. The report does not sufficiently explain the underlying methodology and the robustness of the resulting figures attached to different options and sub-options. (3) The report does not adequately compare options (including sub-options) in terms of effectiveness, efficiency and coherence. It does not sufficiently explain the choice, proportionality and future proof-ness of the preferred option. ________________________________ This opinion concerns a draft impact assessment which may differ from the final version. Commission européenne, B-1049 Bruxelles - Belgium. Office: BERL 02/352. E-mail: [email protected] (4) The report does not systematically and transparently distinguish between the different types and views of stakeholders. (C) What to improve (1) The report should clearly set the scope of the initiative in the wider context of the broad range of other recent EU cybersecurity initiatives and identify exactly what specific aspect of the broader problem it aims to address. It should briefly set out, up front, all recent legislation and proposals in the area of cybersecurity and those with a cybersecurity aspect and explain the articulation between them and the initiative in terms of prevention and mitigation. It should explain in more detail the reasons why the existing body of legislation and proposals and the ongoing voluntary cyber security standards initiative have failed to address the specific issues identified in the report or to anticipate the need for further intervention. The report should better reflect the active role played by consumer awareness and behaviour in contributing to cybersecurity risks and the way in which design and default mechanisms which direct consumer behaviour may help to mitigate them. (2) The baseline scenario should be dynamic and include all existing EU and international regulations and proposals. It should analyse what is likely to happen both in terms of the threat surface and scale given the multitude of existing tools, and acknowledge likely positive developments, either triggered by maturing legislation (or legislation currently under revision), uptake of voluntary standards or market forces. The report should provide concrete evidence of the risk of market fragmentation through national uncoordinated initiatives. The report should analyse clearly and in detail how the product liability regime affects manufacturers’ ex-ante incentives to reduce consumers’ exposure to cyber security risks and, in light of this assess the remaining gap to be tackled. (3) The report should provide comprehensive options to address all identified problem drivers (including consumer behaviour) or explain why certain drivers will be not tackled while being clear how this is likely to affect the performance of the options. It should clearly explain the content and rationale and comparison of options, including sub-options. It should make sub-options more visible throughout the impact analysis right up to the comparison of options demonstrating how they impact on effectiveness or efficiency to allow for an informed choice. (4) The impact analysis should be further developed. It should be clear about the sources for underlying figures, explain methodologies and how robust and reliable the estimates are, in particular if based on a single data source (e.g. data provided by a trade association). It should explain how the aggregate cost estimates were calculated, including for the One In, One Out approach, and ensure consistency of the figures throughout. The report should further develop the analysis of the impacts on competitiveness and innovation and the analysis of the distributional impacts for each type of stakeholders, in particular, on SMEs. Moreover, the report should further elaborate on the role and effectiveness of standardisation processes in effectively ensuring that the advocated solution is delivered in due time and sufficiently future-proof given that the digital sector is very dynamic and new technologies quickly outpace existing ones. (5) The report should better compare options (including sub-options) in terms of effectiveness, efficiency and coherence while bringing out more clearly the related costs and benefits. In particular, the efficiency analysis should bring out more clearly the expected costs and benefits and should include the estimates of costs and benefits, the net 2 impact and the Benefit Cost Ratios per policy option and sub-option in the comparison table(s). On that basis, the report should further explain the choice and proportionality of the preferred option. (6) The report should systematically and transparently reflect the views of all different stakeholders not just those whose views support the preferred option. The Board notes the estimated costs and benefits of the preferred option(s) in this initiative, as summarised in the attached quantification tables. Some more technical comments have been sent directly to the author DG. (D) Conclusion The DG may proceed with the initiative. The DG must revise the report in accordance with the Board’s findings before launching the interservice consultation. [If there are any changes in the choice or design of the preferred option in the final version of the report, the DG may need to further adjust the attached quantification tables to reflect this.] Full title Proposal for a Regulation of the European Parliament and of the Council on horizontal cybersecurity requirements for connected products and associated services (Cyber Resilience Act) Reference number PLAN/2022/56 Submitted to RSB on 13/05/2022 Date of RSB meeting 06/07/2022 3  ANNEX: Quantification tables extracted from the draft impact assessment report The following tables contain information on the costs and benefits of the initiative on which the Board has given its opinion, as presented above. If the draft report has been revised in line with the Board’s recommendations, the content of these tables may be different from those in the final version of the impact assessment report, as published by the Commission. I. Overview of Benefits (total for all provisions) – Preferred Option Description Amount Comments Direct benefits Prevent internal market n/a Affected stakeholders: fragmentation  Hardware manufacturers and software developers Enhanced security and n/a Affected stakeholders: transparency of digital  Users (B2B and B2C; public products authorities) Reduced number of EUR 293.8 billion annually Affected stakeholders: cyber incidents  Users (B2B and B2C; public authorities)  Hardware manufacturers and software developers (as regards reputational damage) Improvement n/a Affected stakeholders: fundamental rights and  Data subjects (citizens and in particular protection consumers) of personal data and privacy against breaches Increased turn-over due Affected stakeholders: to conformity  Notified bodies assessment Indirect benefits Decrease in risk n/a Affected stakeholders: mitigation costs (such  Users (B2B and B2C; public as cyber insurance etc.) authorities) 4 Increased uptake of n/a Affected stakeholders: digital solutions  Users (B2B and B2C)  Hardware manufacturers and software developers  Importers, distributors  Notified bodies Decrease in compliance n/a Affected stakeholders: costs, such as for  Business users; public operators of essential authorities services under the NIS Directive and entities subject to the GDPR Increased global n/a Affected stakeholders: competitiveness by  Hardware manufacturers and integrating security software developers early in the development process Positive social impact, n/a Affected stakeholders: in particular reduced  Businesses number of cybercrime  Consumers  Public authorities  Citizens Fewer incidents with a n/a Affected stakeholders: negative environmental  Society as a whole impact Administrative cost savings related to the ‘one in, one out’ approach* Decrease in compliance n/a Affected stakeholders: costs, such as for  Business users operators of essential services under the NIS Directive and entities subject to the GDPR Prevent internal market n/a Affected stakeholders: fragmentation due to  Manufacturers of hardware impending divergent and software national rules 5 II. Overview of costs – Preferred option Citizens/Consumers Businesses Administrations One-off Recurrent One-off Recurrent One-off Recurrent *Familiarisat *Secure * ion with new product Familiaris requirements development ation with : N.A. : 30.5% (no new * Secure BaU) - requireme product aggregated: nts: N.A. Direct development EUR 13.13 * adjustment (one-off and billion Appointin costs recurrent) (together g new (triggered by with life- market N.A. N.A. *Information cycle N.A. security on security approach) surveillan requirements, of digital ce information products: *Information authorities obligations) N.A. on security (if of digital applicable products: ): EUR 1 N.A. 600 000 Partly off-set per year by higher prices *Conformity *Creating assessment: and updating EUR 10.6 DoC, billion affixing CE marking and reporting: Direct EUR 7.8 administrativ N.A. N.A. billion. N.A. N.A. e costs * Accreditatio n framework: N.A. (notified bodies) Direct regulatory fees N.A. N.A. N.A. N.A. N.A. N.A. and charges 6  *Monitori ng and Direct enforceme enforcement N.A. N.A. N.A. N.A. N.A. nt new costs requireme nts: EUR 7.7 billion Indirect costs * Higher N.A. * Higher N.A. N.A. N.A. prices of prices of digital digital products products Costs related to the ‘one in, one out’ approach N.A. N.A. *Familiarisat Secure ion with new product requirements development : N.A. : EUR 13.13 *Secure billion product *Information Direct development on security adjustment (one-off and of digital costs recurrent) products: *Information N.A. on security of digital Total products: N.A. Indirect N.A. N.A. N.A. N.A. adjustment costs Administrative N.A. N.A. Testing: Documentati costs (for EUR 10.6 on and offsetting) billion reporting: EUR 7.8 billion. 7 Electronically signed on 08/07/2022 10:57 (UTC+02) in accordance with Article 11 of Commission Decision (EU) 2021/2121  Table of contents TOC \o "1-1" \u 1. Introduction: EU Political and legal context PAGEREF _Toc113494865 \h 2 2. Problem definition PAGEREF _Toc113494866 \h 4 3. Why should the EU act? PAGEREF _Toc113494867 \h 18 4. Objectives: What is to be achieved? PAGEREF _Toc113494868 \h 20 5. What are the available policy options? PAGEREF _Toc113494869 \h 21 6. What are the impacts of the policy options? PAGEREF _Toc113494870 \h 39 7. How do the options compare? PAGEREF _Toc113494871 \h 71 8. Preferred option PAGEREF _Toc113494872 \h 80 9. How will actual impacts be monitored and evaluated? PAGEREF _Toc113494873 \h 86 Glossary of abbreviations PAGEREF _Toc113494874 \h 89 Glossary of terms and definitions PAGEREF _Toc113494875 \h 91 List of tables PAGEREF _Toc113494876 \h 94 Introduction: EU Political and legal context In a more and more digitalised world, the number of high-profile cyberattacks keeps on increasing and the global annual cost of cybercrime was estimated to amount to EUR 5.5 trillion by 2021. Digital hardware and software products constitute one of the main avenues for successful cyberattacks. In a connected environment, a cybersecurity incident in one product can affect an entire organisation or a whole supply chain, often propagating across the borders of the internal market within a matter of minutes . This can lead to severe disruption of economic and social activities or even become life threatening. While the cybersecurity of providers of digital services is regulated at EU level under the Directive concerning measures for a high common level of security of network and information systems acros s the Union ( ‘ NIS Directive’ ), the security of products with digital elements and in particular of software products is so far not subject to any comprehensive piece of EU regulation. Products with digital elements (examples): End devices , e.g.: laptops, smartphones, sensors and cameras; smart robots; smart cards; smart meters; mobile devices; smart speakers; routers; switches ; industrial control systems + Software : firmware ; operating systems; mobile apps ; desktop applications; video games + Components (both hardware as well as software): computer processing units; video cards; software libraries. There are numerous examples of noteworthy cyberattacks resulting from suboptimal product security, such as the Pegasus spyware, which exploits vulnerabilities in mobile phones and has been used by governments to spy on critics and opponents, as well as against prominent political leaders in Europe ; the WannaCry ransomware worm, which exploit ed a Windows vulnerability that affected 200 000 computers across 150 countries in 2017 and caused a damage amounting to billion s of USD; the Kaseya VSA supply chain attack , which used Kaseya’s network administration software to attack over 1 000 companies and forcing a supermarket chain to close all its 500 shops across Sweden; or the many incidents in which banking applications are hacked to steal money from unsuspecting consumers. The EU framework comprises several pieces of horizontal legislation that cover certain aspects linked to cybersecurity from different angles (products, services, crisis management, and crimes) , including measures to improve the security of the digital supply chain. In 2013, the Directive on attacks against information system s, harmonising criminalisation and penalties for a number of offences directed against information systems came into force. In August 2016, the NIS Directive entered into force as the first piece of EU-wide legislation on cybersecurity. It introduced obligations on entities operating in key sectors of the European economies and societies, with a view to make them more resilient against cyber-attacks. More recently, the Commission proposed a review of this Directive (‘NIS2 Directive proposal’) , which will most likely enter into force in 2022 . The upcoming NIS2 Directive raises the EU common level of ambition, through a wider scope, clearer rules, stronger supervision tools, a strengthened framework for operational capabilities and crises management and increased information sharing and cooperation . The new upcoming Directive also provides for supply chain security obligations and related risk management measures. In 2019, t he EU Cybersecurity Act entered into force, aiming to enhance the security of ICT products, services and processes by introducing a voluntary certification mechanism . Cybersecurity of the entire ecosystem is ensured only if all its components are cyber-secure. The above-mentioned EU legislation has however substantial gaps in this regard, as it does not cover the security of products with digital elements (see gap analysis in Annex 13 ) . Improving the cybersecurity of key services through the NIS Directive will not be enough to effectively improve cybersecurity throughout the supply chain . Nor the voluntary cybersecurity certification schemes issued under the Cybersecurity Act where manufacturers do not have a legal obligation to certify their products would be enough to affectively address cybersecurity challenges. The current EU framework applicable to products that may also have digital elements comprises several pieces of legislation, including EU legislation on specific products covering safety-related aspects and general legislation on product liability. However, the current legislation covers only certain aspects linked to the cybersecurity of tangible products with digital elements and, where applicable, embedded software concerning these products (e.g. Radio Equipment Directive – RED – and its relevant delegated act ) . The EU regulatory framework on products (e.g. the General Product Safety Directive (GPSD) and the Machinery Directive (MD) , both currently under review) does not prescribe comprehensive specific cybersecurity requirements. These findings were also confirmed by an exploratory study contracted by the Commission and conducted in 2020-2021 to assess the need for horizontal cybersecurity requirements for products with digital elements , which also indicated that the benefits of the regulatory intervention would outweigh its potential costs . A follow-up study was also contracted by the Commission in early 2022, supporting this impact assessment. While commonly accepted that an incident concerning products with digital elements can affect the whole system, it also appears more and more likely that the market will not be able to meet these constantly rising cybersecurity risks without an appropriate intervention from the policy makers. At global level , security of supply chain and security of products with digital elements became prominent in recent years. Given that most products with digital elements are sold globally and not only within specific countries (for example, most organisations worldwide are using the same operating systems and a majority of smartphones across the globe is outfitted with the same types of microprocessor) , the problems associated with the security of products with digital elements as described in the problem definition of this report are not specific to the EU but impact the rest of the world too. While cybersecurity product regulation is almost non-existing across the globe , s everal countries around the world have started to introduce measures (mainly voluntary) to address this issue . One of the most comprehensive set s of measures was taken by the Unites States of America as a result of significant supply chain attacks that affected the US administration. The measures focus on software and range from guidelines establishing best practices to detect vulnerabilities to requirements for critical software delivered to government customers or a pilot program on cybersecurity labelling for Internet of Things ( IoT ) products. T he UK is re-evaluating supply chain risks linked to ICT services and software and considering introducing soft law or regulatory measures. In Asia, various approaches are considered for supply chain security, such as a potential IoT security framework in Japan or cybersecurity labelling schemes of the likes of those recently introduced in Si ngapore. For m ore details on these global developments see Annex 6 . Noting the above-mentioned gaps in the EU legislative framework, various programmatic and political documents have called for specific EU cybersecurity requirements for digital or connected products . The need for horizontal cybersecurity requirements for all products with digital elements on the internal market as the missing piece of the puzzle completing the picture of EU cybersecurity policies was not only identified in the context of development and implementation of recent EU cybersecurity legislation but also by relevant strategic and programmatic documents : The EU’s Cybersecurity Strategy for the Digital Decade of 16 December 2020 had already announced the establishment of common European cybersecurity standards for connected products. In her 2021 State of the Union address , President von der Leyen announced a new European Cyber Resilience Act (CRA), planned for Q3/2022 under the Commission Work Programme 2022. Council Conclusions of 2 December 2020 and of 23 May 2022 have called for “ a horizontal regulation introducing cyber-security requirements” covering “ the whole lifecycle of products with digital elements ”. The European Parliament, in its Resolution of 10 June 2021 , welcomed “the Commission’s plans to propose horizontal legislation on cyber-security requirements for connected products and ancillary services”. A horizontal intervention would put in place a framework for improving the security of products with digital elements . It w ould require manufacturers of hardware and software to take cybersecurity measures and improve transparency. This will reduce the number of vulnerabilities in such products and empower users to choose products matching their security needs and to use these products in a secure manner. It would aim to be one building block in the EU’s endeavor to ensure a high level of cybersecurity throughout different supply chain levels, as well as in relation to its key concerned actors . At the same time, it would take a coherent and effective approach to preventing and countering cybercrime, all these ultimately for the benefit of consumers and citizens. In the run-up to this impact assessment, the Commission has extensively consult ed all relevant stakeholders. Member States, manufacturers, users , and other stakeholders were also invited to participate in the Open Public Consultation and in the surveys and workshops organised by the study supporting the Commission preparatory work for the upcoming regulatory intervention . The Commission has also published a Call for Evidence, to which stakeholders could submit feedback. See also Annex 2 on stakeholder consultation. Problem definition What are the problems and what are their consequence s ? Cybersecurity in products with digital elements is characterised by two major problems leading to a wide range of consequences and in particular to costs for users, both organisations and consumers, and society as a whole, mainly: (1) a low level of cybersecurity of products with digital elements , which is primarily reflected by the widespread prevalence of vulnerabilities and the insufficient and inconsistent provision of security updates, but also (2) an insufficient understanding among users as regards the cybersecurity of products because they are often not provided with the information necessary to choose products with appropriate cybersecurity features or to use products in a secure manner, leading to in adequately configured products. The cybersecurity of products with digital elements has a particularly strong cross-border dimension , as products manufactured in one country (including third-countries), such as operating systems or laptops, are often used by organisations and consumers across the entire internal market. In addition, given the borderless nature of the Internet, incidents initially affecting only a single entity or a single Member State often spread within minutes across the entire internal market. The widespread presence of vulnerabilities in products with digital elements used by organisations, such as critical infrastructure, or by consumers, as well as misconfigured products due to the users’ inadequate choice of security setting s , have far-reaching consequences. Businesses and other organisations bear significant cost associated with mitigating the risks related to cybersecurity . In addition, they must respond to and recover from cyber attacks, which often propagate across national borders and throughout the internal market. There is also a cost to society when digital solutions are not take n up for fear of security risks . Finally, there is a risk that Member States may start to regulate product s security at national level, leading to internal market fragmentation . Figure SEQ Figure \* ARABIC 1 : Problem definition While fewer vulnerabilities in products with digital elements and more transparency on the side of manufacturers as regards the security properties and secure use of products would not eliminate such costs altogether, more secure hardware and software and better documentation and instructions could lead to a notable reduction in costs. Given that most attacks rely on vulnerability exploits, there would be fewer incidents to manage and recover from. If incidents became less likely, a number of risk mitigation measures, such as cybersecurity insurance, c ould become less expensive. Problem 1: Low level of cybersecurity of products with digital elements marketed in the Union The vast majority of attacks on critical infrastructure or other essential services are the result of vulnerabilities in products with digital elements . The Commission’s proposal for a revision of the NIS Directive requires companies to integrate supply chain security measures into their risk management processes. However, the security of such entities also depends a lot on the availability of secure products. Even the most diligent risk management process cannot offer a high level of organisational security if the market for products with digital elements does not cater to the security needs of organisations. While a number of factors, such as badly configured systems and credential theft ( e.g. through phishing), can facilitate or enable cyberattacks, the main attack vector for security breaches is the exploitation of vulnerabilities in hardware and software . E stimates of the share of incidents resulting from exploits against weaknesses in the computational logic and design of software range from 62 % for operators of essential services identified under the NIS D irective to 90 % . A large majority of vulnerabilities are exploitable over the Internet and do not require physical access to networks, which explains why malicious actors are carrying out their attacks on European organisations from anywhere in the world. Cyberattacks against individuals or organisations exploit vulnerabilities in software and hardware products deployed within the victim’s network. T o achieve their mission , m alicious actors usually exploit multiple vulnerabilities at various stages of an attack . Preventing vulnerabilities during product development and identifying and closing vulnerabilities in products before they can be exploited could bring cyberattacks to halt at various stages of the ir development . For example, attackers might first exploit a vulnerability allowing them to breach the server hosting a company’s website before making their way through the company’s network to more crucial systems, such as key workstations and the sensitive data stored thereon. The number of vulnerabilities recorded in vulnerability databases is increasing year-on-year. For example, vulnerabilities recorded under the US Common Vulnerabilities and Exposures (CVE) system have increased from 18 325 in 2020 to 20 150 in 2021. This is also valid for the high-profile vulnerabilities that are exploited by malicious actors and for which manufacturers have to date not provided any patch (“zero-days”) . According to cybersecurity researchers and databases tracking vulnerabilities, to date the year 2021 has seen the so-far highest number of zero-day vulnerabilities in products with digital elements actively exploited. As a result, the attack surface that malicious actors can exploit increased significantly. At the same time, the threat landscape has evolved, with the number of documented major state-sponsored cybercrime groups increasing year-on-year. While there is no universally applicable measure ment of the aggregate level of security of products with digital elements marketed in the Union, a number of observations indicate that the security of products with digital elements is low across the board . Vulnerabilities are regularly identified in all types of products, both hardware and software. When it comes to hardware, vulnerabilities are discovered both in integrated products sold in the market (such as smartphones, laptops or smart household appliances) as well as in hardware components, such as in memory, c entral p rocessing u nit s (CPUs) and other chipsets. Similarly, software vulnerabilities are found in all types of products, ranging from operating systems to user applications and even those products actually designed to help prevent incidents, such as anti-virus software . Again, vulnerabilities are not only found in final products but also in intermediate software components, such as libraries, and including in open-source components. The Apache Log4j logging utility is the most recent example of a major vulnerability in a widely used open-source software component that has affected entities across the entire internal market. Log4j has been used by a wide range of major software manufacturers and the vulnerability, which has existed since 2013 but was only discovered in 2021, has led to security incidents across the globe. Moreover, the number of vulnerable devices connected to the Internet is increasing. For example, manufacturers are connecting more and more ICSs to the Internet. Between 2017 and 2018, the number of ICSs increased by 27 %. According to a 2021 study, many companies are connecting operational technology (OT) directly to the Internet. Almost all devices analysed by the study contain at least one vulnerability, with Europe and North America being the most affected. Security is not only a concern in products deployed in an industrial or organisational setting , but also when it comes to consumer devices. A recent Euroconsumers probe into connected home devices, such as alarm systems and food processors, has revealed that two-thirds of devices contain vulnerabilities considered as ‘of high severity’ or ‘critical’, affecting both low-cost devices of unknown brands as well as products developed by well-known manufacturers. Vulnerabilities in connected products are not only a theoretical concern , but their exploitation has a very real impact on consumers. For example, in 2019 cybercriminals breached Ring Home Security Cameras to observe citizens in their private homes and to speak with a small child in the child’s room. Manufacturers of products with digital elements do not only place vulnerable products on the marke t , but they often also do little to improve security throughout the life cycle of their products. For example, a 2018 survey of smartph one manufacturers revealed that 14 out of 19 device manufacturers provide security updates for less than three years. In addition, when manufacturers do provide updates fixing vulnerabilities, they often take too long . Even security flaws discovered by Google’s Project Zero, which pressures manufacturers of browsers and other software into swiftly fixing vulnerabilities by threatening to disclose them after 90 days, are on average only fixed after 52 days. Finally, many manufactures do not even provide for means to contact them to report discovered vulnerabilities. W eaknesses in products with digital elements are not only discovered by the manufacturer of a product or a malicious actor , but also by other manufacturers , security researchers, ethical hackers and even customers. Ideally, organisations should therefore develop their own vulnerability disclosure policies to facilitate interaction with these actors. At the very least, organisations should provide for a means to report vulnerabilities to them. According to the European Telecommunications Standards Institute, “As of early 2022 only about only about 20 % of ICT and IoT companies have a publicly identifiable dedicated means to notify a company of a potentially serious security issue with their products or services." The problems associated with non-secure products are exacerbated by the fact that in a range of markets for products with digital elements , the number of available products is very limited, creating a monoculture . As a result, whenever a new vulnerability is exploited, a relatively large number of users is affected at the same time. This monoculture is explained by the fact that in some instances the utility of products with digital elements , in particular software, increases with the number of people that use it. The importance of such network effects that dissuade users from diversifying the products that they use and their impact on cybersecurity have been long recognised. In addition, exploiting known vulnerabilities has never been easier and does often not require a particularly high degree of familiarity with the underlying weaknesses in the computational logic of targeted systems. Asked to rate the overall level of security of products with digital elements in the Union, the respondents to the Commission’s public consultation on the initiative gave on average a 2.82 (on a scale from 1 to 5 with 5 indicating a very high level of cybersecurity) products with digital elements . The responses of the different stakeholder groups were as follows: national market surveillance bodies (1 . 5), consumer associations (1 . 7), public administrations as users (2 . 5), SMEs as users (2 . 5), hardware manufacturers (3 . 2), software manufacturers (2 . 8), SMEs in their role as manufacturers (3 . 2). In addition, an overwhelming majority of 95 % of respondents said that the level of risk of cybersecurity incidents affecting products with digital elements has increased during the last five years. Problem 2: Insufficient understanding among users as regards the cybersecurity of products While it is crucial to make products with digital elements more secure, cybersecurity incidents are in many cases also the result of users choosing products ill-fitted for their purposes or wrongly configuring hardware and software, thereby unnecessarily increasing the security risk of their device or network. This is the result of a number of factors, including a lack of cybersecurity awareness and skills of users, and a lack of information provided by manufacturers on security properties, vulnerabilities and secure use. For example, a study of a Dutch consumer protection organisation covering 86 manufacturers across 18 different product groups has revealed that only 1 out of 5 manufacturers provides information to customers about available security updates. Nothing is more revealing of the lack of understanding amongst users than the notorious neglect of urgent security updates. A survey from 2014 interviewing Microsoft Windows users suggested a lack of awareness and knowledge by users as well as a lack of clear information provided by manufacturers to users. According to 2020 Eurostat data, around 48 % of EU citizens have never restricted or refused access to personal data, when using or installing an app on a smartphone. Asked in the consultations held by the study supporting this impact assessment t o which extent an insufficient understanding of users of the security of products with digital elements has a negative impact on the security of individuals or organisations, 69 % of participants replied that the impact was at least moderate. Asked to rate consumers’ awareness and understanding of cybersecurity properties of products with digital elements , consumer organisation s gave an average rating of 2.33 (on a scale from 1 to 5). Asked in the public consultation to rate their own awareness of the cybersecurity risks associated with products with digital elements , consumer organisations gave a rating of 2 . 3 on behalf of consumers. Similarly, when asked to rate their understanding of the cybersecurity properties of products with digital elements and the skills to operate them securely, consumer organisations provided a rating of 1 . 7. What are the problem drivers? Driver 1: Lack of incentives for manufacturers to take security seriously Manufacturers often neglect the security of their products. Almost 50 % of manufacturers knowingly place products with digital elements on the marked that contain vulnerabilities. One of the main reasons for this is that manufacturers lack the necessary incentives to invest in a secure development life cycle (SDLC). This is the result of strong negative externalities in markets for products with digital elements , information asymmetries between manufacturers and users, a faced-paced market and the costs associated with secure development. A recent international survey amongst almost 100 software develop ment professionals of mobile health applications has revealed that “little or no budget for employing security” is considered the main challenge when it comes to application security, followed by “insufficient security knowledge [amongst developers]” . Other important challenges that were identified highlight deficiencies in the development life cycles of manufacturers, such as a “lack of involvement of security experts” , “poor security decisions during development process” and a “lack of security testing” . Asked in the public consultation whether manufacturers of software were effectively addressing cybersecurity vulnerabilities and incidents affecting their customers, the respondents gave an overall rating of 2.96 ( on a scale from 1 to 5) , with consumer organisations rating the effectiveness of manufacturers very low (1.33). The responses of the other stakeholder groups were as follows: national market surveillance bodies (2 . 0), public administrations as users (2 . 8), SMEs as users (2 . 3), hardware manufacturers (3 . 7), software manufacturers (3 . 4), SMEs in their role as manufacturers (3 . 5). Users bear the c osts associated with incidents and the market has negative externalities While manufacturers of products with digital elements can sometimes face reputational damage when their products are found to be lacking security, the cost of vulnerabilities is predominantly borne by the users, such as operators of essential services, but also consumers. Examples of costs borne by users are risk mitigation costs, such as taking out cybersecurity insurance or putting in place a security operation centre , as well as the costs resulting from a cybersecurity incident, such as the cost involved in re covering lost data. This limits the incentives of manufacturers to invest into secure design and development and to provide security updates. While it might seem intuitive to assume that manufacturers have an incentive to make their products secure and avoid the fallout of incidents involving their products, in reality it is rarely the companies affected by major cybersecurity incidents that suffer significant negative long-term consequences, but rather the users or customers. One of the reasons why reputational damage often does not translate into users actually switching products consists of the high switching costs associated with replacing a product by another one: products are often heavily tied into existing operations. Moreover, in many cases products markets do not provide for a wide range of alternative products with digital elements . For example , there are only very few widely used operating systems for desktop computers and smartphones. Similarly, the chipset market is highly concentrated with only few companies offering desktop CPUs, video card chipsets and other components. Respondents to the public consultation have identified costs borne by users as an important driver for the low level of security of products with digital elements : Respondents rated the “The user bears additional cost when affected by a cybersecurity incident” with 4.13 (on a scale from 1 to 5). The responses of the different stakeholder groups were as follows: national market surveillance bodies (4 . 7), consumer associations (5 . 0), public administrations as users (4 . 6), SMEs as users (4 . 6), hardware manufacturers (3 . 4), software manufacturers (3 . 9), SMEs in their role as manufacturers (3 . 6). In addition, it is often not even the manufacturers or the users bearing the costs of incidents but unrelated third parties, such as the victims of DDoS attacks carried out using infected devices: Given the structural and persistent nature of such negative externalities in the markets for products with digital elements , a recent study on IoT device security has concluded that “The costs of security failures are often borne by other stakeholders than the owners of the device or the manufacturers. So, there is a market failure here that justifies government intervention.” Information asymmetries While the manufacturers of products with digital elements are normally not bearing the cost associated with vulnerabilities, they would have to bear the additional cost of making their products more secure. This raises the question if there could be any other incentives leading to an adequate level of investment in product security, such as competitive advantage derived from placing products with a high level of security on the market. However, u sers are often unaware of the security risks associated with products with digital elements . W hile they may attribute value to secure products, they do not have the knowledge to understand the value stemming from a product that has been developed with security considerations mind. In addition, given the complexity of products with digital elements and the fact that users usually do not have any knowledge of the internal workings of a product , it is very difficult for them to make purchasing decisions based on such properties . This lead s to “bad products driving out good ones” . While information asymmetry applies to both professional users (such as critical infrastructure) as well as consumers, it is in particular the case for consumers. As a result, manufacturers cannot gain a competitive advantage from investing in the security of their products, such as by adopting a SDLC. Cybersecurity as a potential barrier to fast market entry (first-mover advantage) Not only do manufacturers lack positive incentives to invest in security, emphasising product security can sometimes even be detrimental to the success of an undertaking: In a competitive market, companies can only bear additional marginal cost stemming from cybersecurity if their competitors are taking investments in cybersecurity equally seriously, unless they can increase prices because users value the integration of additional security properties. Hardware and software, however, are often characterised by the presence of strong network effects and economies of scale, making markets for products with digital elements a winner takes it all economy. Due to the fast-paced nature of markets for products with digital elements , manufacturers are usually trying to bring new products or features for existing products onto the market as quickly as possible, prioritising feature development and compatibility with existing products, treating the development of security properties as an afterthought: “From the economic perspective of the manufacturers, there are less benefits in strongly securing IoT devices compared to the benefits that arise from shorter development cycles omitting these security measures.” Nothing epitomises the fast market entry approach more than the motto that Facebook had adopted in its early years of development: Move fast and break things . Securing products comes at a cost While it is possible to improve the security of products through investment, companies tend to shy away from the costs associated with building a SDLC. The cost associated with improving product security depends on both the maturity of the entity as regards cybersecurity as well as the level of ambition. According to a recent study on the cost of required security, the cost associated with the additional effort made to improve the security of software products is at least 19 % of the development costs, depending on the security objectives to be achieved. Traditionally, researchers believed that rational manufacturers should invest in cybersecurity (such as by setting up a SDLC), as it would be cheaper to prevent vulnerabilities in the first place than to fix them at a later stage (delayed issue effect). More recently, however, researchers have begun to challenge this notion, bringing forward new evidence suggesting that patching security holes in a product at a later stage is no more expensive than resolving security issues early during development. This further substantiates the view that, given the cost of cybersecurity, manufactures have no natural incentive to develop secure products. Driver 2: Piecemeal coverage of cybersecurity in EU policies Currently there are no specific cybersecurity requirements comprehensively and systematically applicable to all products with digital elements , hardware or software, accessing the internal market. Cybersecurity of software (embedded in hardware and upload-able or of generic use, i.e. standalone ) in particular, of key importance for cybersecurity policies, is the least regulated even at the level of sector- or product-specific legislation with limited scope. In order to effectively ensure the security of products as per the problems identified, comprehensive and systematic cybersecurity requirements applicable to all digital products, should entail as key minimum elements, that : (i) cybersecurity is factored in the design and development of the digital products and that due diligence is exercised by manufacturers on security aspects when designing and developing their products, (ii) transparency is ensured on cybersecurity aspects that need to be made known to customers and (iii) security support (updates and handling of vulnerabilities) are provided after the placement on the market . Nonetheless, t here is a small set of EU legal acts providing for product-related cybersecurity requirements . This is the case of the Radio Equipment Directive (RED) together with a recently adopted delegated regulation , which cover s IoT devices outfitted with a radio interface, or the Medical Devices Regulation (MDR) , which cover s both tangible medical products as well as software. In addition, there are a few European product laws that provide some rules regarding the cybersecurity of products, albeit only in a partial manner, such as the Toy Safety Directive (TSD) . However, m ost hardware, such as wired IoT devices or computer components, including chipsets, memory chips or processors, as well as the vast majority of software products, such as operating systems, user applications, server software or software libraries, are not covered by any European legal act dealing with their cybersecurity . The exploratory study contracted by the Commission and conducted in 2020-2021 to assess the need for horizontal cybersecurity requirements for products with digital elements , conducted a gap analysis comparing the cybersecurity objectives set out in the Cybersecurity Act (Article 51) against the identified cybersecurity-relevant requirements of 37 pieces of EU legislation concerning products with digital elements . This includ ed all legislation related to the New Legislative Framework ( NLF ) , as well as legislation with a strong link with cybersecurity and data protection, which can affect indirectly and to a limited extent manufacturers (e.g. the eIDAS Regulation, General Data protection Regulation (GDPR), the NIS Directive, RED and GPSD). The NLF is a package of measures that streamline the obligations of manufacturers, authorised representatives, importers and distributors, improve market surveillance and boost the quality of conformity assessments. It also regulates the use of CE marking and creates a toolbox of measures for use in product legislation. This framework was introduced in 2008 to depart from the ‘old approach’ where technical legislation was going into great detail, usually motivated by a lack of confidence in the rigour of economic operators on issues of public health and safety. The gap analysis concluded that the current EU legislative framework does not cover all security objectives , that legislation related to the NLF does not address fully the cybersecurity requirements for products with digital elements and that there are different levels of granularity of cybersecurity requirements in the legislation in scope. In addition, the study concluded that requirements regarding software are very rarely covered by such legislation. For more deta ils on existing European legislation, see section 1 in Annex 5 . As a result of the regulatory gaps described, no piece of EU legislation requires currently comprehensive cybersecurity requirements for all products with digital elements . While there is a variety of international standards concerning several aspects of product cybersecurity (consumer IoT, assurance of security throughout lifecycle or vulnerability handling, access control, etc.), there are no harmonised European standards for products with digital elements across sectors ( see Annex 14 ) . A detailed regulatory gap analysis can be found in Annex 13 . Driver 3: M anufacturers do not provide information on security properties and vulnerabilities M arkets for products with digital elements exhibit strong information asymmetries. This is in particular for closed source products , but also applies to open source products , given the high degree of complexity of products with digital elements . Against the backdrop of a user base that for the most part lacks the skills to evaluate the security properties of products with digital elements , manufacturers in products with digital elements markets are facing a moral hazard , being incentiv ised to further deprioritise product security and transferring the risk onto users. This leads to a situation in which manufacturers compete with one another on product features, such design or usability, but not on advertised security properties. In many cases, the information provided by manufacturers does not even allow proficient users or companies, such as operators of essential services under the NIS Directive, to compare security requirements with security properties and to make informed purchasing decisions about products . This is not only true when it comes to products with digital elements developed for end-users , but also with regard to intermediate software components used by other software manufacturers to build final products. Asked in the public consultation if they agreed with the statement that “There is sufficient and clear information made available on the cybersecurity properties of products with digital elements ” , participants gave an average rating of 2.50 (on a scale from 1 to 5), with consumer organisations giving a rating of only 1.33, users (business and consumers) giving a rating of 2.34, hardware manufacturers rating the information they provide with 2.85. SMEs and organisations representing SMEs in general rated it at 2.4 and 2.6 out of 5, similar to the average, with a slightly higher rating of 3.00 for organisations representing SME manufacturers , and those representing SME users rating it at 2.0. Driver 4: M anufacturers do not provide information on secure use Apart from not disclosing relevant information about the security properties of products with digital elements , manufacturers often also fail to provide information helping users employ products in a secure manner, such as by including information on secure use in the manual or installati on instructions. A recent surv ey of IoT device manufacturers revealed that only 43 % of manufacturers provide information on how users can change default passwords and only 26 % of manufacturers provide additional advice on how to protect their products from cybersecurity breaches. Additional drivers not addressed by this intervention In addition to the drivers listed above, there are a number of additional problem drivers that have an impact on the security of products with digital elements as well as on the understanding of users as regards suc h products. However, given the nature of the product -related intervention considered , these additional drivers would not necessarily be addressed directly . Lack of bargaining power of users: Products with digital elements markets are often characterised by the presence of a few large manufacturers due to economies of scale and vendor lock-in , the latter being the result of a lack of compatibility between hardware and software platforms. As a result, users of products with digital elements lack the bargaining power necessary to ensure that manufacturers develop products matching the security needs of specific users. Lack of qualified security professionals: Manufacturers of products with digital elements often struggle to hire qualified security professionals: For example, the gap in cybersecurity professionals in Europe amounted t o 199 000 in 2020. The Union is trying to address the skills gap through a variety of measures, including funding through the Digital Europe Programme. Lack of cybersecurity awareness and skills of users: Studies show that users often lack even the most basic cybersecurity skills. While this applies in particular to consumers, who are often not even familiar with basic internet security terminology, it also affects businesses and other organisations: For instance, only half of business leaders and only a third of their employees acknowledge the risk that cybercrime poses to their organisations. More details on additional drivers identified can be found in section 2 of Annex 5 . Consequences of the problems identified Consequence 1: Increased number of cybersecurity incidents with material and non-material harm to citizens and companies The importance and impact of cyber attacks have increased dramatically in recent years. On the one hand, both companies and consumers are growing more dependent on products with digital elements . This trend has been exacerbated by the COVID-19 crisis, which gave rise to widely spread telework and accelerated the digitisation of society. In addition, critical infrastructure as well as manufacturers are increasingly connecting their industrial control systems (ICSs) to the Internet. On the other hand, cyber attacks are sharply increasing and they are used as an economic and geopolitical weapon. The 2020 Annual Cost of a Data Breach Report of the Ponemon Institute estimates that the average cost of a data breach for individual businesses was EUR 3.5 million in 2018, which is an increase of 6.4 % over the previous year. Such costs include, but are not limited to, getting systems and manufacturing processes back online, managing the reputational fallout, paying a ransom , recovering or compensating for lost or stolen data, and cleaning, reinstalling or replacing affected hardware. In many cases, it takes months for companies to fully recover from an incident. As incidents affect the availability, integrity , authenticity and confidentiality of services, they often affect customers ( e.g. a service might become unavailable or sensitive customer data might be stolen) and sometimes propagate across organisations and supply chains throughout the internal market, generating considerable cost s . For example, ransomware attacks alone are estimated to have cost the world roughly USD 20 billion in the year 2021. Statistically speaking, every 11 seconds another organisation is hit by a ransomware attack. Supply chain attacks represented a major problem in recent years : cybercriminals introduce malicious code into legitimate products with digital elements for the purpose of attacking the users of such products. One of the most prominent recent examples is the SolarWinds attack in 2020. Vulnerabilities and badly configured systems not only affect the security of organisations but also have a major impact on consumers. Impacts can be financial, as well as related to privacy or health. For instance, when it comes to financial harm, certain types of malware infect the devices of citizens with the goal of collecting online banking credentials and secretly executing payments. Incidents can also have an impact of the safety of citizens. For example, cybersecurity incidents in hospitals have been found to lead to a small increase in mortality rate. In a number of instances, IoT consumer devices have been hacked to track the lives of citizens. A phenomenon of particular relevance to consumers is the hacking of IoT devices for the purpose of integrating them into a botnet , a larger network of devices stretching across the internal market and beyond, controlled by a malicious actor and used to conduct so-called DDoS attacks affecting the availability of services provided by organisations, such as critical infrastructure, and to send out unwanted spam messages to email users. Cross-border botnets create significant negative externalities, as it is usually not the device owners that have to bear the cost of device abuse but rather the victims of DDoS attacks or the recipients of spam. It is estimated that an individual small company targeted by a DDoS attack can face costs up to USD 120 000, while for larger companies the cost can go as high as USD 2 million. In 2021 alone cybercriminals were able to leverage hacked devices and launch 9.75 million DDoS attacks worldwide. Generally speaking, entities across all economic sectors tend to fall victim to cybersecurity attacks. This is first and foremost explained by the fact that “ in many cases the threats manifest themselves by exploiting vulnerabilities in underlying ICT systems that are being used in a variety of sectors ” . Nonetheless, certain sectors are more affected than others: According to the EU’s cybersecurity agency ( ENISA ) , public administrations, digital service providers, healthcare and finance are the sectors experiencing the highest number of incidents, while sectors such as water utilities, postal and courier services, space and semiconductors are the least affected. These differences are explained by the relative economic importance of certain sectors as well as by the maturity of organisations when it comes to cyber resilience, an issue being addressed by the revision of the NIS Directive. Respondents to the public consultation have overall rated the consequences of cybersecurity incidents as very high. SME s consistently rated o n average the material consequences of cybersecurity incidents higher than other organisations. Consequence 2: Increased cost to society to mitigate cyber risks In addition to the costs following an incident, businesses and other organisations are also forced to invest significantly into incident prevention, handling and mitigation as a result of non-secure products with digital elements . Such investments include taking out cybersecurity insurance or putting in place entire company departments dedicated to security, such as cybersecurity incident response teams (CSIRTs) or security operations centres (SOCs). According to the Commission’s impact assessment for the revision of the NIS Directive, the average ICT security spending of companies in 2020 is of approximately 9.14 % of their ICT spending. In the public consultation, both consumers as well as respondents identifying themselves as users agreed with the statement that “The user bears additional costs due to highly priced cybersecurity insurance” , rating it at 4.50 and 3.48 respectively (on a scale from 1 to 5). Similarly, consumers and users agreed with the statement that “The user bears additional costs due to the need to deploy highly priced technical security solutions” , rating it at 3.67 and 4.03 respectively. In particular SMEs in their role as users agreed with the two statements (3.80 and 4.20 respectively). Consequence 3: Reduced uptake of digital solutions Finally, lacking cybersecurity also creates opportunity costs for businesses, governments and society as whole, when modern technologies are not deployed as quickly as possible for fear of being unable to manage the risks associated with the m . This may seem counterintuitive given the recent substantial increase in digitisation caused by the pandemic. But irrespective of the exceptional circumstances in recent years, security concerns are considered as one of the main barriers to the adoption of products with digital elements . In fact, security concerns are one of the main reasons why decision makers are shying away from investments in IoT solutions. A reduced uptake of digital solutions can have a negative impact on innovation, efficiency gains and, as a result, economic growth. Consequence 4: Risk of emergence of internal market fragmentation While only few Member States have so far introduced measures to regulate the security of products with digital elements at national level (both Germany and Finland have introduced labelling schemes, see section 6.3 ) , the scale of the problems associated with insecure products with digital elements could in the future lead to targeted product-specific interventions at national level . The Council considers the security issues associated with products with digital elements as a matter of urgency and has repeatedly called upon the Commission to propose regulation in this area. Member States are aware that, given the impact on the internal market, measures need to be taken at EU level. In the absence of EU regulation however , they ar e likely to take further action , within then limits allowed by the treaties. This could be the case particularly to achieve objectives in the areas of safety, health, environment and consumer protection, these being areas where national regulations of this sort could be acceptable without being considered a breach of free movement of goods in the internal market. This could lead to a situation in which manufacturers would be facing an unsystematic approach to product security across the internal market. This could result in internal market fragmentation with negative consequences for the cost-effectiveness and competitiveness of European hardware and software manufacturers (see section 6.3 ). In the public consultation, respondents rated the question “T o what extent do you agree that there is a risk of increasing costs and legal uncertainty for market stakeholders, in the absence of an EU initiative? ” with 4.38 out of 5 (with 5 indicating that they fully agree). SMEs responded with 4.4 out of 5, and organisations representing SMEs with 4.5. Finally, in absence of harmonised rules, users, such as critical infrastructures obligated under the revised NIS Directive to take their supply chain security more seriously, may start putting in place diverging contractual requirements for manufacturers of products with digital elements . How likely are the problem s to persist? There have been numerous efforts to improve the cybersecurity of products with digital elements both by academia and by the manufacturing and development community. For instance, new programming languages, such as Rust or Go, have been developed that minimize the risk of certain types of vulnerabilities, such as memory corruption. Several mostly large manufacturers have started adopting a SDLC with a view to improve software and hardware security. As a result, security software, such as static and dynamic testing tools, has become available on the market, helping manufacturers to verify the security of computer code. Moreover , some manufacturers of products, such as operating systems, browsers and routers, are outfitting their products with automated updating features, ensuring that also inexperienced users can benefit from the latest security updates. In addition, the Cybersecurity Act, which c a me into force in 2019, provides for the possibility to certify , on a voluntary basis, ICT products, services and processes. A number of product- specific international standards have also emerged, such as ETSI’s Consumer Mobile Device Protection Profile, standards for industrial automation and control systems , or a set of guidelines released by the Open Web Application Security Project (OWASP). S ome of the problem drivers described in the previous section may diminish in the future. For example, the labour market may adjust and provide manufacturers with more qualified security professionals, either as a result of market forces or f ollowing government measures . Sim ilarly, as a result of awareness raising campaigns and adapted school curricula, users could become more aware of cybersecurity risks and more proficient in using products with digital elements securely. However, while some of the recent market developments and standardisation and certification efforts are steps in the right direction, most of the problem drivers are very unlikely to disappear, given that they are the direct result of persistent structural market failures . The lack of incentives for manufacturers to take the cybersecurity of their products seriously will persist in the presence of negative externalities and information asymmetries, but also against the backdrop of a fast-paced industry that rewards early market entry above everything else. Given that existing standards are voluntary and non-comprehensive , manufacturers have little incentive to apply them. In addition, while new supply chain security requirements for critical infrastructure and other essential entities under the reviewed NIS Directive will help put pressure on hardware and software manufacturers, business users and other organisations, such as public administrations, will continue to lack negotiating power in more concentrated products with digital elements markets. While there have been various attempts within the market to improve the security of products with digital elements , the overall assessment that many products with digital elements are highly vulnerable is unlikely to change without government intervention. A recent study o n software vulnerabilities has concluded that “ i n 15 years, the vulnerability landscape hasn’t changed; through the lens of the metrics in this paper we aren’t making progress.” As a result, regulators have little reason to believe that the situation will substantially improve without regulatory intervention. In the absence of European legislation, Member States are likely to introduce national regulations laying down security requirements on such categories of products , within the limits allowed by EU law . While national intervention could contribu te to reducing the problem of lo w product security, it would inevitably also lead to internal market fragmentation , preventing manufacturers on an otherwise global products market from providing hardware and software solutions across the internal market in a cost-effective manner (see section 6.3 for more details). Why should the EU act? Legal basis This intervention will be based on Article 114 of the Treaty on the Functioning of the European Union (TFEU), whose objective is the establishment and functioning of the internal market by enhancing measures for the approximation of national rules. The measures must be intended to improve the conditions for the establishment and functioning of the internal market and must genuinely have that objective, actually contributing to the elimination of obstacles to the free movement of goods or services, or to the removal of distortions of competition. Article 114 TFEU may be used as a legal basis to prevent the occurrence of these obstacles resulting from diverging national laws and approaches on how to address the legal uncertainties and gaps in the existing legal frameworks. Furthermore, the Court of Justice has recognised that applying heterogeneous technical requirements could be valid grounds to trigger Article 114 TFEU. The present intervention would aim to improve the internal market’s functioning by streamlining and supplementing existing rules. T he current EU legislative framework applicable to products with digital elements is based on Article 114, and comprises several pieces of legislation, including on specific products and safety-related aspects or general legislation on product liability . However , it covers only certain aspects linked to the cybersecurity of tangible products with digital elements and, as applicable, software embedded in these products. As explained in more detail in section 6.3 , at national level, Member States are starting to take national measures requiring manufacturers of products with digital elements to enhance their cybersecurity. At the same time, t he cybersecurity of products with digital elements has a particularly strong cross-border dimension, as products manufactured in one country are often used by organisations and consumers across the entire internal market. Incidents that initially concern a single entity or Member State often spread within minutes across organisations, sectors and several Member States . The various acts and initiatives taken so far at EU and national levels only partially address the problems identified and risk creating a legislative patchwork within the internal market, increasing legal uncertainty for both manufacturers and users of these products and adding unnecessary burden on companies to comply with a number of requirements for similar types of products. Therefore, the envisaged in tervention would harmonise and streamline the EU regulatory landscape by introducing cybersecurity requirements for products with digital elements and avoid overlapping requirements stemming from different pieces of legislation. A horizontal regulatory intervention on cybersecurity of products would do away with legal uncertainty on these aspects triggered by a patched approach taken in various product-specific or general product-related pieces of legislation . It would create greater legal certa inty for operators and users across the Union, as well as a harmonisation of the European single market, creating more viable conditions for operators aiming at entering the EU market. Subsidiarity: Necessity of EU action The strong cross-border nature of cybersecurity in general and the growing risks and incidents, which have spill-over effects across borders, sectors and products, mean that the objectives of the present intervention cannot effectively be achieved by Member States alone. Taking into account the global nature of markets for products with digital elements , Member States face the same risks with respect to the same product with digital elements on their territory. For example, a recent study on infected IoT products across the internal market has revealed that it is the same nine manufacturers in each country that are responsible for placing the highest number of IoT devices on the market that have been infected as a result of vulnerabilities, concluding that “international collaboration among regulators in various countries is a feasible path. This would not only bundle scarce resources on the side of governments, but is also more likely to influence manufacturer behaviour through collective action. An obvious starting point would be coordination at the level of the European Union.” An emerging patchy framework of potentially diverging national rules also risks hampering an open and competitive single market for products with digital elements . Some Member States, such as Germany and Finland have already taken first (non-binding) measures to improve the security of products with digital elements (see section 6.3 ). National approaches in addressing the problems, and in particular approaches introducing mandatory requirements, will only create additional legal uncertainty and legal barriers. Companies could be prevented from seamlessly expanding into other Member States, depriving users of the benefits of their products. Given the lack of negotiation power of individual users on a global p roducts market with large multi national manufacturers (see section 2.2.5 ), regulation at national level wou ld not be effective. In a 2021 report , the Dutch Safety Board concluded that the products with digital elements market “can hardly be influenced by users in the Netherlands alone. Influencing such a global market requires a larger power block, for example at EU or UN level, or based on joint actions by end users.” Joint action at EU level is therefore necessary to establish a high level of trust among users, increasing the attractiveness of EU products with digital elements . It would also benefit the (digital) single market and internal market in general by providing legal certainty and achieving a level playing field for manufacturers of products with digital elements . Ultimately, as referred to in section 1 , the Council Conclusions of 23 May 2022 on the development of the European Union’s cyber posture call upon the Commission to propose, by the end of 2022, common cybersecurity requirements for connected devices. Subsidiarity: Added value of EU action The objectives of the initiative can be better achieved at Union level so as to avoid a further fragmentation of the single market into potentially contradictory national frameworks. A single framework regarding cybersecurity requirements for products with digital elements would provide legal certainty and avoid overlapping or contradictory requirements stemming from different pieces of legislation. Harmonised EU requir ements would facilitate compliance for manufacturers of products with digital elements and create more viable conditions for operators aiming at entering t he EU market . Users’ trust that products with digital elements acquired in any Member State comply with a harmonised set of requirements would increase their trust in and demand for these products. Given the global and cross-border nature of the digital market and the internet, the intervention would reduce negative cross-border spill-overs and costs to society linked to mitigating risks of non-secure products. As regards the proportionality of the intervention, the measures in the policy options considered would not go beyond what is needed to achieve the general and specific objectives and would not impose disproportionate costs. More specifically, the intervention considered would ensure that products with digital elements would be secured throughout their whole life cycle and proportionally to the risks faced through objective-oriented and technology neutral requirements that remain reasonable and generally corresponding to the interest of the entities involved. Objectives: What is to be achieved? Figure SEQ Figure \* ARABIC 2 : Intervention logic General objectives Based on the main problems identified in the section 2.1 , the main objectives of the intervention should be as follows: General Objective 1 (GO1): Ensure the proper functioning of the internal market and prevent market fragmentation by creating harmonised conditions for the development of secure products with digital elements . The intervention should ensure that hardware and software products are released to the market with fewer vulnerabilities and that manufactures take the security seriously throughout a product’s entire life cycle, in particular by providing timely security updates. In addition, it is important that manufacturers prevent malicious actors from tampering with production code. General Objective 2 (GO2): Ensure the proper functioning of the internal market and prevent market fragmentation by creating harmonised allowing users to take cybersecurity into account when selecting and using products with digital elements . The intervention should ensure that both consumers as well as business users and other organisations are able to select products whose security properties match their security requirements. In addition, measures should be taken to support users in operating technical in a secure manner. Specific objectives Based on the problem drivers identified in section 2.2 and with a view to reaching the two general objectives defined above, the specific objectives of the intervention should be as follows: To address the problem of low level of cybersecurity of products with digital elements marketed in the Union: SPO1 Ensure that manufacturers improve the security of their products with digital elements since the design and development phase and throughout the whole life cycle of those products SPO2 Ensure a coherent cybersecurity framework , facilitating compliance for hardware and software manufacturers To address the problem of insufficient understanding among users as regards the cybersecurity of products: SPO3 Enhance the transparency as regards the security properties of products with digital elements SPO4 Enable organisations and consumers to use products with digital elements securely As referred to in section 2.2.5 , there are certain additional problem drivers that will not be addressed by the proposed intervention. This is not to say that the intervention will have no impact at all on these drivers (see sect ion 6.7 ). What are the available policy options? This section presents the policy options, including the baseline scenario, that have been considered for addressing the problems identified in s ection 2 and meeting the objectives set out in s ection 4 . Problem drivers Specific policy objectives Policy options PO1 (soft law) PO2 (ad-hoc interv.) PO3 (mixed appr.) PO4 (horiz. interv.) PO4 a) (horiz. interv. only critical software) PO4 b) (horiz. interv. all software) PO 3 i) PO 3 ii) PO 4 a) i) PO 4 a) ii) PO4 b) i) PO4 b) ii) DR1: Lack of incentives for manufacturers to take security seriously SPO1: Ensure that manufacturers improve the security of their products with digital elements since the design and development phase and throughout the whole life cycle of those products —Communications, guidance and recommendations for supply side stakeholders, including on non-embedded software —Recommendation on public procurement of products with digital elements — Development of additional European cybersecurity certification schemes —Amendments to existing product specific legislation —Integrate cybersecurity into future product-specific NLF legislation —Horizontal regulatory intervention for tangible products with digital elements (excluding non-embedded software) —A potential legal act on non-embedded software at a later stage (staggered approach) —Horizontal regulatory intervention for a broad scope of tangible and only critical intangible products with digital elements (including non-embedded software) —Horizontal regulatory intervention for a broad scope of tangible and intangible products with digital elements (including non-embedded software) — self-assessment by default for all products covered — third-party assessment for a narrow share of critical tangible products — self-assessment by default for all products covered — third-party assessment for a narrow share of critical tangible and intangible products — self-assessment by default for all products — third-party assessment for a narrow share of critical tangible and intangible products DR2: Piecemeal coverage of cybersecurity in EU policies SPO2: Ensure a coherent cybersecurity framework DR 3 : Manufacturers do not provide information on security properties and vulnerabilities SPO3: Enhance the transparency as regards the security properties of products with digital elements (partly included in the measures addressing DR1) (partly included in the measures addressing DR1) Horizontal intervention to include transparency requirements for tangible products with digital elements on security properties Horizontal intervention to include transparency requirements for both tangible and critical intangible products with digital elements on security properties Horizontal intervention to include transparency requirements for both tangible and intangible products with digital elements on security properties DR4: M anufacturers do not provide information on secure use SPO4: Enable organisations and consumers to use products with digital elements securely (partly included in the measures addressing DR1) (partly included in the measures addressing DR1) Horizontal intervention to include transparency for tangible products with digital elements requirements on secure use Horizontal intervention to include transparency requirements for both tangible and critical intangible products with digital elements on secure use Horizontal intervention to include transparency requirements for both tangible and intangible products with digital elements on secure use Table SEQ Table \* ARABIC 1 : Problem drivers, specif ic objectives and policy options What is the baseline from which options are assessed? The relevant EU markets A horizontal regulatory intervention would lay down requirements for some or all products with digital elements marketed in the Union (with the broadest scope under policy option 4). Requirements would not only cover the final product with digital elements (e.g. a smart phone) , but also their components, both for hardware and software. As a result, depending on the policy option s , the initiative would have a n impact throughout the entire digital supply chain, and provide users with a very high level of assurance rega rding the security of products. See also the illustrative example of smart phones in the description of options 3 and 4, section 5.2 . The relevant markets include software and hardware products , which the policy options will impact to a different extent . Due to the absence of a consistent and comparable publicly available dataset on the dimension of the market for products with digital elements , certain proxy indicators have been used to asses s the value of the relevant markets. The methodology and the market analysis is described in more detai l in Annex 3 . The analysis includes the value produced by both non-EU and EU companies in the EU market, while it was not possible to generate aggregated values for each of these two. Software market Based on the data gathered by a recent study which provided for a breakdown of the software and software-based services market , the following categories can be identified: ( 1) Software products ; (2) Software-related services ; (3) Cloud computing ; (4) Games. The present analysis is focused on software products (including games) and does not explore the specific markets related to software services and cloud . This is because the latter would not be included in the scope of a potential horizontal regulation (policy options 3 and 4), since only products (and hence software as a product) would be included in the scope and not services. The proxy indicator used to assess the dimension of the software market is based on a subset of NACE 2 activities of the Information and Communication sector (see Annex 3 ). The proxy indicates that , in 2019, the production value of the EU-27 software development amounted to over EUR 236 billion . During the same year, the sector recorded a turnover of EUR 265 billion with a total number of enterprises of 365 759. In terms of number of companies, the software industry is almost entirely composed of SMEs . W hereas the total number of enterprises for the selected sample amounted to 341 781 in 2019, the number of SMEs operating in the software market in the same year reached 340 918, accounting for 99.7 % of the total. However, when looking at the turnover generated by SMEs in the software market for sample countries, it accounts for 41 % of the EUR 305 444 billion which shows the important relative weight of big market players that may constitute only 0 . 3 % of enterprises in the market but generate 59 % of revenue. When referring to turnover, it is difficult to assess the share of the revenues related to B2C and B2B . Nevertheless, by looking at the German software market, it is possible to highlight that those revenues from software sales rely heavily on B2B with 67.9 % of revenue being driven from business. This split shows a high integration of the software market with other economic sectors that rely on software for their operations. The size of embedded software is valued at EUR 2.4 billion in 2020 and is expected to continue growing at a compound annual growth r ate ( CAGR ) of 5.5 % from 2021 to 2027. N on-embedded software represents the biggest part of the industry’s sales . Globally, the r evenue in the s oftware market is projected to reach USD 608.70 billion in 2022 , with nearly half of the revenue generated in the United States . Most competitive software companies are from the United States followed by Asia. According to McKinsey, in 2020, t here was no European company on the list of the world’s ten most valuable software and software-enabled companies, and were only three among the top 20. Furthermore, over a third of the 100 most valuable companies in the United States came from the software sector, as did about a quarter of th ose in Asia. In Europe, that figure stood at just 7 %. Hardware market T o estimate the value of the hardware market, several proxies were explored based on Eurostat data in the study accompanying the impact assessment : the ICT manufacturing sector – standard classification (ICT-SC) and the extended classification (ICT-EX T -ADJ) . The latter covers more manufacturing sectors than those which are ‘purely’ digital. The estimates based only on the ICT manufacturing sector are under the real values of all products with digital elements placed on the Union market. At the same time, the estimates based on the extended classification are likely over the real value: The adjustment indicators used to estimate the weight of products with digital elements as compared to non- products with digital elements within the same category are an overestimation, since the proxy used for this adjustment considered the digital intensity of the manufacturing sub-sectors, which does not necessarily match the production of digital goods ( see Annex 3 ). In 2019, the production value of the EU-27 ICT-SC amounted to EUR 222 billion . During the same year, the sector recorded a turnover of EUR 285 billion with a total number of enterprises of 22 773. When considering the ICT-EXT-ADJ indicator, the production value of the EU-27 amounted to EUR 1 081 billion, the turnover to EUR 1 220 billion and the total number of enterprises of 249 513 in 2019. As mentioned above, this would most likely be a n overestimation. The European ICT-SC manufacturing industry is almost entirely composed of SMEs. W hereas the total number of enterprises amounted to 22 773 in 2019, the number of SMEs operating in the hardware market in the same year reached 22 119, accounting for 97.13 % of the total. However, when looking at the turnover generated by SMEs in the hardware market, it accounts for 21.9 % of the global turnover which shows the very important weight of larger companies that may constitute only 2.87 % of enterprises in the market but generate 78.1 % of revenue . The weight of the ICT manufacturing on the overall European economy was stable over the past five years and still appears to be limited, amounting to 0.41 % in 2019. When referring to turnover, it is difficult to assess the share of the revenues related to B2C and B2B . Nevertheless, by looking at the German hardware market, it is possible to highlight that revenues from hardware sales were equally split between the B2B (48.1 %) and B2C (51.9 %) sectors in 2018. The reason behind this split is the strong consumer business stream connected to the sale of smartphones, laptops and general consumer electronics. This represents an important distinction with the software and services market where the B2B component appears to be predominant, accounting for more than two-thirds of the overall sales. Total market value The global market for products with digital elements encompassing software and hardware has a total production value in Europe of EUR 458 billion and turnover of EUR 550 billion in 2019 , if the hardware market is considered as only including the elements of the ICT-SC indicator. The number of enterprises operating in this sector is 388 532 , when considering the limited scope of ICT-SC, with a vast majority being SMEs (99.58%) . Considering the extended classification (ICT-EXT-ADJ), these values are up to EUR 1317 billion in production value and EUR 14 85 billion in turnover for 2019. The number of enterprises in this sector is 615 272 , with a vast majority being SMEs (99.58%). These estimates however may be overestimated since they rely on proxies of digital intensity and not production of digital goods per se. Based on this data, under both indicators, SMEs account for about 34.4 % of the turnover generated in the market for products with digital elements for 2019. Aggregated indicators for the global market for products with digital elements in 2019 can be found in Annex 3 . Baseline scenario The baseline scenario entails no common (i.e. horizontal) legislation to set cybersecurity req uirements for products with digital elements . As referred to in sections 1 and 2.2.2 ., t he current EU framework applicable to products comprises several pieces of legislation that cover only certain aspects linked to the cybersecurity of tangible products with digital elements and, where applicable, embedded software concerning these products . This legislative framework was not conceived to tackle specifically the challenges linked to cybersecurity of products with digital elements . It largely covers requirements for placing the products on the market, but not necessarily for the whole life cycle of products, which is crucial in the case of products with digital elements . The current legislation also fails to cover a variety of widely used hardware . Moreover, non-embedded software is not currently addressed despite the major impact resulting from insecure non-embedded software . for a detailed gap analysis, see Annex 13 . As a significant first step towards increasing the level of cybersecurity of wireless devices, the delegated act under RED , adopted in October 2021, aims to improve the cybersecurity of these devices on the European market by laying down new general requirements which manufacturers will have to follow in the design and production of the concerned products, constitutes. N on-embedded software is however not covered by these requirements . Furthermore, t he act does not provide for duty of care for the whole life cycle of these products . It can be assumed that, given the pace, spread and importance of digitization for all sectors of economy, any new product-related legislation in the NLF would include certain cybersecurity-related aspects. However, these would be product- and/or sector-specific and therefore would not be able to address cybersecurity risks in a targeted and comprehensive way. Leaving the integration of cybersecurity-related requirements only for certain product legislation would leave other categories of products not covered by such measures and possibly raise the risk of different and even diverging requirements stemming from separate pieces of legislation. This would lead to a fragmented regulatory landscape, potential discrimination and legal uncertainty , affecting the well-functioning of the internal market . Maintaining this status quo would therefore mean that cybersecurity would remain only partially addressed in product-related legislation, while existing horizontal cybersecurity legislation, such as the NIS framework or the Cybersecurity Act, would not provide for the means to establish cybersecurity requirements for products with digital elements . In the scenario of maintaining the status quo, the development of European voluntary cybersecurity certifications schemes would continue as foreseen, based on the Cybersecurity Act, implying a voluntary conformity assessment . Manufacturers do not have a legal obligation to seek certification for their products . The proposal for the NIS2 Directive expected to enter into force before the end of 2022, with a transposition period of 21 months, provides for an empowerment for the Commission to adopt delegated acts specifying categories of essential entities shall be required to obtain a certificate under a European certification scheme. However, this would rather cover a limited category of products used in particular sectors and would therefore not be sufficient to address systematic cybersecurity-related issues of all products with digital element s , as described in section 2 . Other voluntary national practices and measures would continue, such as voluntary labelling measures of certain categories of products, as it is currently the case in few Member States. This can raise the risk of further fragmenting the internal market. Finally, maintaining the status quo would entail no specific soft law or regulation at EU level as regards cybersecurity of standalone software. At national level , Member States may develop targeted initiatives within the boundaries of European law to better pro tect their consumers. For example, Member States could put in place diverging security and transparency obligations for operating systems or virtual private network software, which is becoming increasingly popular since the beginning of pandemic. In absence of harmonised rules, users, such as critical infrastructures obligated under the revised NIS Directive to take their supply chain security more seriously, may start putting in place diverging contractual requirements for manufacturers of products with digital element s. At global level , it can be assumed that the security of supply chain measures taken recently, in particular in the United States of America (notably mandatory measures for critical software under public procurement) and the UK (notably security requirements of consumer IoT), as well as potentially further similar measures, would influence the playing field for European manufacturers present on global markets, potentially putting them at a disadvantage. A horizontal European regulation in this regard would be the most comprehensive to be introduced world-wide, creating legal certainty and getting Europe to set the path forward for cybersecurity in products with digital elements at global level. As described in section 2.4 , s ome problem drivers may diminish in the future. The labour market may for example provide more qualified security professionals, either as a result of market forces or due to government intervention . A wareness raising campaigns and adapted school curricula may also lead to users become more aware of cybersecurity risks and more proficient in using producta with digital element s securely. Additional international standards on products and processes may also emerge, helping manufacturers improve the design and development of products with digital element s. Description of the policy options The policy options analysed range from the least interventionist and closer to the baseline scenario (option 1 – soft law approach and voluntary measures) , through a lighter option that could entail certain legislative interventions on a case-by-case basis (option 2 – ad-hoc regulatory intervention) , up to the most interventionist (options 3 and 4 – horizontal regulation on cybersecurity), with option 4 varying in relation to scope (option 4 b) having the most comprehensive scope, all products with digital elements , covering also non-embedded software). Both policy options 3 and 4 also vary in relation to the level of conformity assessment (with and without mandatory third-party assessment). Furthermore, the various options analysed took account of the extent to which various measures, vertical or horizontal, or combination thereof could address the type of cybersecurity risks the products with digital elements are exposed to and the problems identified and their drivers. Policy options 3 and 4 are based on the New Legislative Framework (NLF) . The NLF places obligations on manufacturers and their authorised representatives as well as on importers and distributors. A detailed description of the NLF can be found i n Annex 11 . T he NLF is primarily a framework placing obligations on economic operators, as the aforementioned types of entities. As a result, it is not foreseen to place obligations on users, such as consumers as well as companies or other types of organisations. Departing from the status quo, the following options are therefore considered in view of the specific objectives to be achieved as set out in section 4.2 above. Option 1: Soft law approach and voluntary measures In this option, there would be no mandatory regulatory intervention. Instead, the Commission would issue communications, guidance , recommendations and potentially code s of conduct to encourage voluntary measures (self regulation) , including potentially on non-embedded software , and provide guidance to support supply-side stakeholders to enhance the digital security of their products. These guidelines or recommendations could consider the elements that are referred to in options 3 and 4 below under the potential cybersecurity requirements. Such recommendations or guidelines could also be limited only to the public procurement of products with digital elements , given existing practices of public procurement which oftentimes include security-related considerations, such as due diligence in respect of cybersecurity when procuring certain products with digital elements in certain sectors or by certain agencies. Recommendations for public procurement may also ultimately have broader effects beyond strictly the public procurement framework and be also considered in private procurement a good practices. At the same time, it would be expected for t he Union Rolling Work Programme for European cybersecurity certification , on the basis of Article 47(5) of the Cybersecurity Act, to consider the development of additional European cybersecurity certification schemes that would cover more categories of products for which cybersecurity is currently not being properly addressed , such as industrial IoT . These schemes would remain voluntary, unless otherwise decided via a delegated act for particular categories of products used in particular sectors through the empowerment provided to the Commission on the basis of the NIS2 Directive , once it enters into force . National schemes (e.g. labelling) , voluntary or mandatory, would continue to be developed to compensate for the lack of EU horizontal rules. Option 2: Ad-hoc regulatory intervention for cybersecurity of tangible products with digital elements and respective embedded software This option would entail an ad-hoc product-specific regulatory intervention that would be limited to adding and/or amending the cybersecurity requirements in the already existing legislation or introducing new legislation as new risks emerge, including potentially on non-embedded software. A number of legislative initiatives or reviews are currently being prepared or negotiated with a view to integrate more broadly digitization and the development of new technologies, with a tendency to cover certain cybersecurity aspects, either through a safety angle (see the general product safety framework) or more specifically to certain technologies or products (e.g. AI). A scenario where this approach would be continued , in the absen ce of a horizontal intervention , can therefore be considered realistic. More specifically, For existing NLF legislation , it would entail: c ase-by-case analyses that may lead to legislative amendments ( gradually or at once ) in relation to those products that have a digital element, but for which the existing legislation does not foresee any cybersecurity requirements. b ased on a case-by-case analysis, consider amendments to legislation already containing certain cybersecurity requirements, to the extent necessary , to include more specific or targeted cybersecurity requirements, including where applicable in relation to embedded software. This could a possible amendment of the RED Directive in order to equally extend the scope of the RED delegated act and to include non-embedded software as well as a duty of care obligation for the whole life cycle of the product . For future NLF legislation , it would entail: c ybersecurity requirements to be introduced when new product (NLF) legislation is developed and cybersecurity relevant. For ‘old approach’ product legislation , it would entail: Where necessary and where the basic acts allows, introducing amendments, in particular for empowerments on complementing or further specifying cybersecurity requirements via delegated or implementing acts. Note: The next two options (3 and 4) entail a horizontal regulatory intervention varying in scope, largely following the NLF approach . This framework typically sets essential requirements as a condition for the placement of certain products on the internal market. These requirements are objective - oriented, followed at a later stage by harmonised standards developed by standardisation bodies , which elaborate on the technical means through which the requirements could be met. More information on standards can be found in Annex 14. NLF legislation also typically provides for conformity assessment , which is the process conducted by the manufacturer to demonstrat e whether the essential requirements relating to a product or process have been fulfilled. C onformity assessment procedures are composed of conformity assessment modules defined by the NLF , ranging from self-assessment by the manufacturer up to the assessment in certain circumstances , or in consideration of certain risks , by independent third parties. The latter are known generally as conformity assessment bodies, or more formally as ‘notified bodies’ . Member States have the responsibility to decide which of their conformity assessment bodies fulfil the necessary criteria to become notified. This may happen through an accreditation process. Accreditation is a formal system which provides an independent attestation of the competence, impartiality and integrity of conformity assessment bodies. The NLF framewo rk also typically provides for EU market surveillance , which is under the responsibility of the Member States. For more details, see Annex 11. Option 3: Mixed approach, including horizontal mandatory rules for cybersecurity of tangible products with digital elements and respective embedded software and a staggered approach for non-embedded software This option would entail a regulation introducing horizontal cybersecurity requirements for all tangible products with digital elements and the software embedded within these, as a condition for placement on the market . N on-embedded software would not be regulated. Given its relatively broad scope and since the policy option proposes both security requirements as well as transparency requirements , policy option 3 addresses all four problem drivers as far as hardware products and their embedded software is concerned. Obligations would apply to manufacturers and to a lesser extent to also to distributors (such as online shops or brick and mortar stores) as well as to importers. The main building blocks of the regulatory intervention under this option would be as follows: Scope: all tangible products with digital elements , i.e. hardware (e.g. end devices such as: laptops, smartphones, sensors and cameras; smart robots; smart cards; smart meters; mobile devices; smart speakers or networks, such as: routers; switches) the respective embedded software associated with these products , meaning firmware or other software that is essential for the function of the end-product (e.g. operating systems; network system; storage and security management, etc.). It will not cover non-embedded software , meaning software that is additional to the function of the device on which it is downloaded (e.g. extended operating system, mobile apps). Instead, a staggered approach would be considered , with soft law measures such as guidelines or recommendations taken as a first step, potentially followed by horizontal regulatory intervention, depending on the results of implementing such measures . The reason is that tra di tionally non-embedded software is not covered by existing product legislation within the NLF and therefore an intermediary period could be considered via soft law measures to test the potential uptake by the relevant software manufacturers . The rationale of analysing an option not covering non-embedded software in the scope is as follows: (i) it corresponds to the current NLF legislation, which covers as a rule tangible products and at most their embedded software and (ii) it is an option suggested by certain stakeholders on the grounds that more judicious consideration is necessary before imposing cybersecurity requirements on non-embedded software due to its intangible nature. The definition of “ product with digital elements ” would specify that “ products with digital elements ” refer to both hardware and software as well as hardware and software components placed on the market separately. Requirements and obligations: In terms of cybersecurity requirements and obligations for economic operators , it would mandate that tangible products with digital elements and their embedded software shall only be made available on the market if, where dully supplied, properly installed, maintained and used for their intended purpose or under conditions which can be reasonably foreseen, they meet the specific cybersecurity requirements. While manufacturers would be required to comply with the requirements, they would not be held accountable for how the product will be used . Natur e of the requirements : These requirements would be objective-oriented, technology-neutral and future proof against a fast - evolving product and technology landscape. They would not be sector or product-specific. In terms of granularity, they would not be too prescriptive as they would be applicable to a wide category of products, yet more specific than a very generic principle that would only require that products are cyber secure or protected. Content of the requirements : The requirements would mandate manufacturers to factor in cybersecurity in the design and development of the products with digital elements , to exercise due diligence on security aspects when design ing and developing their products, to be transparent on cybersecurity aspects that need to be made known to customers and to ensure security support (updates) in a proportionate way . More specifically, manufacturers would mainly be mandated to: Design and develop these products in consideration of the risk posed to the security of network and information systems. Design and develop these products in such a way that they provide adequate resilience against security threats, ensure that the products can be used securely and ensure protection of stored, transmitted or otherwise processed data and that security is taken into account, as applicable, in all phases of the design, develop ment and production process . Put in place design and development solutions for the product , i.e. se curity by design and by default mechanisms , to deliver with a secure by default configuration ; capabilities to perform or support integrity checks; authentication and access control mechanisms ; guarantees for protection of the exposed attack surfaces; protection against degradation or denial of service attacks; ways for enabling adequate security updates and ensure that adequate security support can be received . In addition to the product-related security requirements described above, h ave in place vulnerability management , vulnerability disclosure policies and testing . In addition, t o ensure the effective functioning and security of the internal market and awareness of cybersecurity risks by relevant authorities and bodies, manufacturer s should report vulnerabilities that are being actively exploited and any incident having an impact on the cybersecurity of these products to the EU agency for cybersecurity, ENISA . Based on the received information, ENISA should prepare intelligence on emerging trends regarding cybersecurity risks in products with digital elements to the national competent authorities and the European Commission, e.g . in the NIS Cooperation Group, as well as provid e advice to support the implementation process of this Regulation. These requirements derive from the overall objective of ensuring a high level of cybersecurity of products with digital elements . They take account of well-settled practices in terms of cybersecurity of products, factoring in the security objectives that the Cybersecurity Act establishes, as well as existing international standards for certain specific products , such as the ETSI standards for IoT consumer products . The above-mentioned requirements are inter-dependent and complementary to each other , ensur ing as a whole that the respective product would be secure. For example, for certain risks and intended use cases it may be appropriate to integrate an authentication mechanism into a device to prevent unauthorised access and data theft (requirement " protection from unauthorised access by appropriate control mechanisms "). For this requirement to be effective, it is essential that other requirements are fulfilled as well: f or instance, if the device is shipped with a widely-known default password , a malicious actor could access the data despite an adequate authentication mechanism being in place. The device should therefore not be shipped with any default password , but instead require users to select a strong custom password upon first use (requirement " delivered with a secure by default configuration "). In addition to the above-mentioned requirements concerning the products as such, o bligations would be set up for economic operators, starting from manufacturers, up to distributors and importers, in relation to the placement on the market of the tangible products with digital elements and their embedded software, as adequate for their role and responsibilities on the supply chain . These obligations would mainly be: Transparency-related , including in terms of information made available to end users, keeping records or disclosure of information concerning the components of a product, ensuring duty of care , vulnerability disclosure. Making available technical documentation . Providing information and guidance to users on cybersecurity aspects. Who should respect the se obligations? When placing any product with digital elements on the market, manufacturers would be required to ensure that it has been designed, developed and pro duced in accordance with the essential cybersecurity requirements set out by the regulation. This would apply no matter whether the product is for end users or embedded in a final product. For tangible products with digital elements and software embedded in such products that is essential for the functions of these products, the responsibility for the compliance with the essential cybersecurity requirements would pertain to the manufacturer of the whole product. The essential cybersecurity requirements would be followed by a standardisation mandate for the standardisation bodies to develop harmonised standards which would set out the technical specifications, some product or sector-specific, by which compliance with the requirements could be ensured. The regulation setting out the horizontal requirements would not provide for liability rules. These are set out by the general EU product liability framework (currently under review) which sets out liability rules for defective products so that consumers can claim compensation for damage caused by defective products. The Product Liability Directive establishes the principle that the manufacturer of a product is liable for damages caused by a defect in their product irrespective of fault (“strict liability”). It defines the conditions that allow injured parties to seek redress from injuries or damage to personal property caused by defective products marketed within the EU. Whole life cycle: As regards market placement coverage, the whole life cycle of the products with digital elements would be considered, and in particular obligations for manufacturers to provide information about the end-of-life of the products and the security support provided, as well as obligations to provide security updates and support for a reasonable period of time (e.g. average of five years) , while ensuring proportionality . This approach would be compatible with the EU framework on liability for defective products , now undergoing review, which, among others, aims to take into account the dynamics and seriousness of cybersecurity threats and which is expected to introduce liability for situations when damages are triggered by vulnerabilities . The liability of an economic operator may be reduced or disallowed when, having regard to all the circumstances, the damage is caused both by a defect in the product and by the fault of the injured person [including, for example, rejecting a software security update] or any person for whom the injured person is responsible . In the absence of corresponding horizontal regulation setting out post-market placement security obligations on manufacturers, the leverage of the future product liability framework (currently under review) on the manufactures who may be held liab le for damages caused by lack of cybersecurity measures would be more limited. For example, absent specific cybersecurity requirements that manufacturers must comply with in relation to their products with digital elements , there will be more limited ways to successfully trigger liability for damages caused by cybersecurity-related defects of such products . Conformity assessment: Different sub-options may be considered with regard to the conformity assessment procedures : Sub-option 3 i) No risk categorisation and self-assessment of conformity by manufacturer only, while manufacturers may voluntarily opt for a third-party conformity assessment when deemed appropriate. Sub-option 3 ii) Two risk categories : by default : self-assessment , and critical products : third-party conformity assessment prescribed for certain categories of products under a risk-based approach . The categories would be explicitly listed in the horizontal regulation, with the possibility to be updated based on a delegated act empowerment and could include, for example, products such as critical software, products that serve as safety components, industrial IoT and industrial control systems. They would t ak e account of factors such as intended use or functionality : based on cybersecurity functionality, software products that have security-critical functions or pose similar significant potential for harm if compromised ; based on intended or reasonably foreseeable use or potential risk of physical harm : products with digital elements intended to be used in a sensitive environment, including in critical infrastructures or in an industrial setting . In addition, a n empowerment for delegated acts would be considered for the Commission to specify, based on established criticality criteria in the basic act, the categories of products for which certification , on the basis of EU cybersecurity certification schemes established by the Cybersecurity Act would be required. See table in Annex 12 illustrating the two-level risk categories for the conformity assessment . Even if not mandatory, E U cybersecurity c ertification schemes would also continue to be used based on the Cybersecurity Act and, where applicable, could be used as evidence to demonstrate compliance with the essential requirements. It would rather be expected however for the planned new European cybersecurity certification schemes regarding products with digital elements to be more limited in this option than in the status quo or in option 1 or 2. Where compliance of the product with the applicable essential requirements has been demonstrated, either via self-assessment modules or by a third party, manufacturers would draw up an EU declaration of conformity and affix the CE marking. Interplay with other product-related legislation (notably NLF) : The horizontal cybersecurity requirements in this option would come to complement and co-exist with existing product-related legislation. The horizontal cybersecurity rules would establish non-product - specific essential cybersecurity requirements that would be considered a baseline for all products with digital elements . If justified by the particularities of certain products and if the horizontal rules , and the harmonised standards to be developed on this basis , would not suffice, additional product-specific requirements could still be established by dedicated legislation. Furthermore, f or certain specific NLF legislation, such as the proposed Machinery Regulation , where certain product-specific cybersecurity requirements are already covered for safety components, the horizontal cybersecurity requirements could include provisions to stipulate that those particular requirements would take precedence. Overall, the act setting out the horizontal cybersecurity requirements would set out a rule of lex specialis, specifying that w here, for a certain category of products with digital elements , the cybersecurity risks addressed by the essential requirements are covered by other more specific requirements of other Union harmonisation legislation, these horizontal cybersecurity requirements shall not apply to those products to the extent that the specific Union legislation in question sufficiently covers such risks , achieving the same level of protection as the horizontal requirements . In some cases, where the Union legislation in question contains requirements adapted to the sector - specific needs, including on software and general obligations on manufacturers, covering the whole life cycle of products, as well as conformity assessment procedures , the act setting horizontal requirements could exclude those products from its scope. This c ould be the case for Union legislation regulating medical devic es , certified aeronautical equipment or potentially motor vehicles . Even in those cases, the horizontal requirements would still apply to certain components of those products and eventually ensure a high level of security of the supply chain. The relationship of policy option 4 with existing vertical cybersecurity regulation. The example of cars. UN Regulation No 155 requires manufacturers to take a number of product- and process-related cybersecurity measures that are very similar to the requirements in policy options 3 and 4. Amongst others, manufacturers must perform an exhaustive risk assessment (that considers interactions with any external systems) and protect the vehicle type against risks. Manufacturers must also put in place a Cybersecurity Management System (CSMS) covering the whole life cycle of the vehicle. The CSMS must manage dependencies that may exist with contracted suppliers, service providers or manufacturers' sub-organizations, ensuring security throughout the supply chain. Those suppliers are not directly covered by UN Regulation No 155 but would be subject to the h orizontal requirements for hardware and software under policy option 4 . Therefore, it will be easier for vehicle manufacturers to manage their dependencies, as the components would carry the CE marking probing compliance with cyber-security requirements. Under UN Regulation No 15 5 , the car manufacturer must also take measures to secure dedicated environments on the vehicle type for the storage and execution of aftermarket software (such as software media players) and perform testing to verify the effectiveness of the measures. S uch aftermarket products are not covered by the UN Regulation, but would be covered by policy option 4 . This would contribute to increasing the security of motor vehicles. Of all NLF legislation, the case of the RED Delegated Regulation requires particular attention, because this delegated act covers three general essential cybersecurity -related requirements for a big category of tangible products with digital elements (wireless hardware products) that would be also covered by the horizontal cybersecurity requirements. More specifically, the relevant RED Delegated Regulation establishes the following three essential requirements for inter-connected radio equipment: (i) ensure network protection; (ii) ensure safeguards for the protection of personal data and privacy, (iii) ensure protection from fraud. A standardisation mandate is now being prepared, with standards likely to be developed within 2-3 years. The RED Delegated Regulation shall apply from 30 months after its entry into force. In this option, the horizontal cybersecurity requirements would be more specific and granular than the general requirements set out in the RED Delegated Regulation for all wireless products . The RED delegated act would then be implemented until the horizontal cybersecurity requirements would start applying. From that moment , the cybersecurity require ments of the RED Delegated Regulation would become obsolete. A less optimal a lternative would be to consider that compliance with the horizontal cybersecurity requirements could be presumed compliance with the cybersecurity requirements of RED delegated act. Furthermore, when preparing the standardisation request for the horizontal cybersecurity requirements, it must be ensured that the standardisation work done with the respective RED Delegated Regulation is preserved and complemented only where needed. See Annex 9 for a detailed overview of the interplay with product legislation. Option 4: A horizontal regulatory intervention introducing cybersecurity requirements for a broad scope of tangible and non-tangible products with digital elements , including non-embedded software. This option differs from option 3 only as regards the scope , as it would include non-embedded software (critical or all) in the scope of a potential regulation. Some particular elements of the regulatory intervention may however be impacted differently as compared to option 3 as a result of the differences in scope, as highlighted below. Scope: A ll products with digital elements , including non-embedded (standalone) software would be covered. Alternative sub-options could be considered regarding the categories of software to be covered : Sub-option 4 a) would cover only critical software : c ritical software, such as operating systems or web browsers, would be defined as the software which has security-critical functions or which poses similar significant potential for harm if compromised. In particular, any software that has direct software dependencies upon one or more components with at least one of these attributes: (i) is designed to run with elevated privilege or manage privileges; (ii) has direct or privileged access to networking or computing resources; (iii) is designed to control access to data or operational technologies ; (iv) performs a function critical to trust ; (v) operates outside of normal trust boundaries with privileged access. Crit ical software as defined above is estimate d at approximate ly 10% out of total software market. Furthermore, cybersecurity measures for critical software were also implemented in the Unites States of America, where the mandatory cybersecurity measures imposed concerned only critical software subject to public procurement, all other measures remaining voluntary (see Annex 6 ) . Sub-option 4 b) all software : This would reflect the fact that all types of software products contain vulnerabilities and that even software considered as low risk can serve as a stepping stone to breach a network with a view to penetrating more critical systems at a later stage of an attack chain. In addition, it is often difficult to assess the risk associated with a product before its placing on the market, as the risk to society often increased with a growing market share. Requirements and obligations: Horizontal essential cybersecurity requirements and corresponding obligations for operators as described above in option 3 , including reporting of exploited vulnerabilit i es and cybersecurity incidents to ENISA , would be set out for all products with digital elements , including non-embedded software. For user-installed software [operating systems – except when the operator system is developed by the device manufacturer – and applications] and in general for non-embedded software, the responsibility for the compliance with the essential requirements would pertain to the software manufacturer . Whole life cycle: As regards market placement coverage, as in option 3, duty of care for whole life cycle would be provided for. This option would be even more fine-tune d than option 3 with the upcoming new EU framework for liability for defective products, considering that the latter also aims to extend liability explicitly for software. Conformity assessment: The same two sub-options as in option 3 would be considered with regard to the c onformity assessment procedures, corresponding respectively to sub-options 4 a) i) no risk categorisation, 4 a) ii) with risk categorisation, 4 b) i ) no risk categorisation, and 4 b) ii) with risk categorisation. Interplay with other product-related legislation (notably NLF) : The interplay would be the same as set out in option 3 above (see also for more details Annex 8). On the specific interplay with the RED Delegated Regulation, Annex 7 illustrates the particular differences between the two acts. In this option, the horizontal cybersecurity requirements would address even more than in option 3 the existing gaps in what the RED delegated act covers, since they would also address standalone software. In this option, the planning of future European cybersecurity certification schemes would be more impacted than in option 3 , considering that, due to the comprehensive scope, there would be much less regulatory gaps to fill in with certification in addition to what the horizontal requirements would require. However, new European cybersecurity certification schemes could emerge for products with digital elements requiring additional assurance. How would the horizontal cybersecurity requirements set for the broadest scope in option 4 work in practice? The example of smart phones . Smart phones would be included in the scope of the horizontal regulation (policy options 3 and 4), as they are connected hardware devices with a built-in computational logic. Under policy option 4, manufacturers of such devices would be required to implement security requirements, undergo a conformity assessment and affix the CE marking. A smart phone consists of a large number of hardware components, such as CPUs, wireless modems, Wi-Fi chipsets or Bluetooth interfaces, which the manufacturer must acquire from other semiconductor manufacturers . Furthermore, these hardware components function thanks to firmware (i.e. embedded software that provides low-level control of the components). Therefore, in addition to the manufacturer of the smart phone, the manufacturers of these hardware components and the software manufacturers of the firmware would also be covered under the scope of a horizontal regulatory intervention (both under policy option 3 and 4). Smart phones are also usually shipped with an operating system (non-embedded software). The smartphone manufacturer would also need to ensure the security of the operating system. In cases where the manufacturer is also the manufacturer of the operating system, the security requirements that the manufacturer is required to implement would not only cover the hardware device, but would also extend to the software. In cases where the operating system is provided by a third party, the manufacturer would need to check the CE marking affixed to the operating system to make sure that it has been developed in line with the requirements. The manufacturer of the operating system would equally be subject to such an obligation in relation to the various software components integrated during development. Consumers and business users, and in particular companies that are subject to supply chain security obligations could rely on the CE marking as an indicator that not only the manufacturer of the final product has taken cybersecurity seriously during the development process, but also that all hardware and software components inside the product have been developed factoring-in security. Options discarded at an early stage In addition to the four options presented in section 5.2 , in the analysis of potential policy options that could address the problems described in section 2 and reach the general and specific objectives set out in section 4 , a number of options or sub-options, notably in relation to alternatives entailing regulatory interventions, were discarded at an early stage and therefore not assessed in further detail, as follows: As regards the choice of legal instrument , the options consisting of a regulatory intervention (notably options 3 and 4) would entail the adoption of a regulation and not a directive . This is because, for this particular type of product legislation, a regulation would more effectively address the problems identified in section 2 and meet the objectives formulated in section 4 , since it is an intervention that is conditioning the placing on the internal market of a very wide category of products. The transposition process in the case of a directive for such intervention could leave too much room for discretion at national level, potentially leading to lack of uniformity of certain cybersecurity requirements, legal uncertainty, further fragmentation or even discriminatory situations cross-border, even more taking account of the fact that the products covered could be of multiple purpose or use and that manufacturers can produce multiple categories of such products . As regards the scope of potential regulatory interventions in options 3 and 4 : Excluding the wireless products covered by the RED delegated act from the scope of the regulatory interventions envisaged in options 3 and 4 was not considered a valid sub-option. This is because the essential requirements set out in the RED delegated act are of generic nature, while covering a wide category of products (inter-connected radio equipment) that represent an important part of the overall scope considered for the horizontal cybersecurity regulatory intervention in options 3 and 4. The essential requirements in the RED delegated act alone would not sufficiently address the problems identified, as described in section 2 , nor would they be sufficient to effectively meet the objectives set out in section 4 . Furthermore, aspects such as duty of care or whole life cycle are not covered by the RED delegated act . Before new horizontal cybersecurity rules would start applying, important progress would have been achieved with the implementation of the RED delegated act, including preparation of standards, which would also take account of the proposal for a horizontal regulation. A smooth sequencing between the two acts would then be ensured , without generating overlapping or unnecessary burden on the relevant economic operators concerned by such obligations. In relation to the horizontal cybersecurity requirements envisaged in options 3 and 4, the sub-option of differentiating such requirements per category of risks was discarded at an early stage. This is because such sub-option would have been unrealistic, given that the requirements would in any case be objective-oriented and aim at setting basic requirements for introducing security by design and by default, ensuring transparency, duty of care throughout whole life cycle. These would be baseline requirements that all products with digital elements should have in place irrespective of their functionalities or intended use. The differentiation per categories of risk would rather have relevance for informing the strictness with which compliance with the requirements is assessed. It can only be reflected in more sector- or product-specific standards. As regards still the horizontal cybersecurity requirements envisaged in options 3 and 4, the sub-option of differentiating such requirements between Business to Client ( B2C ) and Business to Business ( B2B ) was discarded at an early stage. This is because essential cybersecurity requirements as those that would be set out through a horizontal regulatory intervention would be objective-oriented, hence the same irrespective of the use case, with the aim to ensure that security is factored in since the design and the development of the respective products. These would therefore not differ depending on the user. Furthermore, many products with digital elements are used in both settings. As regards the duty of care throughout the life cycle of products with digital elements , the potential legislative interventions analysed did not consider the alternative of not covering whole life cycle at all as a valid option. This type of coverage is coherent with other current legislative reviews considered, such as the EU product liability framework , and is also determined by the very nature of the requirements considered, i.e. in cybersecurity the updates are a necessity, therefore any alternative where no obligation concerning the life cycle would have been considered would not have been realistic. Furthermore, the coverage of whole life cycle is one of the aspects regarding a horizontal cybersecurity intervention for products with digital elements where the vast majority of stake holders concur . As regards market surveillance, policy options 2, 3 and 4 would plug into the New Legislative Framework. Market surveillance would therefore be based on an existing and well-established concept. As a result, governance rules for market surveillance authorities going beyond the standard NLF provisions leaving discretion to Member States on how they organise themselves was not considered as a realistic option for a first-time market intervention of this breadth . What are the impacts of the policy options? Overview of i mpacts o n businesses, public authorities and consumers To the extent possible, specific and aggregated quantitative estimates have bee n elaborate d for the different sources of costs and benefits . However, the ability to develop such quantitative estimates was limited by different factors, such as the multitude of specific product markets covered by the initiative and the ability to define at granular level the markets in the scope of the different policy options. Where possible, estimates and assumptions were made. D ifferent methodologies were used for the quantification of costs and benefits that will be indicated in the relevant sections . Furthermore, t he quantitative analysis of costs and benefit s uses in a consistent way for the aggregation several key assumptions that are further explained in Annex 4 : Estimation of number of products : To estimate the number of products with digital elements on the market, the assumption of one product per manufacturer was used. T he indicator extended classification (ICT-EXT-ADJ , see section 5.1. and Annex 3 ) for hardware was used. C ombined with the indicator for software (SD), 615 272 manufacturers /products are counted on a market that is valued in total at up to EUR 1 485 billion in turnover . While it is an underestimation to count one product with digital elements per manufacturer , as large companies might develop hundreds of products, it is compensated to some extent by the choice of using a broad indicator for the hardware market . Furthermore, the aggragted estimations have been made based on the assumption that all products currently on the market would be impacted, while under policy option 3 and 4, costs would actually occur for new products being placed on the market. Business as usual (BaU) : based on available data, it is estimated that 50 % of manufacturers have a systematic approach to secure product development , while for the rest, it is assumed that they have no security requirements in place. For conformity assessment, the BaU costs are estimated at 40% for hardware manufacturers, and at 25% for software manufacturers. For further background, see Annex 4. Average product development cost s : it is estimated that on average developm e nt costs by product are of 140 000 EUR. For further background, see Annex 4 . For the qualitative assessments of impacts, in order to compare the policy options (and sub-options), a scale from Neutral to +++ has been used (with "+++" indicating the highest impact). The table below present s an overview of the main (direct and indirect) economic, internal market, security, competitiveness, social, environmental and fundamental rights imp acts and stakeholders affected that will be analysed more in detail in the following sections for each polic y option. Affected stakeholder Main impacts Costs Benefits (Direct and indirect) Businesses Software & h ardware manufactures Direct compliance costs (e.g. security requirements; information obligations; documentation; testing ; reporting obligations ) Streamlined requ irements for products with digital elements Reduced cyber incidents (cos ts of reputation) Higher u ptake of products with digital elements in and outside the EU (turnover) Importers of products with digital elements Direct compliance costs (familiarisation ; verification ) H igher u ptake of products with digital elements in and outside the EU (turnover) Reduced cyber incidents (costs of reputation) Distributers of products with digital elements Direct compliance costs (familiarisation ; verification ) Higher u ptake of products with digital elements in and outside the EU (turnover) Reduced cyber incidents (costs of reputation) Businesses as end-users Higher prices of products with digital elements Higher t ransparency on security properties and on secure use of products with digital elements Reduced cyber incidents (costs of handling & reputation) Reduced cyber mitigation costs Reduced compliance costs to meet other EU and national cyber legislation (e.g. NIS) Notified bodies Direct compliance costs (e.g. training and new staff ; accreditation framework ) Increased turnover Streamlined requirements for accreditation related to security of products with digital elements Public authorities Market surveillance authorities (MSAs) Direct compliance costs (e.g. training and new staff) Enforcement costs (e.g. monitoring and inspection) Overall benefit of public interest of ensuring that products with digital elements accessing the internal market are secure Cost savings due to streamlined requirements for market surveillance of products with digital elements Accreditation and notifying authorities Direct compliance costs (e.g. training and new staff) E nforcement costs ( monitoring) Streamlined accreditation and notification requirements Fees from notified bodies Public authorities as end-users Direct compliance costs (e.g. familiarization for public procurement) Higher prices of products with digital elements Transparency on security properties and on secure use of products with digital elements Reduced cyber incidents (costs of handling & reputation) Reduced cyber mitigation costs Reduced compliance costs to meet other EU and national cyber relevant legislation (e.g. NIS) ENISA Direct compliance costs (collect and disseminate information on exploited vulnerabilities) Enhanced transparency on the security of products with digital elements Consumers and citizens Consumers and citizens Higher prices Transparency on security properties and secure use of products with digital elements Enhanced protection of fundamental rights, especially privacy and data protection (reduced data breaches) Table SEQ Table \* ARABIC 2 : Main impacts and stakeholders affected E conomic impacts This section analyse s economic impacts on businesses, SMEs, public authorities and users . Impacts on manufacturers of products with digital elements and other economic operators The impacts in terms of costs and benefits on businesses , including manufacturers, distributors and importers , will stem from , on the one side, compliance costs, and on the other side, increased reduced cyber incidents, reputation, competitiveness and increased uptake of products with digital elements . The impact on SMEs , including as economic operators, is detailed in section 6.3.2 . Analysis of compliance costs Direct compliance costs will impact most significantly software and hardware manufacturers. The overview of the main cost sources is summarised below : Familiarisation wit h the new obligations (one-off): m anufacturer s , distributors and importers covered by the initiative will have to bear adjustment costs to familiarise with the obligations under the new legislation and develop compliance strategies (implementation costs). Secure product development throughout the life cycle (one-off and recurrent), including requirements related to vulnerability handling as well as support and security updates : Adjustment costs would stem from the implementation of security controls and features into the product design and development (one-off and recurrent for checking regularly compliance and implementing updates ) , hiring skilled human resources, and from potential equipment and material costs (e.g. new security software). Security controls and features would also include obligations to communicate and inform end users on the lifespan of the product and provide security support. Information and transparency requirements to end-users on secure product properties and instruction s for use (one-off and recurrent): Adjustment costs would stem from information obligations on the security properties and use of the digital product . Conformity assessment : i nternal product testing/self-assessment , one-off costs , e.g. for the purchase of laboratory and testing equipment for internal testing , and recurrent costs , e.g. for the recalibration of testing equipment and reporting , as well as t hird-party product testing and certification (one-off for the certification fees and recurrent for maintenance of the certification, e.g. regular audits ) . For more background on testing costs, see Box 2 . Other conformity costs and reporting obligations : companies will need to develop a technical documentation and a declaration of conformity, affixing marking on products and report on the conformity of products at the request of authorities as well as reporting of exploited vulnerabilities and incidents to ENISA . Internal systems and procedures need to be put in place to ensure that the technical documents and declaration of conformity are updated regularly. Furthermore, vulnerability and incident reporting requirements will represent both one-off and recurrent costs for businesses (e.g. to set up the reporting systems and to report regularly on events) . Quantitative estimates are provided to the extent possible , and mostly available for policy options 3 and 4 . Due to the limited data available, the provided estimates only represent average and abstract figures. It could not be distinguished between one-off and recurrent co sts . In general, as highlighted by stakeholders , the compliance costs for a company will greatly vary depend ing on : (i) the complexity and size of the product; (ii) the existing security practices of a given company; ( iii ) the environment (B2C vs. B2B), and ( i v) the size of the company. Unless specified, the quantitative estimates expr ess additional compliance costs , taking into account the Business as Usual (BaU) costs . BaU costs captu re existing costs in the absence of any policy measure. Box 1 summarizes the methodological steps, assumptions and limitations. Summary and limitations of methodological approach on quantification of compliance costs In order to estimate the direct compliance costs for businesses, the following steps have been taken: First, t he relevant stakeholders that would be impacted by direct compliance costs have been identified. This include s economic operators subject to direct obligations, i.e. manufacturers (of software and hardware), distributors and importers. The different cost sources that would affect the economic operators were identified and verified through sta ke holder consultations, including the public consultation and targeted workshops and surveys (see Annex 2) . For each cost source, estimates on the product development costs were gathered from primary and secondary sources . The data that could be gathered is limited. O nly one primary source estimation was used for the cost source related to documentation and reporting under policy option 3 and 4 , however this cost estimation could not be verified. Secondary data was used for major cost estimates, such as conformity assessment and secure product development . No cost estimates could be made for a nu mber of costs sources, such as familiarisation with the requirement of the initiative and providing information to users. Where data could be found, average cost estimates for an abstract product unit were made. On this basis, the costs were aggregated for the market in the scope of the relevant policy op tion. The Standard Cost Model could not be applied due to limited data available . In order to aggregate the costs , the number of products with digital elements that would be impacted was estimated , taking into account a general assumption of BaU costs, and multiplying by the average product unit costs . The main product markets were identified, respectively the software and hardware market , based on the ICT-EXT-ADJ and SD market indicator s (see Section 5.1. and Annex 3) , and the scope of the relevant policy option s were delineated to the extent possible. In some cases (e.g. for critical software), assumptions for the market share had to be done due to a lack of granularity of market data. In order to apply the BaU costs, assumptions have been made on the percentage of businesses already implementing the relevant measures , as detailed in Annex 4 . Box SEQ Box \* ARABIC 1 : Overview of methodological steps for the quantitative analysis of compliance costs Policy o ption 1 Given that the measures will be voluntary, under this option only the participating manufacturers would bear possible additional adjustment and administrative costs . As these costs would depend on the engagement of the manufacturers into voluntary initiatives , it is not possible to give aggregated cost estimates. Under policy option 1, there would be no direct compliance costs on importers and distributors. Adjustment costs for manufacturers would stem from implementing security requirements as foresee n in relevant guidelines or recommendations. To estimate the costs of secure product development, secondary data was used, which is the Venson calibration model (further developed in Annex 4 ). According to this academic research, implementing a secure product development life cycle approach, without any requirements in place, would on average add 30.5% of product development costs ( if no comprehensive security measures are in place ) . Administrative costs would be linked to third-party conformity assessment procedure s to be carried out under voluntary EU certification scheme s , and could range between EUR 25 000 to 40 000 per product , according to secondary data . The economic cost impact of option 1 is lik el y to be low on manufacturers, and neutral on distributors and importers . The BaU co sts are expected to be high as the manufacturers participating to voluntary initiatives are likely to be the more security-minded. Furthermore, it can be assumed that those manufacturers participating in such voluntary measures would expect any additional costs to be offset by direct or indirect benefits (e.g. increase their reputation and market share). For this policy option, s takeholders indicated in the public consultation low to medium costs ( on average 2.5 , with 5 being the highest ) with the highest average costs for the compliance with guidelines on public procurement. For communications, guidance and recommend ations, stakeholders indicated on average the cost would be medium . The use of voluntary European cybersecurity certification, on the basis of the Cybersecurity Act, was rated as high by software and hardware manufacturers . Despite being voluntary, business representatives stressed that certification involves costs when it is required by customers . At the same time, the possibility to obtain an EU wide certificate would reduce cost s for those manufacturers that already certify their products or would act as an incentive for those willing to do so . Such certification costs would in any case occur in the status quo as well , therefore the BaU costs would be high . Costs (administrative and adjustment costs) Commission (voluntary) recommendations and guidance Secure product development costs for those manufacturers that decide to apply the measures = + 30.5% of product development costs if no BaU costs, o n average EUR 42 700 for a product unit cost of EUR 140 000. No costs for importers and distributors Additional (voluntary) EU certification schemes Compliance costs for manufacturers that engage in EU certification (ca. EUR 25 000 to 40 000 for certifying a product ) No costs for distributors and importers Total Neutral/+ Table SEQ Table \* ARABIC 3 : Overview of compliance costs on businesses under policy option 1 Policy o ption 2 Under this policy option, direct compliance costs for hardware and software manufacturers (for embedded and possibly non-embedded software) , as well as distributors and importers would stem mainly from the amend ment and addi tion of cybersecurity requirements in already existing and future NLF legislation. Such amendments would address new risks as they emerge, including potentially for non-embedded software. When asked in the public consultation, st akeholders rated o n average the costs of this option as medium to high with 3.36 out of 5 (with 5 indicating very high costs) . Hardware manufacturers rated the costs related to this option higher than software manufacturers (4.06 vs. 3.73 out of 5). In relation to compliance costs, two main situations can be distinguished, depending on whether non-embedded software is brought i nto the scope through amending an NLF legislation or not. If only hardware manufacturers and manufacturers of embedded software would be concerned , the BaU costs for hardware manufacturers are expected to be high. T he amendment of existing NLF legislation would imply, for a given product , adjustment cost s related to the familiarisation and additional securit y and information requirements linked to the lifecycle approach and increased transparency . O ption 2 foresees no specific conformity rules for cybersecurity requirements only. Therefore, minimal extra administrative costs would be foreseen (e.g. mainly updating technical documentation and the declaration of conformity ). Since it would be determined on a case-by-case basis whether amendments are necessary, it was not possible to make general quantitative cost estimations. I f non-embedded software manufacturers are to be covered by any amendment of existing or future NLF legislation, those manufacturer s would bear high compliance costs . The aggregated costs would depend on the specific sector and t he market share of such software. Possible a mendment of RED delegated act/Directive to include non-embedded softw a re : As outlined in the baseline scenario in S ection 5 , if the RED delegated act would be amended to cover non- embedded software , a dditional adjustment and administrative costs would occur only to a limited extent for hardware manufacture rs already subject to the RED delegated act (i.e. mainly related to lifecycle approach) and would mostly occur for non-embedded software manufacturers. Furthermore, distributors and importers would bear additional familiarisation costs. The cost estimation will focus on the costs on manufacturers of non-embedded software into the scope of the RED delegated act . Based on the market analysis data available (see Annex 3 ), the assumption was made that all non-embedded software would be covered by this measure. To estimate the adjustment costs of secure product development, secondary data was used, which is the Venson calibration model that foresees 30.5% additional product development costs if nothing is in place (further explained in Annex 4 ). This leads to 42 700 EUR additional costs for a product unit when considering an average product development cost of EUR 140 000 . Furthermore, the assumption was made that 50% of software manufacturer s already implement secure requirements ( further explained in Annex 4 ). Taking the SD indicator (see market analysis in Section 5 and Annex 3 ) , and assuming one product per software company, the software secure development costs would amount to EUR 7.8 b illio n . While this figure is likely an underestimation for the whole software market (as there are likely more software products), it goes beyond the scope of the measure ( which would cover only wireless products). Software manufacturers would also bear new adjustment and administrative costs related to conformity assessment (self-assessment) and other obligations linked to conformity . Secondary data was used to estimate the average costs for self-assessment, which is EUR 18 400 per self-tested product (2 staff per month) . Taking the same market scope, and assuming that 25% of the software manufacturers would already apply a similar form of testing , additional testing costs would amount to EUR 5.1 b illio n . Other conformity obligations ( technical documentation, CE marking, declaration of conformity and reporting of exploited vulnerabilities and cyber incidents ) would amount to EUR 4.6 b illio n , using a primary estimate of 9% average additional product development costs that could however not be verified . Hence, the total aggregated compliance costs for software manufacturers would amount to EUR 17.5 b illio n. Costs (administrative and adjustment costs) Amending security requirements in sectoral NLF legislation Depending on the sector where the legislation is amended For manufacturers: Adjustments costs for secure product developme nt ( o n average 30.5% if no BaU) Familiarisation costs and updating technical documentation and conformity documentation For importers and distributors: familiarisation costs Bring ing non-embedded SW into the scope of some NLF legislation and potentially duty of care for whole life cycle (e.g. RED DA) For manufacturers: For s oftware: t otal compliance costs of EUR 17.5 b illio n (not including familiarisation and info r mation obligations) Limited adjustment and familiarisation costs for hardware manufacturers For importers and distributors: familiarisation costs Total +/ ++ Table SEQ Table \* ARABIC 4 : Overview of compliance costs on businesses under policy option 2 Policy o ption 3 Under policy option 3 , c ompliance costs , both adju stment and administrative costs , would occur for all hardware manufacturers and embedded software manufacturers , as well as importers and distributors, due to the horizontal security requirements , associated conformity assessment and documentation and reporting requirements . The main costs for importers and distributors would be adjustment costs related to familiarisation related to the new requirements. The impacts of policy option 3 will depend on the sub-options related to conformity assessment , respectively in sub-option 3 i) and 3 ii) . In a first stage, only voluntary measures would apply to non-embedded software ("staggered approach) . T he se cost impacts are described under o ption 1 , and are not possible to be quantified. Furthermore, due to the lack of granularity of the market analysis, the aggregated impact on embedded software could not be estimated precisely . In the public consultation, stakeholders rated the costs of " Introducing mandatory horizontal cybersecurity requirements for hardware products" o n average at medium to high , with 3.55 out of 5 (with 5 indicating very costly). Regarding adjustment costs , the main cost source will be related to secure product development . To estimate the se adjustment costs , secondary data was used, which is the Venson calibration model that estimates an average of 30.5% additional product development costs if no security is in place (further explained in Annex 4 ) . This leads to 42 700 EUR of additional product development costs for an average product with digital elements unit (EUR 140 000) . Taking the assumption that 50% of hardware manufacturers are already implementing adequate security requirements (further explained in Annex 4 ) , and estimating the number of hardware products impacted by using the ICT-EXT-ADJ indicator, the aggregated additional costs related to secure product development would be of EUR 5.33 billion . Adjustment costs related to f amiliarisation costs and costs related to transparency and information could not be estimated due to a lack of available primary and secondary data. For instance, in the case of the Toy Safety Directive, for importers, the time spent to comply with the Directive’s requirements equalled to 110 man-hours per toy type (EUR 2 500). For distributors, time spent to comply with the Directive’s requirements: 86 man-hours per toy type (EUR 1 953). According to the targeted survey , the costs related to information and transparency would not be significant if provided in digital format. Regarding conformity assessment costs , they are expected to vary depending on the sub-options related to conformity assessment. The average costs of conformity assessment per product with digital elements was drawn from secondary data . For self-assessment , the average cost was estimated at EUR 18 400 including one-off and recurrent costs (see Box 2 ) . For third-party assessment, costs were estimated at EUR 25 000 , which represents an average of possible costs for different types of products based on secondary data. Box 2 further discusses the costs of self-assessment and third-party assessment. Costs related to conformity assessment would be both adjustment costs in the case of self-assessment (e.g. setting up and maintaining testing facilities) as well as administrative costs linked to certification fees paid to notified bodies to carry out audits and review documentation . Under both sub-options 3i) and 3ii) , the BaU costs for conformity assessment for hardware manufacturers have been assumed to be o n average at 40% both for self-testing and third-party assessment. This figure represent s a low average of BaU cost evidenced . I n the context of the Impact Assessment of the RED delegated act , the BaU for hardware products varied between 30 % for more simple products to 90 % for complex products such as routers. No data could be found on BaU costs for internal testing. Th ese assumption s and estimates have several limitation s : In the case of self-assessment ( policy option 3i) ) , for hardware manufacturers already covered by NLF legislation (in particular RED), the BaU would likely be high er , as they could either follow the existing approaches on conformity assessment . The additional costs would mainly apply to non-wired hardware products on the market, of which the precise share could not be estimated . Some of these manufacturers of non-wired hardware would likely also have internal testing practices in place. The BaU costs and additional testing costs would in pra c tice greatly vary depending on the complexity of the product , as evidenced by the I mpact assessment of the RED delegated act . The costs increase with the complexity of the product, therefore it can be assumed that consumer products would generally bear lower costs for testing compared to industrial products. The BaU costs might be equally low er in the B2C compared to B2B sector, the latter being typically bound by more detailed contractual responsibilities . Therefore, the additional costs related to conformity assessment are expected to be higher on consumer products higher than for business products (f or examples, see Box 2 ) . Under sub-option 3 i) , taking into account the BaU factor of 40% and the number of products based on the ICT-ADJ-EXT market indicator , and counting o n average EUR 18 400 of internal testing by product, the aggregated additional costs related to the conformity assessment for the hardware market are estimated at EUR 2.8 billion . Under sub-option 3 ii) , t aking into account the same BaU factor and market indicator, and the average costs of EUR 25 000 for third party assessment and assumig that the share of critical products should be narrow (ca. 10% of the market) , the aggregated additional costs related to t he conformity assessment for the hardware market are estimated at EUR 2 . 9 billion . Other costs related to conformity, such as the technical documentation, the d eclaration of conformity , affixing of the CE market and reporting of exploited vulnerabilities and cybersecurity incidents to ENISA , have been estimated ( using the estimate of additional 9% of product development costs based on primary data ) at EUR 3.1 billion for the hardware market . As a result, i n total, under policy option 3 sub-option i) , the total additional aggregated compliance costs (adjustment and administrative) would be of EUR 11.2 billion . Under policy option 3 sub-option ii) , additional aggregated compliance (adjustment and administrative) costs would be of EUR 11 . 3 billion . These figures do not include the costs for embedded software manufacturers, and therefore might be an underestimation. Testing costs Other conformity costs Total conformity costs ( adjustment and administrative costs) Adjustment costs for s ecure product development Total compliance costs 3 (i) self-assessment EUR 2.8 b n EUR 3.1 b n EUR 5.9 bn EUR 5.3 bn EUR 11.2 bn 3 ii) third-party assessment EUR 2 . 9 b n EUR 2.5. bn (self-assessment) EUR 0.4 bn EUR (third-party assessment) EUR 3.1 b n EUR 6 bn EUR 5.3 bn EUR 11 . 3 bn Voluntary approach on SW See PO1 Table SEQ Table \* ARABIC 5 : Overview of aggregated compliance costs on businesses u nder policy option 3 . Both under policy option 3 and 4, a n important source of compliance costs would stem from the conformity assessment . Depending on the sub-options, third-party assessment would be foreseen for a narrow share of the market. Self-assessment (or internal testing) is generally seen as less costly than third-party assessment as it does not involve any notified body . However, the stakeholder consultations did not enable to make precise cost estimates to reflect the difference between the two assessment procedures. Business stakeholders generally stressed the importance for the manufacturer to have flexibility regarding the procedure . Self-assessment of a product with digital elements typically includes (i) setting up an internal testing laboratory (one-off adjustment cost, e.g. train and hire staff); (ii) internal testing of a product with digital elements (recurrent). Third party assessment of a product with digital elements includes: i) the review of the technical documentation by a notified body ; and ii) the testing and audit of the technical characteristics of the product with digital elements itself. Throughout the consultations, stakeholders expressed different opinions as to whether self-assessment would be more or less costly compared to third-party assessment. During a consultation workshop, most respondents said that the impact on costs of internal product testing/self-assessment would be “Low” , followed by “Medium” . Some stakeholders stressed that the costs will be less than third-party conformity assessment , and could be easily integrated in the internal product development process . During the same workshop, a ccording to stakeholders, the impact on costs of external third-party product testing (or certification) would be “ High” , followed by “Very high” . On the contrary, d uring the targeted survey, interviewees stressed that one-off costs for self-assessment testing are quite high as it demands building internal capabilities, which could be cumbersome for SMEs. The recurrent costs of self-assessment could be lower once internal capa bilities have been put in place, while there would be high er recurrent costs for third-party assessment. In the context of the targeted survey, operating expenses (OPEX) – recurrent costs were estimated between EUR 3 000 and EUR 5 000 per product . Similarly, secondary data shows that the costs for internal testing for a laptop were estimated at EUR 5 000 per unit. The stakeholders' feedback and estimated costs could be summarised as follows : Type of cost Testing method One-off costs Recurrent Average (estimation) Self-assessment +/++ Neutral/+ (around 30%) EUR 18 400 Third-party assessment Neutral/+ ++ EUR 25 000 The costs related to self-assesment and third - party assessment heavily depend on the complexity of the product , in particular in terms of supply chain involving different hardware and/or software manufacturers. In order to estimate average costs, the following cost estimates from secondary data were used: In the Cybersecurity Act’s Impact Assessment study, it was estimated that costs (average recurrent and one-off) might potentially be higher than EUR 18 400 in staff costs, which corresponds to two FTE months for an average firm with an hourly rate of ca. EUR 29. No other secondary sources could be identified. For the EU Cybersecurity Act , in France the Certification Sécuritaire de Premier Niveau (CSPN) costs were estimated between EUR 25 000 to EUR 35 000, while in the Netherlands the Baseline Security Product Assessment (BSPA) were estimated on average at EUR 40 000. For the delegated act of the RED, the cost estimations ranged from EUR 5 000 to EUR 50 000 or more, depending on the product. Hence, an average of EUR 25 000 was chosen to estimate the costs of third-party assessment . As a matter of comparison, the benchmark averages in the Study to support the IA of the Artificial Intelligence Act lie between EUR 16 800 and 23 000 . Examples of testing costs for produ c ts For t esting connected garden equipment (consumer product) , the costs would be of 25 000 EUR, while the BaU costs would be of only 20%. The costs of third-party assessment will increase with the complexity of the product, while for such products , the share of BaU costs would also typically be higher (70 to 90%). For example, for a more complex product, like a router, the total costs are estimated at EUR 126 000, with a BaU cost s of 90%. For software intended for telecom networks and complex IT-systems (in the scope of policy option 4 ) , self-assessment would cost around 30 000-50 000 EUR, with BaU cost s of 90%. Box SEQ Box \* ARABIC 2 : Costs of conformity assessment for policy option 3 and 4. Policy o ption 4 Under this policy option, all hardware and software manufacturers (depending on the sub-options) , as well as distributors and importers, would bear additional compliance costs. As for policy option 3, the main costs for importers and distributors would be familiarisation costs. The costs of policy option 4 will depend on the sub-options related to the scope (4a) and ( 4b) and conformity assessment (i) an ( ii) . The detailed market analysis ( Annex 3 ) did not enable to estimate the share of critical non-embedded software , therefore the assumption was made that it would represent less than 10% of the software market . As in policy option 3, the market analysis did not enable to distinguish between embedded and non-embedded software, therefore the cost estimates are provided for the software market in general. When asked in the public consultation about the costs of introducing mandatory horizontal cybersecurity requirements for software products, stakeholders indicate d medium to high costs o n average (3.68 out of 5). Hardware manufacturers rated the costs slightly lower ( 3.47 ) than software manufacturers (4.42 out of 5). As mentioned, for introducing mandatory horizontal cybersecurity requirements for hardware products, stakeholders indicated o n average medium to high costs (3.55 out of 5). Taking the questions together, software manufacturers indicated in average " high to very high costs" (4.21 out of 5) compared to hardware manufacturers , who rated the costs " medium to high" (3.47 out of 5). When consulting stakeholders, most respondents said that the impact of implementing security requirements relating to features of the products with digital elements and relat ed to vulnerability management would be “ Medium” , followed by “ High ”. The impact on costs of implementing requirements relating to security updates, end of life and whole life cycle would be “High” , followed by “Medium”. Under policy option 4 , b ased on the available quantitative cost estimates, and depending on the sub-options, the following aggregated compliance costs c ould be estimated : Regarding adjustment costs , the same approach is taken as in previous sections on estimating secure product development costs : secondary data was used, which is the Venson calibration model that estimates an average of 30.5% additional product development costs if no comprehensive cyber security measures are in place (further explained in Annex 4 ) . This leads to 42 700 EUR of additional product development costs for an average product with digital elements unit (140 000 EUR) . The assumption that 50% of manufacturers are already implementing adequate security requirements (further explained in Annex 4 ) is taken. The aggregated adjustment costs vary depend ing on sub-options related to the scope of the initiative. Under policy option 4 a) only 10% of the software market (assumption for share of critical software) would be impacted and the whole hardware market. By estimating the number of products with digital elements concerned using the SD and ICT-EXT-ADJ indicator s , aggregated additional costs related to secure product development are of EUR 6.11 b illio n . Under policy option 4 b ) , the full software and hardware markets would be impacted. By estimating the number of products with digital elements concerned using the ICT-EXT-ADJ and SD indicators , it leads to aggregated additional costs of EUR 13.13 billion . As for policy option 3, costs for manufacturers, distributors and importers related to familiarisation could not be estimated , but would occur under all sub-options . The costs related to information and transparency for manufacturers to the end-users could not be estimated. According to the targeted survey , the impact on costs of implementing requirements related to transparency, guidelines and user information would be “m edium” , followed by “l ow” . Respondents specif ied that the costs related to transparency and information would not be significant if provided in digital format. Regarding the conformity assessment costs , they will vary for policy option 4 a) and b) depending on the sub-options related to conformity assessment. The average costs of testing by product with digital elements was drawn from secondary data, as explained in Box 2 . These costs would be both adjustment costs in the case of self-assessment (e.g. setting up and maintaining testing facilities) as well as administrative costs linked to certification fees paid to notified bodies. The average cost for self-assessment was estimated at EUR 18 400, and for third-party assessment at 25 000 EUR (see Box 2 above) . As explained in policy option 3 , the BaU factor for hardware manufacturers was estimated at 40%. For software manufacturers, it is assumed that the BaU factor would be lower, given that less software products are today covered by NLF legislation. In the absence of any data, an average BaU of 25 % was chosen, to reflect the feedback received from stakeholders that at least for more complex software products, testing, including third-party assessment, would be in place , and that testing was to some extent alredy carried out during the product development process . Taking into account the BaU factor of 40% and 25% respectively for hardware and software products, and estimating the number of products based on the ICT-ADJ-EXT and SD indicators , the aggregated additional costs related to conformity assessment are summarised in t he table below. It was assumed that third-party assessment would apply to 10% of the concerned products considered critical under policy option s 4 (a)(ii) and 4(b)(ii ) . In addition, the administrative costs related to documentation and reporting (e.g. technical documentation , declaration of conformity, affixing of the CE market and reporting of exploited vulnerabilites and cybersecurity incidents to ENISA ) , have been estimated with the followng assumptions: 9% of additional product development costs (see policy option 3 ); an average unit cost of EUR 140 000, and a number of products based on the ICT-ADJ-EXT and SD indicators . The results are summarised i n the table below. Testing costs (adjustment and administrative costs) Other conformity costs (administrative costs) Total conformity costs Adjustment costs for s ecure product development Total compliance costs (adjustment and administrative costs) 4(a)(i) self-assessment 3. 3 bn EUR EUR 3.6 b n EUR 6 . 9 bn EUR 6.1 bn EUR 13 bn 4(a)(ii) third-party assessment 3 .4 bn EUR - EUR 3 bn (self-assessment) - EUR 0.4 bn (third-party assessment) EUR 3.6 b n EUR 7 bn EUR 6.1 bn EUR 13 .1 bn 4(b)(i) self-assessment EUR 7.9 b n EUR 7.8 bn EUR 15.7 bn EUR 13.13 b n EUR 28.8 bn 4(b)(ii) third-party assessment EUR 8 . 1 b n EUR 7 bn (self-assessment) EUR 1.1 bn ( third-party assessment) EUR 7.8 bn EUR 15 . 9 bn EUR 13.13 bn EUR 29 bn Table SEQ Table \* ARABIC 6 : Overview of aggregated compliance costs on businesses by sub-option under policy option 4 O verview of benefits for businesses for all policy options I n policy option 1 , t he uptake of voluntary measures would be driven by market considerations ( cost-benefit analysis) such as enhanced reputation as well as participation in public procurement procedures. It is likely that the manufacturers of the most problematic cheap equipment and software would not join a voluntary initiative as this would not be in line with their business strategy. The positive i mpact in terms of reduced cybersecurity incidents ( s ee section 6. 6 ) , uptake of product with digital elements by EU users ( section 6.3.4 ) and global competitiveness and innovation ( section 6.4 ) would be limited and depend on the market uptake of voluntary initiatives. In addition, t he absence of horizontal legislation would drive significant compliance costs and complexity ( see section 6.3 ). In policy option 2 , similar to option 1, the positive impact in terms of cybersecurity incidents ( s ee section 6.6 ) , uptake of products with digital elements by EU users ( section 6.3.4 ) and global competitiveness and innovation ( section 6.4 ) would be limited to certain categories of hardware products, and if at all, to certain non- embedded software products used in a specific sector . In addition, the absence of horizontal legislation will drive significant compliance costs and complexity ( see section 6.3 ). In policy option 3 , hardware manufacturers would benefit from a reduce d number of cybersecurity incidents ( see also section 6.6 ) , although the impact would be limited by the fact that non-embedded software is not covered by a horizontal initiative in the first stage. The uptake of CE marked tangible products by EU users and globally is expected to increase ( section s 6.3.4 and 6.4 ) . The initiative would have a positive impact to prevent internal market fragment ation for all tangible products ( sections 6.3 ). Under policy option 4 , both software and hardware manufacturers would benefit from a reduced reputational fallout following a decrease in the number of cybersecurity incidents of ca. 33% affecting their products ( s ee also section 6.6 ). Furthermore, businesses would also benefit from enhanced supply chain security as users of products with digital elements . The uptake of CE marked software and hardware products would lik ely increase in the EU and globally, strengthening the EU's technological leadership. Furthermore, both software and hardware manufacturers would benefit from the prevention of internal market fragmentation ( section 6.3 ). As stressed by stakeholders in public and targeted consultations, in policy option 3 and 4 , compliance costs could be substantially off-set by alignment with existing European and international standards . These standards will be taken into account in the standardisation process for harmonised standards that would follow the adoption of the initiative under policy option 3 and 4. The work related to standardisation is further developed under S ection 6.5 . It should also be noted that the complia n ce costs can be off-set by transferring costs to the end-user , which will be further develo p ped under section 6.3.4. Cost savings for businesses due to reduced cyber incidents under policy options 3 and 4 As a European regulation introducing horizontal requirements would trigger more than half of manufacturers to introduce a secure development product lifecycle, it is estimated that policy option 4 and 3 could reduce the cybersecurity attack surface of products with digital elements respectively by between 20 % to 33 % for policy option 4 b) and by between 10 % and 16 % for policy option 3, and hence reduce the costs related to cybersecurity incidents for businesses . Th e se numbers a re rough estimate s of when the regulatory intervention w ould be fully applicable and the standardisation process has concluded. Assumptions incl ude that currently less than 50 % of manufacturers (see also Section 2.2 ) follow a systematic approach to security and that a secure SDLC can reduce the number of c ritical vulnerabilities by 66 %. The latter number draws on a study showing that , after introducing its SDLC in 2004, Microsoft was able to reduce the number of critical vulnerabilities in its product by a range of 66 % (see also Section 6.5 ). Furthermore, e stimates of the share of incidents resulting from exploits against weaknesses in the computational logic and design of software range from 62 % to 90 % for operators of essential services identified under the NIS D irective . It is assumed that this share is valid for the whole economy. B ased on the market analysis presented in S ection 5.1. , the hardware market, to which option 3 would apply at first, is estimated to make up 48 % of all products with digital elements, while the software market is estimated to make up 52 %. Under option 4 a), the market share of critical software is estimated to represent 10% of the software market . Both under policy option 3 ii) and 4a)ii) or 4b)ii), it is not possible to make any assumption related to the impact of third-party assessem en t on vulnerability reduction and cost savings related to cybersecurity incidents . Taking into account all the above-mentioned assumptions: Under policy option 3, it can be estimated that the cybersecurity attack surface would be approximately decreased by 1 6 %, if we assume that broadly all incidents are the results of vulnerabilities . This number takes into account that 50% of the hardware manufacturers ( representing 48% of the concerned market) will implement a secure product development cycle. On the contrary, if considering that only 62% of the incidents are due to vulnerability exploitation, according to the lower estimate of the ENISA study mentioned above , this would lead to a reduction of the cybersecurity attack surface by 10%. U nder policy option 4 a), in addition to hardware manufacturers, 50% of the manufacturers of critical software would implement a secure product development cycle (taking into account the BaU) . Critical software is estimated to represent 10% of the software market. Hence compared to policy option 3 , it is estimated that the cybersecurity attack surface would be reduced by 11% to 1 8 % , respectively reflecting scenarios where only 62% of the incidents are due to vulnerabilities or all incidents . Th is estimation leads most lik ely to an underestimation as critical software plays a specific role in the cybersecurity of products. Under policy option 4 b), in addition to hardware manufacturers, 50% of the manufacturers of all software manufacturers would would implement a secure product development cycle . Hence, it is estimated that the cybersecurity attack surface would be reduced by 20 to 33% , respectively reflecting scenarios where only 62% of the incidents are due to vulnerabilities or all incidents. T his is a reasonable expectation, considering that b uilding in security in the build -up of the product and ensuring effective vulnerability handling are the most effective means of addressing cybersecurity threats and incidents in products. As attackers usually need to chain multiple vulnerability exploits together to achieve their final objective, a reduction of vulnerabilities by 33 % could potentially thwart an even larger number of attacks. The initiative is designed to work in concert with the NIS2 Directive, which will require around 110 000 medium-sized and large firms to take appropriate security measures, including measures to prevent incidents. As a result, both the horizontal requirements for products with digital elements and NIS2 combined will lead to fewer vulnerabilities in products with digital elements , more security patches provided by manufacturers and faster patching of security holes by critical infrastructure s and other essential entities. In light of the above, option 3 could lead to a reduction of cybersecurity incidents by between 10 % and 16 % and as a result reduce the costs associated with cybersecurity incidents by a similar percentage . While estimates regarding the costs associated with cybersecurity incidents are not available at European level, data for certain Member States exists. Based on an extrapolation of incident-related data available for Germany (see Box 3 ) , i t is estimated that under this option the initiative could lead to a reduction in costs stemming from security incidents affecting companies by between EUR 90 billion to EUR 140 billion annually . O ption 4 a ) , which would cover hardware and critical software , could lead to a reduction of cybersecurity incidents by 11% to 18% and and reduced incident-related costs by a similar percentage. Using the data available for Germany (see Box 3 ) , i t is estimated that option 4 b) could lead to a n EU-wide reduction in costs stemming from incidents affecting companies by between EUR 97 billion to EUR 158 billion annually. O ption 4 b ) , which would not only cover hardware but also software, could lead to a reduction of cybersecurity incidents by between 20 % and 33 % and reduce incident-related costs by a similar percentage. For instance, the annual costs associated with data breaches and DDoS attacks , which represent only a small subset of all types of security incidents, could be reduced by EUR 2.0 billion to EUR 3.3 billion and EUR 13 .0 billion to EUR 21.45 billion respectively . Using the data available for Germany, i t is estimated that option 4 b) could lead to a n EU-wide reduction in costs stemming from incidents affecting companies by between roughly EUR 180 billion to EUR 290 billion annually. There are no aggregate estimates of the cost of security incidents in Europe. The figure s under PO3 and PO4 w ere calculated using the cost of security incidents in Germany as estimated by the Germ an trade association Bitkom. The aggregate d cost of security incidents in Germany amounted to EUR 220 billion in 2020 according to Bitkom (2021): “Angriffsziel deutsche Wirtschaft: mehr als 220 Milliarden Euro Schaden pro Jahr“. In order to calculate the aggregated benefits in terms of cost savings , the percentage of reduced cybersecurity incidents due to the policy intervention (as foreseen in the related policy option) is applied to the aggregated costs of security incidents in Germany and then extrapolated to the EU. The aggregate cost of security incidents in Germany amounted to EUR 220 billion in 2020 according to the Bitkom (2021) study “Angriffsziel deutsche Wirtschaft: mehr als 220 Milliarden Euro Schaden pro Jahr“. The data is based on a survey conducted by Bitkom Research on behalf of the digital as sociation Bitkom. It surveyed 1 067 companies with 10 or more employees. The interviews were conducted with executives who are responsible for the topic of business protection in their company. These include d managing directors and executives from the areas of corporate security, IT security, risk management or finance. The survey is representative of the economy as a whole. The study found out that n ine out of ten companies (88 percent) were affected by attacks in 2020/2021 (compared to three quarters (75 percent) in 2018/20 19) . The table below summarises the estimations of all compan ies surveyed in the context of the Bitkom study that were affected in the last 12 months (prior to 2021: in the last 2 years) by theft, industrial espionage or sabotage (2021: n=935; 2019: n=801; 2017: n=571; 2015: n=550) . These figures indicate direct and indirect sources of costs . For the purpose of this report, the assumption is taken that the theft, industrial espionage or sabotage impacting the German industry are direct and indirect consequences of cybersecurity incidents. For these reasons , u sing this figure will likely lead to an overestimation of cost savings for businesses due to reduced cybersecurity incidents . Causes of damage Loss amounts in billions of euros (2021) Failure, theft, or damage of Information and production systems or operations 61.9 Extortion with stolen data or encrypted data 24.3 Data protection measures (e.g., informing customers) 17.1 Patent infringements (even before filing) 30.5 Loss of sales due to loss of competitive advantage 29.0 Loss of sales due to counterfeit products (plagiarism) 22.7 Damage to image among customers or suppliers/negative media coverage 12.3 Costs of investigations and substitute measures 13.3 Costs of legal disputes 12.4 Higher employee fluctuation/staff poaching N.A. Other losses 2.2 Total 22 3.5 Source s : https://www.bitkom.org/Presse/Presseinformation/Angriffsziel-deutsche-Wirtschaft-mehr-als-220-Milliarden-Euro-Schaden-pro-Jahr ; Overview of the results of the surve y: https://www.bitkom.org/sites/main/files/2021-08/bitkom-slides-wirtschaftsschutz-cybercrime-05-08-2021.pdf Box SEQ Box \* ARABIC 3 : German study on economic impacts of security incidents The upper-bound benefit of EUR 290 billion alone is estimated to be roughly ten times higher than the compliance costs (see section 8 ) and does not even take into account o ther non-quantifiable benefits, in particular under policy option 4 , such as the d ecrease in risk mitigation costs for users; the higher uptake of digital solutions as a result of an increased trust in modern technologies ; the r eduction in risk mitigation costs (such as cybersecurity insurance) as a result of the reduction in the overall attack surface of products with digital elements; s maller reputational damage to manufacturers resulting from fewer incidents involving vulnerabilities in their products ; e nhanced productivity of manufacturers from a security point of view ; and p revention of the potential costs of market fragmentation that manufacturers would be facing if Member States decided to intervene in the market . The table below present s an overview direct costs and benefits described in this section (and further detailed in the following sections): Total direct compliance costs Benefits (direct and indirect) PO 1 Depending on the uptake of voluntary measures: Secure product development costs (+30.5%) EU certification (EUR 25 000 - 40 000) Depending on the uptake of the voluntary measures: Reduced cybersecurity incidents for end-users (decrease of vulnerabilities of around 33% by product) Avoidance of costs related to security risk mitigation (e.g. insurance) for end-users Increased uptake of products with digital elements by EU users and globally due to a reduction in risk associated with CE marked products with digital elements Direct cost reduction for manufacturers that already use certification due to harmonisation PO 2 Amending sectoral NLF legislation S ecure product developme nt (in average 30.5% Similar to PO1 depending on sectoral scope Amending RED delegated Act 17.5 bn (for software only) Limited to wireless products: R educed cybersecurity incidents for end-users Reduction of costs and cybersecurity incid ents Increased uptake of products with digital elements in the EU and globally PO 3 3 (i) EUR 11.2 bn Reduced cybersecurity incidents for end-users ( decrease of vulnerabilities of 33% by product ): by roughly EUR 90 b n to EUR 140 b n Limited to the hardware market: Avoidance of costs related to security risk mitigation (e.g. insurance) for end-users Increased uptake of products with digital elements by EU users and globally due to a reduction in risk associated with CE marked products with digital elements 3(ii) EUR 1 1 . 3 bn PO 4 4(a)(i) EUR 13 bn Reduction in costs stemming from incidents affecting companies by roughly EUR 97 b n to EUR 158 bn Avoidance of costs related to security risk mitigation (e.g. insurance) for end-users Increased uptake of products with digital elements by EU users and globally due to a reduction in risk associated with CE marked products with digital elements 4(a)(ii) EUR 1 3 . 1 bn 4(b)(i) EUR 28.8 bn Reduction in costs stemming from incidents affecting companies by roughly EUR 180 billion to EUR 290 b n annually Avoidance of costs related to security risk mitigation (e.g. insurance) for end-users Increased uptake of products with digital elements by EU users and globally due to a reduction in risk associated with CE marked products with digital elements 4(b)(ii) EUR 29 bn Table SEQ Table \* ARABIC 7 : Overview of aggregated direct costs vers us benefits for businesses by policy option 4 Impact on SMEs SMEs will be significantly impacted by the initiative, both in terms of costs and benefits. They will be directly impacted by the new requirements as economic operators, i.e. as manufacturers , distributors or importers . Regarding manufacturers of products with digital elements , more than 99% are SMEs (see section 5). The share of SME distributors and retailers of products with digital elements could not be estimated. Furthermore, SMEs will be impacted by the initiative as end-users of products with digital elements . SMEs have been significant spenders in technology , with companies with less than 1 000 employees spending more than USD 30 billion a year on software alone . P olicy option 1 i s not expected to add significant costs on SMEs , while at the same time, SMEs may engage in voluntary measures to increase their market reputation. In the public consultation, SMEs rated the costs related to voluntary measures (guidelines, certification and public procurement) at respectively 3.4, 3.1 and 2.7 out of 5 (with 5 meaning very costly). Taking into account all organizations representing SMEs, the rating was similar (respectively 2.79; 3.00 and 2.87). European certification would significantly reduce costs and administrative burden for SMEs that already certify or are willing to certify their products and services at various level s of assurance. At the same time, benefits in terms of security for SMEs as end-users would be limited. Under policy option 2 , additional compliance costs would be borne by SMEs covered by the specific product regulation. In the public consultation, SME s rated the costs with an average of 2.6 out of 5 (with 5 meaning very costly), lower than the average of other stakeholders (3.36). Taking organizations representing SMEs as a whole it was rated at 3.6. Furthermore, SMEs could face the costs of having to comply with multiple product specific legislations ( section 6.4 ) . Under policy option 3 , additional compliance costs would be borne by SME manufacturers , especially in the hardware segments that are currently not covered by product legislation, but also manufacturers of embedded software. Policy option 4 would in addition add compliance costs on SME s software manufacturers . In the public consulta tion, SME s rated the costs related to policy option 3 and 4 below or similar to the average. Introducing mandatory horizontal cybersecurity requirements for hardware products was rated at 3 . 55 out of 5 by all stakeholders in average ( with 5 indic ating very costly ), while organizations representing SMEs in general rated it higher at 3.54. At the same time SMEs as end-users would benefit from greater legal certainty and more secure products in the hard ware sector. SME companies rated the costs related to Introducing mandatory horizontal cybersecurity requirements for software products , at 3 out of 5 (the average was 3. 68 ), while organizations representing SMEs rated it slightly higher at 3.59. SMEs generally supported a level playing field between all companies . To the question on whether small and medium-sized companies should be subject to the same obligations as larger companies , organizations representing SMEs responded in average 3.92 out of 5 with 5 indicating that they strongly agree. Furthermore, in the public consultation SMEs did not consider that they would be disadvantaged compared to larger companies in a scenario of horizontal mandatory requirements (policy option 3 and 4) . To the question on whether " Mandatory cybersecurity requirements will put smaller hardware manufacturers and software manufacturers developers at a disadvantage compared with larger competitors" , SME representatives were neu t ral (2.41 out of 5 with 5 indicating strongly agree). SME s representatives were also neutral regarding the statement that EU companies are at a disadvantage on the non-EU markets compared to non-EU competitors that are not subject to such requirements (2.5 out of 5). Several SMEs throughout the consultation activities expressed concerns that increasing the cost of development would possibly caus e a competitive disadvantage vis-à-vis large companies and third countries. Some also expressed the fear that the compliance costs could not be borne by some SMEs, which might disappear from the market. SME representatives consistently called for a proportionate approach and for supporting measures . To the statement on the need to Introduce simplified procedures to demonstrate conformity for small companies and individual entrepreneurs, organizations representing SMEs replied o n average at 2.79 out of 5 (with 5 indicating strongly agreed), while SMEs rated it in average at 3.7 out of 5. SME representatives stressed that SMEs w ould likely bear higher compliance costs and that these costs should remain proportionate and be reachable for SMEs. At the same time, stakeholders consistently stressed that any differentiation in terms of requirements and testing based on the size of the company should be avoided . Lighter administrative procedures and obligations could follow a risk-based approach and be based on the criticality of the product. In terms of costs , SMEs as manufacturers would in principle be more affected than large companies for several reasons . L arger companies can more easily distribute the one-off costs of familiarising themselves with new regulation. Furthermore, larger companies have typically a larger customer base and can therefore distribute the fixed costs over more customers (economies of scale). Most importantly, SMEs' financial capacity to absorb fixed costs is much more limited . First , SMEs might lack awareness and knowledge about cybersecurity in general , it might therefore be more costly for them to gather the knowledge about new security requirements, and to implement those. Due to limited internal technical and legal expertise, SMEs tend to turn to external consultants, increasing overall costs. Also, due to the limited capacity of their laboratories – as regards both economic resources and competences – SMEs have to use external testing laboratories or notified bodies to ensure compliance with applicable NLF-aligned legislation. According to a national trade association representing SMEs, 61% of SMEs report obstacles in ensuring their cybersecurity, the biggest challenges being inadequate skills and the costs of cybersecurity. According to an ENISA survey, approximately 12.3 % of the SMEs believe that their information security performance is ‘ b elow’ or ‘ f ar below industry standards’, compared to only 2.1 % for the large enterprises . While these figures point to higher additional compliance costs, this also indicates the need to bring the security level of products manufactured by SMEs to an adequate security level . Regarding policy options 3 (ii), and 4 a) (ii) and (b) (ii) , mandatory third-party assessment could entail considerable costs for SME manufacturer , as highlighted by several stakeholders in the public consultation. One trade association representing SMEs mentioned that a too extensive scope of products to be covered by third-p arty assessment could have serious effects on specialised SMEs up to ceasing their activities. At the same time, other stak eholders in the targeted survey mentioned that SMEs might prefer third-party assessment to avoid higher one-off costs for self-assessment. As a result, flexibility in choosing the conformity assessment seems important to offset the costs on SMEs. It is important to note tha t not all SME manufacturer s will be impacted in the same way . Some SMEs reported in the open public consultation and in conducted interviews that some costs could be covered by business as usual costs (e.g. some standards are already in place). Those SMEs that have no security measures in place will be the most impacted. However, it has not been possible to estimate the risks of market fall out due to excessive compliance costs for the SMEs. SMEs as importers and distributors would bear some familiarisation costs, however as stressed by several SMEs representatives, these economic operators will benefit from the fact that " c ybersecurity must already be ensured by the manufacturer ". Therefore the burden on SME importers and distributors is not expected to be significant, on the contrary. SMEs as end-users might a lso face higher initial prices, similar to other end-users (see section 6.2.4). However, these are not expected to be outweigh ed by the benefits of enhanced security and transparency (see below). The f ollowing elements will help to off-set higher compliance costs for SME manufacturers , in particular under p olicy o ption s 3 and 4: P roportionality of security requirements and testing methodologies was mentioned as essential by several SME representatives to avoid undue burden. Such a proportionate approach is foreseen under p olic y o ption s 3 and 4. The essential cyber security req uirements in the legislative proposal would be objective-oriented and proportionate building on widely used standards (such as ISO 27000 series and the IEC 62443 series , see Annex 14 ) , and the standardisation process that will follow would take into account the technical specificities of the products . This means that for a given risk level, security controls would be adapted. Furthermore, the envisaged horizontal rules would only foresee third-party assessment for high-risk products. This would not represent more than 10% of the markets for products with digital elements . The impact on SMEs would depend on their presence in the market of the specific product categories. Given the risk profile of these products, the BaU costs is expected to be high. Regarding the proportionality of the costs for conformity assessment , notified bodies conducting the third party assessments would take the size of the company into account when setting their fees , as it is currently the practice in NLF legislation. Alignment of harmonised standards stemming from the initiative with European and international standards was stressed by SME representative as an important factor to reduce compliance cost. As previously mentioned, the EU standardisation process will build on existing standards. SME representatives stressed the need for support measures , while maintaining a level playing field between businesses . S uch support measures could include the exchange of best prac tices and information sharing. They would stem from: ENISA has put in place different tools to provide advice to SMEs in securing their business . O ther initiatives are under development, such as to self-assess the security maturity levels of SMEs. EU financial support will contribute to facilitate the implementation of EU regulation on cybersecurity (see Annex 10 ). For instance, EU programmes for research and innovation (Horizon Europe) and for capacity building (Digital Europe) and their respective precursor programmes aim to support EU know-how in security certification (in relation to the Cybersecurity Act) as well as capacity building and training, including for SMEs. The Digital Innovation Hubs funded from Digital Europe and National Coordination Centres under the Cybersecurity Competence Centre and Network regulation are resources for SMEs, which seek technical advice for product development or testing and/or EU cybersecurity financial support. In the 2021-2027 MFF period, Horizon Europe and Digital Europe will invest in the order of EUR 2 billion in a wide variety of cybersecurity topics and actions (see Annex 10 ). On the other hand, SMEs are expected to benefit from the initiative in several ways , both as manufacturers and end-users, likely even more than large companies . First, as end-users, due to their limited capacities describe d previously, SMEs are likely to be more impacted by cybersecurity attacks, as evidenced by the open public consultation (OPC) . Furthermore, according to an ENISA survey, 90 % of the SMEs stated that cybersecurity issues would have serious negative impacts on their business, with 57 % saying they would most likely become bankrupt or go out of business . Therefore, while embedding secur ity in products with digital elements would present a high compliance costs for some SME manufacturers, it would present significant cost saving for SMEs as end-users . SME as end-users would significantly benefit from enhanced transparency of security properties of products. As stated by a national trade association representing SMEs: " In our experience, SMEs also often find it difficult to tell secure solutions and vendors from insecure ones due to the lack of transparency of cybersecurity features and standards. The absence of trust creates uncertainty and can result in SMEs holding back their much-needed investments in digitalisation” . As manufacturers, distributors and importers of products with digital elements , SMEs can benefit from larger trust from end-users and therefore possibly gain new customers. Larger companies typically already benefit from an established customer base, and therefore the benefits in terms of reputation could be even higher for smaller companies. A seamless access to the internal market with harmonised security requirements for all products with digital elements accross sectors can be even more beneficial for SMEs, as they are less equipped to handle different regulatory requirements and related compliance costs . Impacts on public authorities and notified bodies A horizontal regulatory initiative will impact national authorities such as national accreditation bodies and market surveillance authorities ( MSAs ) , as well as private notified bodies (i.e. notified conformity assessment bodies) . These entities have responsibilities related to the monitoring and enforcement of the measures proposed under the different policy options. As the responsibilities of MSAs and notified bodies grow, their capacity to assess products’ technical characteristics from a cybersecurity perspective need to be ensured. In this context, the need for appropriate skills (e.g. to assess software products) has been stressed as a key challenge by stakeholders. Furthermore, next to the usual authorities involved in market surveillance under the NLF , ENISA will take over tasks in particular related to the collection and dissemination of exploited vulnerabilities in view of enhancing intelligence on cybersecurity threats to the internal market. Direct costs for public authorities and notified bodies Market surveillance authorities (MSAs) The main cost sources for MSAs include : (i) possible creation of new authorities (one-off) ; (ii) familiarisation and training on the new requirements for existing or new authorities (one-off and recurrent for new staff), and (iii) enforcement of the new requirements, including post-ma rket surveillance as part of life cycle approach ( one-off and recurrent). In the long-term , cost-savings could occur thanks to a horizontal approach on security requirements (see section 6. 4 ). The number of MSAs is still to be confirmed (discretion of Member States) and the precise impact will depend on the choices of Member States for the new MSA to be appointed under option s 3 and 4. Different models can be envisaged by Member States in order to ensure that competent authorities wou ld have the required expertise . Under policy option 1 , adjustment costs of market surveillance authorities would occur where a new certification or labelling mechanism is introduced. In the case of EU certification, market surveillance authorities already exist , i.e. the national cybersecurity certification authorities , however enforcement costs would occur if new schemes are deployed . When asked on the impact of voluntary measures in the public consultation, market surveillance authorities overall rated this option as "very low" (1/5 with 5 indicating very costly). Under policy option 2 , MSAs appointed under existing product legislation will need to adjust to additional requirements that include cybersecurity. On a case-by-case basis, additional resources will be required for enforcing new cybersecurity requirements on hardware products (e.g. additional physical checks of the products’ technical characteristics and of the technical documentation against the minimum baseline security requirements). When asked in the public consultation on the costs of amending product specific legislation, public authorities acting as market surveillance authorities rated them "high" (4 out of 5 with 5 indicating very costly). Under policy option s 3 and 4 , a dditional adjustment and enforcement costs would occur. The market surveillance authorities wil l be appointed by Member States and can differ from one Member State to another. The precise compliance and enforcement costs are thus difficult to estimate. When asked in the public consultation about the costs of horizontal legislation , public authorities acting as market surveillance authorities rated them "high" (4 out of 5 with 5 = very co stly). In the context of the Cybersecurity Act , it was estimated that Member States appointing a competent certification authority are expected to bear costs that would approximately amount to EUR 1 600 000 per year . This estimate includes costs related to personnel, equipment, subc ontracting, operations as well as setting up of evaluation facilities. However, it is expected that most Member States would appoint existing authorities under policy options 3 and 4. In order to estimate the enforcement costs, secondary data was used from the impact assessment of the delegated act of the RED . MSAs stated that their estimated costs for enforcing the new (cybersecurity) requirements would be in the order of EUR 5 000 – EUR 10 000 for each type of simple equipment, and up to EUR 20 000 for each type of more complex equipment. In order to aggregate the costs, an average costs by product of EUR 12 500 is estimated, and the number of products is estimated ba sed on the ICT-EXT-ADJ and SD market indicators. Under policy option 3, the enforcement costs are likely to be lower when third-party assessment is implemented as market surveillance is carried out to some extent by notified bodies, however this difference could not be capture d in the cost estimates. Hence, i n average, under policy option 3 i) and ii), a ggregated enforcement costs for MSAs are estimated of EUR 3.1 billion . Under policy option 4, the enforcement costs would increase due to the broadened scope of products compared to policy option 3. As for policy option 3, the difference related to mandatory third-party assessment could not be captured. Under policy options 4 a) i) and ii), assuming that critical software represent s 10% of the software market, the aggregated enforcement costs can be estimated at EUR 3.6 billion . Under policy options 4 b) i) and ii), the aggregated costs could be estimated at EUR 7.7 billion . ENISA, the EU Agency for Cybersecurity Under both policy option 3 and 4 and their respective sub-options, ENISA is tasked to receive notifications from manufacturers of actively exploited vulnerabilities contained in the products with digital elements, as well as incidents having an impact on the security of these products. Cost sources for ENISA would stem from collecting the information, from the preparation of intelligence on emerging trends regarding cybersecurity risks in products with digital elements to the national competent authorities and the European Commission, e.g in the NIS2 Cooperation Group, as well as from provi ding advice to support the implementa tion process of this Regulation. Such activities will involve additional a djustment costs for ENISA. Drawing on the impact assessment of the NIS2 Directive , under option 4 b), collecting and disseminating information on exploited vulnerabilites to competent authorities could be estimated to require 3 FTEs. Any structured reporting and advice on the implementation of the initiative could add 1.5 additional FTE s . Taking into account the scope of the respective policy options, this amount could approximately be reduced to 2.5 FTE under option 3, and 3.5 FTEs under option 4a). These administrative costs would however be offset by reduced activities linked to the implementation of the European cybersecurity certification framework (as described in the policy options 3 and 4 in Section 5 ) , and therefore would amount to budget re-allocation. Costs PO 1 neutral/+ PO 2 ++ Amending sectoral NLF legislation Amending RED delegated Act *Aggregated enforcement costs for MSAs: EUR 4.6 bn PO 3 3 (i) *Aggregated enforcement costs for MSAs: EUR 3.1 bn * Vulnerability reporting for ENISA: 2.5 FTEs 3(ii) PO 4 4(a)(i) *Aggregated enforcement costs for MSAs: EUR 3.6 bn EUR 12 500 additional costs by new product *Vulnerability reporting for ENISA: 3.5 FTEs 4(a)(ii) 4(b)(i) *Aggregated enforcement costs for MSAs: EUR 7.7 bn EUR 12 500 additional costs by new product * Vulnerability reporting for ENISA: 4.5 FTEs 4(b)(ii) Table SEQ Table \* ARABIC 8 : Overview of aggre gated costs for public authorities by policy option National accreditation authorities and notifying authorities The main impacts for accreditation and notifying authorities will be linked to additional adjustment (e.g. additional training and human resources) and enforcement costs to take into account the new requirements. The resources spent by accreditation bodies in relation to NLF implementation are however offset and borne largely by conformity assessment bodies through the purchase of accreditation services. It is difficult to estimate the costs on national accreditation authorities and notifying authorities given their differences between Member States and their specificities ( e.g. some are publicly funded, others private ). Under policy option 1 , additional adjustment and enforcement costs for accreditation authorities would occur if a new European certification or labelling scheme is introduced. Under policy option 2 , accreditation and notifying authorities would already be in place, but would bear adjustment and enforcement costs for accrediting conformity assessment bodies for cybersecurity requirements. Under policy option s 3(i) and 4(i) , self-assessment would be the rule, while third-party assessment would be optional for economic operators. A ccreditation authorities will need to accredit notified bodies competent under the new legisla tion. This would lead to additional adjustment and enforcement costs, which would be mainly offset by fees paid by notified bodies. These costs are expected to increase with the extension of scope to non-embedded sof tware ( option 4) and if third-party assessment is mandatory ( option 4 (ii ) ) . Notified bodies Bodies that have been notified by the accreditation or notifying authority of a Member State have a key role in verifying the security and the compliance of products placed on the market. Notified bodies will mainly bear adjustment costs (e.g. training and new staff) and charges linked to the implementation of the new accreditation framework. These costs are both one-off (examination fee) and recurrent (annual fee to accreditation body and costs to develop a q uality management system). The costs will partly depend on the processes in plac e and the availability of resources of the notified body. Fees will also differ depending on the accreditation body. In the context of the Commission evaluation of the NLF , the examination fee for accrediting a body , a one-off cost , was estimated between EUR 4 000 and EUR 20 000 per accreditation. Under policy options 2, 3, and 4 , notified bodies will bear one-off and recurrent costs for adapting to expected changes . On an aggregated level, these will be more important under pol icy option 3 compared to option 2, and under policy optio n 4 compared to option 3 Benefits for public authorities and notified bodies P olicy option 1 and policy option 2 will have limited impacts for MSAs, accreditation bodies, national notifying authorities in terms of preventing internal market fragmentation ( section 6.5 ). Furthermore, under these policy options, public authorities in general would have limited b enefits in terms of security of products with digital elements ( section 6.3.4 and section 6.6 ). Under policy option 3 and 4 , MSAs, accreditation bodies and national notifying authorities will benefit from the internal market effect of a horizontal intervention: harmonised security requirements for a wide range of product s with digital elements instead of dealing with multiple national and/or European product legislation (see section 6.5 ) . In addition, for accreditation bodies and national notifying authorities , costs will be offset by fees paid by notified bodies. While notified bodies will bear compliance costs, they will also benefit from an internal market effect. Furthermore, they will be remunerated for their conformity assessment services. In the context of the review of the Machinery Directive, increased turnover due to third-party assessment was estimated at EUR 202 million. Public authorities in general will benefit as end-users from enhanced t r ansparency on security properties and on secure use of products with digital elements and r educed compliance costs to meet other EU and national cyber relevant legislation (e.g. NIS) ( section 6.3.4 ). They will also benefit from reduced cyber incidents and cyber mitigation costs ( section 6.6. ). In addition, t he burden on public authorities and notified bodies can be partly offset by EU financial programmes that have supported in the past MSAs, accreditation and notified bodies to facilitate the implementation of EU re gulation on cybersecurity, and will continue to do so in the future (see Annex 10 ) . A s for SMEs ( section 6.3.2. ), EU programmes for research and innovation (Horizon Europe) and for capacity building (Digital Europe) and their respective precursor programmes support know-how in security certification (in relation to the Cybersecurity Act) and in relation to capacity building and training for competent authorities under the NIS Directive. In the same vein, and in order to partially offset potential costs related to the implementation of horizontal cybersecurity legislation, EU financial support will , subject to the respective programme governance decisions, support capacity building for public authorities and notified bodies . For a detailed overview, see Annex 10 . Impact on users: organisations , citizens and consumers As described in section 6.6. , the mandatory security requirements for products with digital elements would lead to an increase in the security of hardware and software products, lowering the risk of cybersecurity incidents for both organisations (businesses and public administrations) and consumers as well as the customers of services that would be affected by fewer security incidents, such as data leaks. This would be in particular beneficial to SMEs , as several respondents to the public consultation pointed out that the negative impacts of cybersecurity incidents are more prominent for SMEs . Moreover, requiring manufacturers to document the security properties of their products would help users to make better purchasing decisions, allowing them to compare products-based security properties and individual security needs. While many users lack the necessary skills to analyse such information, it is very likely that consumer protection organisations, computer magazines, security consultants and other market actors would use this information to help users make informed choices. Similarly, requiring manufacturers to provide instructions on how to use products securely would empower users and ensure a more secure deployment of products. As regards the impact on risk mitigation costs that businesses are facing, the measures are expected to lead to a decrease in such costs: business users could more confidently rely on the security of products with digital elements , knowing that the products have undergone a conformity assessment. According to a recent study by Gartner of behalf of ENISA, the initiative would have a very positive impact on key operators required to take cybersecurity measures under the NIS Directive: 55 % of operators of essential services consider that the intervention would lead to a reduction in risk mitigation costs (i.e. cybersecurity investment). As described in section 2.1 , users forgoing investment in products with digital elements is one of the consequences of the low level of security provided by products with digital elements . With users and in particular businesses becoming more confident in the security of products with digital elements , the initiative would therefore also lead to an increased uptake in digital solutions . As regards business users, the initiative would lower the compliance costs with existing legal acts , such as the NIS Directive or the GDPR, in particular when it comes to supply chain security requirements: In the aforementioned Gartner study , 71 % of operators of essential services consider that the intervention would lead to a reduction in supply chain security compliance costs. Finally, as the manufacturers of products with digital elements will be facing compliance costs to implement cyber security requirements, they are likely to pass on some of these costs to users, leading to an increase in prices for consumers as well as organisations. However, this is not expected to have a significant impact. When aske d in the public consultation whether they valued products’ usability and price over cyber security features , 46 % of respondents disagreed and only 12 % seemed to privilege usability and price over cyber security. The results were similar for SMEs . B ased on the impact assessment of the RED delegated act, for lawnmowers , t he additional costs for end-users could be up to 3 EUR per unit more expensive compared with a non-secured lawnmower product with cheap Wi-Fi connectivity. Integrated encryption into the Central Processing Unit (CPU) would require changes to the electronics a nd additional technical support, which could result in extra costs to the end-user of up to 10 EUR per unit. The price increase per router for testing would be up to EUR 0.355 per device. In addition, transparency requirements would contribute to boosting the awareness of users of the security risks associated with certain products. Consumer protections organisations and other actors, such as security researchers or computer magazines, could use the additional information provided by manufacturers to provide consumers and organisational users with a better overview of the security properties and features of products with digital elements , helping them make better purchasing and deployment decisions. Under policy option 1 , the positive impact on users in terms of security, risk mitigation, digital uptake and compliance costs woul d be limited, considering that no mandatory measures would be imposed . However, additional certification schemes could incentives certain players to undergo ICT prod uct certification, boosting confidence of users in such products and lowering businesses’ compliance costs with other legislation. Under policy option 2 , there would be a positive impac t on users for a limited number of products covered by the NLF legislation. However, the majority of products with digital elements in the EU are currently not covered by any NLF legislation. A more substantial impact would occur if the scope if the RED Delegated Act is extended to non-emebedded software. Under policy option 3 , which includes a horizontal regulatory intervention for a broad scope of tangible products with digital elements , the positive impact on users in terms of security, risk mitigation, digital uptake and compliance costs would increase dramatically as regards tangible products. It would however remain very limit ed as regards software products . Under policy option 4 , all manufacturers of tangible and intangible products would be expected to take cybersecurity measures, which would lead to a substantial positive impact on users, citizens and consumers in terms of security, risk mitigation, digital uptake and compliance costs with other legislation. In the public consultation, when asked whether Horizontal cybersecurity requirements for products with digital elements would increase awareness of users when it comes to cyber risks , 82.22 % of respondents (strongly) agreed. Functioning of the internal market The impact on the internal market depends on how effective the regulatory framework is in preventing the emergence of obstacles and fragmentation by mutually contradicting national initiatives aiming to address the problems set out in section 2.1 . Member States are increasingly recognising the need to address concerns regarding the security of products with digital elements . For example, in 2019, Finland has created a labelling scheme for IoT devices, such as smart TVs, smartphones and toys based on the ETSI standard s . Germany has recently introduced a consumer security label for broadband routers, smart TVs, cameras, speakers, toys, as well as cleaning and gardening robots. Policy options 1 and 2 explicitly point to the creation of additional voluntary national schemes absent Union legislation. So far, mandatory national cybersecurity requirements for products with digital elements are rather th e exception than the rule in the Member States. One notable example is the mandatory protection profiles introduced by Germany for manufacturers of smart meter gateways. Given the dire state of product security in the internal market, Member States are expected to sooner or later consider further national product rules to protect their critical infrastructure, crucial manufacturing processes or citizens. Such a national approach would inevitably lead to a fragmentation of the internal market. Most products with digital elements markets are European if not global. Major operating systems, such as Microsoft Windows or Android with its various forks, are sold to a global user base. Similarly, given the importance of economies of scale in hardware markets as described in section 2.2.5 , many components, such as CPUs or network chipsets, are equally marketed across the globe. For example, infected IoT devices in the internal market can be traced back to the same manufacturers, irrespective of in which Member State they are deployed. National rules on such products would therefore force manufacturers to adjust their products to national markets, resulting in a decrease in cost-effectiveness across the internal market. In some cases, manufacturers, and in particular smaller ones, may even decide not to market a product in regions with a low expected sales volume in order to avoid the additional cost associated with adjusting the product to national rules . While policy options 1 and 2 may entail additional voluntary national schemes as one way of addressing the problem of low product security, nothing would prevent the Member States from setting their own rules with the negative consequences described above. In the public consultation, when discussing the impacts, multiple stakeholders expressed the dangers of legislative fragmentation, and mentioned that any interventions that foster fragmentation (voluntary vertical schemes or national regulatory schemes) will drive significant compliance costs and complexity to no improved security. Under policy option 2 , internal market fragmentation could at least be prevented for those products that are regulated under the NLF. However, in the public consultation, several stakeholders mentioned that amending d ifferent legislation with cyber security requirements would lead to a multiplicity of non-homogeneous requirements and increase the overall cost. Policy option 3 would effectively prevent internal market fragmentation for all tangible products, given its horizontal regulatory intervention in this area. Given its staggered approach to the introduction of security requirements for non-tangible products, internal market fragmentation in the area of software would most likely be temporary. Policy option 4 would be the most effective in preventing fragmentation, as the horizontal regulatory intervention would cover a broad scope, including all software . In the public consultation, to the question whether “ Horizontal cybersecurity requirement would improve the functioning of the internal market by levelling the playing field for manufacturers […] ” , over 88 % respondents strongly agreed. Competitiveness, innovation and trade : Impacts on EU and non-EU companies C ompetitiveness and trade in the software and hardware markets Competition in the software market is generally global and the sector is a highly profitable one. Software is used to a large extent from external providers, either as a ready-to-use system or via hired external contractors. Therefore, companies from outside the EU find it relatively easy to win customers, and as a result supply chains are often international. The EU is importing more than exporting software products. In percentage terms, the software share of extra-EU exports is separated from that of intra-EU27 imports by 18 % (see Annex 3 ). Regarding hardware, EU imports from third countries and intra-EU imports are similar shares, with intra-EU imports only surpassing extra-EU ones by five percentage points. The competitiveness of EU products and commercial balance might vary from one sub-category of hardware product to another. In 2021, several product categories that are amongst the top EU export products could be covered by a possible horizontal regulatory intervention such as: machinery and equipment (12.9 % of total exports), and computer, electronic and optical products (7.9 %) . Amongst the top EU imports are: computer, electronic and optical products (14 % of total imports); machinery & equipment, electrical equipment and basic metals (all three 6 %). Possible impacts on EU and non-EU companies in terms of competitiveness Regarding the impact on EU companies , on the one hand, additional compliance costs could increase the development and production costs of EU companies and hence their ability to export products globally. Furthermore, conformity assessment might delay the placing on the market of a product with digital elements , and hence the first mover advantage. On the other hand, the initiative can impact positively the uptake of products with digital elements globally and enhance the productivity and reputation of European companies from a security standpoint, thereby contributing to Europe's position as global leader in cyber-secure products. Under p olicy options 1 and 2 , the impact on Europe's competitiveness would be limited, both in terms of possible compliance costs and benefits. Given the voluntary nature of the measures, the impact of these options on reputation is expected to be limited to those manufacturer that decide to engage into voluntary measures, such as national labelling and EU certification. The absence of any "CE mark" or alike for a substantial part of the hardware and software market will however reduce the impact on enhancing the reputation and visibility of EU products with digital elements globally ( and similarly, non-EU products with digital elements offered on the EU market ) . The increased demand for products with digital elements would depend on the extent to which voluntary measures penetrate the market. Under policy option 3 , and policy option 4, additional compliance costs would occur respectively for European and non-EU hardware and embedded software manufacturers as well as non-embedded software manufacturers . However, it is expected that these policy option s w ould equally strengthen the visibility and reputation of EU hardware and if applicable software products globally as well as of non-EU hardware products on the EU market in terms of cyber security When asked in the public consultation on whether Mandatory cybersecurity requirements will put EU manufacturers at a disadvantage on the non-EU markets compared to non-EU competitors that are not subject to such requirements, hardware manufacturers were neutral (2.6 out of 5, with 5 indicating strong agreement), while software manufacturers generally agreed (3 out of 5). Organisations represen t ing SMEs had a neutral stance (2.5 out of 5), and SME companies generally disagreed (2 out of 5). This suggests that software manufacturers could be slightly more concerned regarding the impact on their global competitiveness. In this context, mention should be made that the responses of software developers must be analysed in a wider context, considering that, unlike hardware manufacturers, they have been very limitedly exposed to NLF-type legislation, if at all. Stakeholders stressed the concern that horizontal requirements could undermine the winner-takes-all dynamic , which is by nature even more prevalent in the software sector (or first mover advantage). In particular, third-party assessment under option 4(ii) can delay the timing of placing an EU software product on the global market. However, these impacts are not expected to be significant as only very limited categories of products would be affected by such third-party testing . When asked in the onl ine targeted survey on whether policy o ption 4 would negatively affect exports of products with digital elements at industry level , respondents mentioned a low impact (2.4 out of 10 with 1 being the lowest and 10 the highest). Respondents rated the negative impact on imports slightly higher, but still not significant (3.7 out of 10). Furthermore, both under option 3(ii) and 4(a)(ii) and 4(b)(ii), third party assessment could only apply to a very narrow share of products (max. 10%), for which the BaU cost are likely to be high. A horizontal initiative under policy option 3 and 4 can be beneficial to the European industry, as it would raise the overall security culture in Europe, making European products with digital elements more secure, reliable and trustworthy, and hence competitive. The demand for products with digital elements will continue and/or might even increase on the EU market , and security is an increasing driver of this demand. Hence, a horizontal initiative could contribute positively to build Europe's global technology leadership in the hardware and software market. Assurance on security requirement are both attractive in the B2B sector and B2C sectors . Furthermore, a s highlighted in the Commission ’s sector inquiry on Internet of Things cybersecurity is a key parameter on which consumer IoT manufacturers compete . E xperts also highlight that growth for European companies in the software could result by exploiting the competitiveness of the European software industry in the vertical industrial sectors and B2B segment. In this context, assurance on security could provide a competitive strength to European B2B software products in a large number of sectors. S imila r to other NLF legislations, a horizontal regulatory intervention is expected to enhance the quality and reputation of "CE marked" hardware and software offered on global markets, and therefore bring competitive strength to European manufacturers compared to their third country counterparts. A horizontal initiative will have positive effects on innovation in cybersecurity technologies in Europe and boost the competitiveness of European industry . The introduction of security requirements, such as security by design, as well as conformity assessment, as well as the definition of related harmonised standards (or if applicable, specifications by the Commission) will provide legal certainty for investments and boost the demand for a variety of cybersecurity tools, such pen testing, automatic scanning, etc. Those technologies have been identified as priorities for investments in R&D under Horizon Europe (see Annex 10). At the same time, as regards the effects on innovation in general, the intervention would be proportionate and would introduce objective-based requirements, technology and product/sector-neutral, without being overly-prescriptive. A reasonable transition period of 2-2.5 years to prepare the implementation would also be provided (see standardisation below) , giving time to the relevant markets to prepare, while providing a clear direction for R&D investments. The impact on non-European companies will be similar to the one on European companies. G iven its large share of imports, the EU is an attractive market for non-EU companies. Therefore, exporting to Europe will likely remain attractive for non-EU companies. While it cannot be excluded that some firms might direct their offering to other markets, this effect is not expected to be significant. Furthermore, the initiative could enhance the reputation of non-EU providers on the EU market by demonstrating that they are meeting high security standards. A significant cost could stem from the obligation to have an economic operator established in th e Union, which exists in some NLF legislation. However, this is not envisaged in any of the policy options. Last, it is important to stress that while European horizontal requirements for products with digital elements would be the first comprehensive product security initiative globally , EU trading partners, with the US in the lead, a re pursuing similar objectives to the EU with regard to security of products with digital elements and have started to introduce measures to address particularly the security of supply chain and security of products with digital elements . (see Annex 6 ). The role of standardisation in competitiveness and innovation Under the policy options (3) and (4), following the adoption of the legislation , the Commission will prepare a standardisation request (under Regulation 1025/2012 on European standardisation) to the relevant European standardisation bodies (ESOs), ETSI and CEN-CENELEC , taking account of a transition period from entry into force to application of at least two years to allow the preparation of implementation, including the development of needed harmonised standards by ESOs. Stakeholders consistently stressed that b oth EU and non-EU compan ies that are operating globally would greatly benefit in terms of competitiveness if EU standards and conformity assessment methodologies are as much as possible aligned with existing European and international standards . For global (EU and non-EU companies), possible costs could stem from regulatory divergence between the EU and global trade partners. The costs of third party conformity assessment and certification could risk being duplicated across different regulatory jurisdictions if EU rules diverge from each other and from international ones. The ESOs pointed out that th e cost of developing standards is financed primarily by industry (93-95%) followed by national governments (around 3-5%) and the European Commission / EFTA contribution (around 2%) . The approximate cost of creating one standard from scratch was estimated at approximately EUR 1 million . The cost is financed primarily by industry (93-95%) followed by national governments (around 3-5%) and the European Commission / EFTA contribution (around 2%) . C ompliance with harmonised standards is not mandatory, but creates a presumption of compliance with the legal requirements, unless otherwise specifically provided by the horizontal regulation . This creates a strong incentive for industry to contribute to the standardisation work, which is always a voluntary process. The fact that industry bears most of the cost of the system, together with the voluntary character of standards, reflects its high interest in the role of standards, including in support to the application of NLF-aligned legislation. If developed in a timely manner, harmonised European standards can provide a key competitive advantage for European industry by adopting more advanced standards compared to their competitors. However, it has to be noted that, recently, economic operators and business associations mentioned the development of harmonised standards as a severe issue, generating significant costs for companies beyond the costs associated with the development of standards detailed above . C ompanies face difficulties in using new standards, reportedly due to delays in the mandates by the Commission and the citation of harmonised standards at EU level: this ultimately hampers companies’ competitiveness, as competitors on the global stage (for instance, in the United States and China) adopt more advanced standards than Europe . The alignment with existing and international standards would be ensured in the following ways: The Commission will request the harmonised standards to be developed on the basis of the European horizontal regulation will take account (e.g. through a gap analysis) existing international standards and all other relevant standards developed by that time, including those on the basis of the RED delegated act . The envisaged requirements for the proposal for a horizontal regulation should take into account of the main elements of the standardisation request to be issued on the basis of the RED delegated act. In order to ensure alignment with existing cybersecurity standards, ENISA should be involved in the standardisation work. The adoption of harmonised European standards does not mean that new standards need to be built from scratch. An existing standard can be designated as harmonised standard for presumption of compliance with essential requirements defined in the Union legislation. While there are existing standards related to the security of products with digital elements (see table in Annex 13 ), only a detailed gap analysis would enable to conclude if some standards would provide the required level of security. T he EU has already announced the willingness to work closely with its main trading partners, in particular the US to deepen its cooperation "on new cybersecurity technologies and standards". Security and resilience While there is little systematic research measuring the effect of a Security Development Lifecycle (SDL C ) on product security, available evidence suggests that firms can significantly reduce the attack surface of their products by implementing a systematic approach to cybersecurity in their development processes. For instance, after introducing its SDLC in 2004, Microsoft was able to reduce the number of critical vulnerabilities in its product range by 66 %. As regards securing products across the entire life cycle, in particular by providing timely security updates for critical vulnerabilities, Google’s Project Zero provides evidence that manufactures can indeed provide security updates much more quickly than under the status quo, if provided with proper incentives . A mongst the software projects that Project Zero is analysing, the number of days between the discovery of a vulnerability and the provision of a fix has dropped from an average of 80 days to 52 days. A legally binding requirement covering the entire hardware and software market would produce strong incentives to reduce the time for providing security updates . I nformation regarding the actual implementation of SDLC by hardware and software manufacturers is patchy. According to a 2010 survey conducted amongst 46 manufacturers, only 30.4 % of them have implemented a formalised approach . More recent studies focusing on Europe , produce similar findings: A survey of Norwegian public organisations involved in developing software concludes that on average only 39 % of the security measures described in the Building Security In Maturity Model (BSIMM) are implemented. In a 2021 study amongst 61 Finnish software practitioners, 29 % of respondents said their firms were not following any systematic approach. Based on this data, it is estimated that currently less than 50 % of manufacturers have a systematic approach to product development. Given the low uptake of secure coding practices by manufactures, the introduction of mandatory requirements as regards the security of products and development processes would lead to a significant increase in product security and, as a result, in the security and resilience of users, including critical infrastructures, other providers of essential services and consumers. A survey conducted as part of the NIS Investments Study 2022 shows that developing more secure products and patching holes in existing products would substantially lower the costs associated with cybersecurity incidents: 69 % of critical infrastructure providers and other operators of essential services stated that mandatory cybersecurity requirements for products with digital elements would lead to a reduction in the number of security incidents, suggesting that the intervention would significantly contribute to raising the level of resilience of the most critical parts of the European economy. Experience has shown that mandatory security requirements are indeed effective in making companies take security more seriously and ultimately in raising the overall level of security. In a 2020 survey assessing the impact of the NIS Directive on security, 82 % of operators of essential services gave the Directive a mark of 4 or above (on a scale from 1 to 5) . Under policy option 1 , the number of hardware and software manufacturers that would introduce a SDLC and provide security updates throughout a product’s life cycle is unlikely to increase, considering that the additional guidance provided by the Commission would be just one more non-binding recommendation. Under policy option 2 , the number c ould only increase for manufacturers of products covered by NLF legislation and possibly very limited categories of non-embedded software products . Policy option 2 would therefore not provide any additional security for a wide range of critical products, and in particular for non-embedded software, which would remain largely unregulated from a security standpoint . Under policy option 3 , the number would increase dramatically for manufacturers of tangible products, as manufacturers would only be able to meet the requirements laid down by the EU horizontal rules by implementing a formalised approach to product security. As regards software manufacturers , they might eventually be required to take a systematic approach to security too (staggered approach). Under policy option 4 b) , all manufacturers of tangible and intangible products across the entire supply chain would be expected to take a systematic approach, which should lead to a substantial increase in product security, as manufacturers would not only need to take the security of processes and products seriously before the pla c ing on the market, but they would also have to introduce adequate vulnerability management measures, provide security updates beyond the pla c ing on the market and make information available to users helping them to choose the products with the best security properties and use these products in a secure way. These measures would be entirely absent from policy option 1 and only apply to a limited range of products under policy options 2 and 3. In the public consultation, regarding the question whether Horizontal cybersecurity requirements for products with digital elements would enhance and ensure a consistently high level of the security of products with digital element s , over 90 % of the respondents (strongly) agreed. Impacts on fundamental rights All policy options are expected to enhance to a certain extent the protection of fundamental rights and freedoms such as privacy, protection of personal data, conduct of business and property or personal dignity and integrity. Policy options 3 and 4 consisting of horizontal regulatory interventions are nevertheless expected to be more likely to help decrease the number and severity of incidents, including personal data breaches . In particular, policy option 4 covering the broadest scope, including all software would be the most effective in this regard . The horizontal cybersecurity requirements would contribute to the security of personal data by protecting the confidentiality, integrity and availability of information in products with digital elements . C ompliance with those requirements will facilitate compliance with the requirement of security of processing of personal data under the GDPR. Certain requirements, such as security by design and default, will also contribute to making the products more data-protection and privacy-friendly from the design phase. A horizontal intervention, and notably the most comprehensive in scope, i.e. option 4 b) , would enhance the transparency and information to users, including those that might be less equipped with cybersecurity skills. Users would also be better informed about the risks, capabilities and limitations of the products with digital elements , which would place them in a better position to take the necessary preventive and mitigating measures to reduce the residual risks. At the same time, the significance of the impacts on the protection of fundamental rights will depend on the degree of regulatory intervention, as presented below. Respondents to the open public consultation have rated the actual impact of a damage to fundamental rights caused by a cybersecurity incidents affecting products with digital elements as moderate to high, with an overall average rating of 3.8 (on a scale of 1 to 5), a 4.16 rating by users and 4.5 by consumer organisations. SME companies gave an overall rating of 4. As regards the overall impact of cybersecurity requirements on fundamental rights, the respondents to the public consultation consider that they would enhance the protection of privacy and personal data to a high degree (an average of 4.09 on a scale of 1 to 5). SME s rated the impact similarly at 4.1. The respondents also agreed to a great extent that the requirements would ensure a hig h level of consumer protection . SMEs also rated the impact high ( 4.4 out of 5 ) . Social impact Cybersecurity incidents have far-reaching consequences for society. Therefore, enhancing the cybersecurity of products with digital elements would also have positive social impacts such as reduced levels of cybercrime. Moreover, improving the transparency and information of users would have positive impacts for more vulnerable groups of users. Also, the initiative would have a positive effect on the labour market by creating new opportunities for cybersecurity trained specialists. It is expected that policy options 3 and 4 would ensure a higher level of cybersecurity for products with digital elements and would therefore have a stronger impact in the prevention of cybercrime and on social aspects in general. Since policy option 4 a) and b) would cover also standalone software (only critical for 4 a)) , considering the particular relevance of such products (such as apps) with strong social aspects, it would be expected that the positive impact of this policy option in this regard would be the highest. In addition to the four problem drivers addressed by the Commission’s planned intervention, three additional drivers were identified : “lack of bargaining power of users”, “lack of qualified security professionals” and “lack of cybersecurity awareness and skills of users”. While the initiative would not address those additional drivers directly, policy options 3 and 4 would contribute to a European security culture. Moreover, the additional efforts by manufacturers in raising the level of security of their products c ould further increase the demand for security professionals and would incentivise more citizens to consider a career in cybersecurity. Finally, as citizens would see the CE marking affixed to a wide range of products having undergone conformity assessment, the intervention would also lead to an increased awareness of the risks associated with products with digital elements , creating incentives for citizens to improve their understanding of cybersecurity issues. The consultation activities revealed that policy options 3 and 4 are expected to create to the greatest extent additional jobs in the relevant markets and in the whole economy (respectively scoring an average of 5.0 and 6.4 on a scale from 1 to 10 for the former and 5.6 and 6.6 for the latter). Policy options 3 and 4 are also considered to increase the demand for additional or new skills to the largest extent (respectively scoring an average of 6.6. and 7.4 on a scale from 1 to 10). Environmental impacts Strengthening the cybersecurity of products with digital elements could have positive environmental impacts by contributing to wider use of latest generation digital infrastructure and services, which are more sustainable and compliant with the latest environmental standards. I ncidents affecting critical infrastructure and manufacturing could in some instances have a negative impact on the environment, as incidents could result in harmful emissions, waste discharges as well as spills. Even though not many such incidents have occurred so far, cybersecurity experts consider the risk to pipelines or other critical infrastructure to be real. Depending on the policy option, the regulatory intervention could therefore prevent environmental damage by having a positive impact on the resilience of such entities, as it would improve the security of SCADA systems and other hardware and software deployed by critical infrastructure. Respondents to the open public consultation have rated the actual impact of an environmental damage caused by a cybersecurity incidents affecting products with digital elements as overall moderate. The average rating by all respondents was at 2.31 (on a scale of 1 to 5), with hardware and software manufacturers rating it at 1.82, users at 2.72 and consumer organisations at 5. W hile the expected environmental impacts for neither of the policy options would be major, strengthening the cybersecurity of products with digital elements through policy option 4 having the widest scope of application, could have the most positive environmental impacts by contributing to wider use of latest generation of more sustainable digital infrastructure and services. This was confirmed in the targeted consultation, where respondents have indicated that option 4 is be expected to minimise environmental damage to the greatest extent , with the other options scor ing lower . How do the options compare? Effectiveness : expected achievement of the objectives As regards effectiveness, options 3 and 4 featuring horizontal requirements are more likely to meet the general and specific objectives set out in s ection 4 compared to option 1 and 2 , since they entail a regulatory horizontal intervention which would condition the placement on the market of certain or all products with digital elements to the compliance with essential cybersecurity requirements. This would ensure that security would be incorporated in the design and development of these products and that cybersecurity would become a baseline for products with digital elements placed on the internal market, with a high potential to improve the security of these products and also to improve the way users choose such products based on their cybersecurity. Respondents to the open public consultation agreed that horizontal requirements would be the most effective measure, rating them with 4.08 on a scale from 1 to 5. Further voluntary European cybersecurity certification schemes for products with digital elements and services and E U public procurement guidelines taking into account cybersecurity requirements , as foreseen in policy option 1, were rated respectively at 2.99 out of 5, and 3.72 out of 5. A mending existing legislation regulating specific products with a digital dimension (such as the legislati on on lifts or gas appliances), as foreseen in policy option 2, rated overall 3.39 out of 5. In terms of security requirements , 90. 8 % of the stakeholders agreed with the fact that hardware manufacturers and software developers should be responsible for the full life cycle of a product with digital elements . Stakeholders overall rated cybersecurity by design and by default as very effective approaches to contribute to the cybersecurity of products with digital elements, rating them respectively at 4.81 and 4.42 (out of 5, with 5 meaning very effective). Of these two horizontal regulatory options, policy option 4 would be more likely to meet these objectives compared to option 3, since it would also cover in its scope non-embedded software, hence ensuring a higher level of security for a wider scope of products, often dependent on each other. Furthermore option 4 b) would be more effective compared to option 4 a) as it would cover all non-embedded software, while in option 4 a) only critical software would be covered. Option 4 b) would also have a higher potential to ensure legal certainty and avoid further fragmentation of the internal market with regard to cybersecurity requirements applicable to products with digital elements . Keeping the status quo or relying on ad hoc regulatory interventions as regards cybersecurity or national voluntary schemes, as i t would happen under policy options 1 and 2 , would by contrast further deepen such fragmentation. In terms of scope , stakeholders agreed with the effectiveness of applying cybersecurity requirements in the following way: hardware products (4.0 out of 5, with 5 indicating that they strongly agreed), embedded software (4.14 out of 5); all standalone software (3.7 out of 5); software products subject to higher cybersecurity risk (4.53 out of 5). While the effectiveness of covering standalone software was rated comparatively lower, this can be explained by a lower support from manufacturers (2.76 out of 5), while users still expressed a strong support (4.03 out of 5). The position of manufacturer is consistent with higher compliance costs linked to the coverage of all software products under policy option 4 b) (see 'efficiency' below). In terms of conformity assessment, the sub-option (ii) establishing t wo risk categories informing conformity assessment under policy option 3 and 4a) and b) would respectively be more effective than options 3i), 4a)i) and 4b)ii) to enhance the security of products with digital elements. The involvement of a third-party body in the testing of higher risk products was broadly supported by stakeholders. 95.10% of the respondents in the public consultation supported the fact that products with digital elements with a higher risk should be subject to a stricter process of demonstrating con formity with these requirements. Only 2.92 (out of 5) agreed that self-declaration of conformity by a hardware manufacturer or software developer gives a sufficient confidence that security requirements are met . 86.15% agreed that involvement of a third party should be requi red under certain circumstances. C onsidering the type of requirements, scope and conformity assessment procedure s , policy option 4 b) ii) appears as most effective to reach the specific objectives set in Section 4 . Efficiency and e conomic i mpacts P olicy options 1 and 2 are likely to bring limited compliance costs, being mostly based on the use of voluntary measures. At the same time, the benefits would equally be limited as they would be mostly related to the reduction of legal uncertainty due to guidance (policy option 1) or the coverage of certain legislative gaps (policy option 2). Amending the RED delegated act to bring in all software would likely increase the benefits under policy optio n 2 close to policy option 3. P olicy options 3 and 4 would bring respectively significant economic benefits linked to the reduction of costs due to reduced cybersecurity incidents, estimated in the range of respectively EUR 90 to EUR 140 billion under policy option 3) , EUR 97 to 158 b illio n under policy option 4 a) and EUR 180 to 290 b illio n under policy option 4 b) . At the same time, c ompliance costs would be higher under policy option 3 and 4, compared to policy option 1 and 2. U nder policy option 2, an exception is the scenario of broadening the scope of the RED delegated act to non-embedded software that would include higher compliance costs than under policy option 3 and 4 a). The compliance costs for manufacturers and other economic operators on the supply chain would be triggered both by the design and development of products with digital elements with security as an inherent feature and the conformity assessment processes that go with that . These compliance costs increase with the scope and with mandatory third-party testing. Therefore, they are the highest under policy option 4) b) ii). The table below presents the overview of all the economic impacts analysed in this report. Concerning the methodology for the comparison of impacts, the report generally operates with the “+/-“ rating system for impacts that were qualitatively assessed. To the extent possible, were quantitative data was available, the net impact and cost-benefit ratio has been estimated. The table evidences the net positive impact increasing with a broadened scope between policy option 3 and 4. The net positive impact is the highest for policy option 4 and its respective sub-options. While no granular quantitative data is available, it is reasonable to assume that the net positive impact would be the highest for policy option 4b) ii). It is not possible to define a detailed cost-benefit ratio comparison of sub-options. The cost-benefit ratio which is higher for policy option 3 compared to 4 can be explained by the absence of granular quant it ative data for benefits at the level of sub-options. While the benefits "only" double between policy option 3 and 4, the compliance costs increase more significantly as software products have lower BaU costs, e.g . for testing . Furthermore, the software market is slightly bigger compared to the hardware market . At the same time, benefits in terms of reduction of cyber incidents, competitiveness and prevention of internal market fragmentation increase with a broadened scope, and are expected to be the highest under policy option 4) b) ii). Under options 3 to 4 and their respective sub-options, the effects of additional compliance costs will have a larger relative cost impact on SMEs than on large companies. Such compliance costs would be the highest under policy option 4 b) ii). Even though the relative cost increases are higher for SMEs, the impact on SMEs overall costs is still considered moderate when measured against the benefits that would result from a reduced number of cybersecurity incidents that would be most significant under policy option 4 b) ii). SMEs rated the costs of voluntary measures in average at 3.1 out of 5 (with 5 indicating very costly), compared to 3.6 for policy option 2, and around 3.5 out of 5 for horizontal requirements. For Member States and public authorities , the direct costs would increase with a broader scope of products to be monitored , hence the direct costs would be the highest under policy option 4 b) . For the same scope, enforcement costs are expected to be higher without third party-assessment, under policy option 3 i) and 4a)i) and 4b)i) compared to 3 ii) and 4 a)ii) and 4b)ii). Public authorities will benefit under policy option 3 and 4 as users of products with digital elements from an enhance d security of products and reduced costs due to less cybersecurity incidents . Market surveillance authorities could also benefit in terms of efficiency from alignment of the provisions for market surveillance for harmonised and non-harmonised products with digital elements. Such benefits are expected to be the highest under policy option 4 b) ii). Consumers will benefit from the reduction of unsecure products with digital elements on the market. The trend of the impact of the different options on the reduction of costs due to cybersecurity incidents can be reasonably assumed to be similar as for businesses. Hence, they can expected to be the highest under policy option 4 b) ii). Consumers might face higher end-user prices on products with digital elements, which can be expected to be the highest under option 4 b) ii). However, these are not expected to be significant both in terms of quantitative and qualitative value to the consumers and will decrease over time (see section 6.3.4 ). Key Cost s /benefits Policy options PO 1 PO 2 PO 3 PO 4 3 (i) 3 (ii) 4a ) 4b ) 4a) i) 4a)i) 4b)i) 4b)ii) Businesses Costs Compliance costs (for average product development cost of 140 000 EUR) Neutral/+ +/++ EUR 11.2 bn EUR 1 1 . 3 bn 13 bn EUR 1 3 .1 bn EUR EUR 28.8 bn EUR 29 bn Compliance costs for SMEs + ++ ++ ++ ++ ++ ++ + ++ + Standardisation costs Neutral ++ + + ++ ++ ++ + ++ + End-user prices (indirect) Neutral/+ Neutral/+ + + ++ ++ +++ +++ Benefits Cost savings due to reduced cyber incidents Neutral + EUR 90 billion to EUR 140 bn annually EUR 97 b n to EUR 158 b n EUR 180 to 290 bn annually Prevent internal market fragmentation Neutral / - Neutral / - + + ++ ++ +++ +++ Increased c ompetitiveness & uptake of products with digital elements Neutral Neutral + + ++ ++ +++ +++ Net value* EUR 77.8 - 127.8 bn EUR 9 3 bn - 144 .9 bn EUR EUR 1 51 - 2 61 bn Cost benefit ratio* 7.4 - 11.5 7.4 - 12.1 6. 2 - 10 Public authorities Benefits R educed cyber incidents Neutral + ++ ++ ++/+++ ++/+++ +++ +++ Costs MS authorities - enforcement costs (average for products on the market) Neutral/+ ++ EUR 3.1 bn EUR 3.1 bn EUR 3.6 bn EUR 3.6 bn EUR 7.7 bn EUR 7.7 bn ENISA - collecting and disseminating information on exploited vulnerabilites ( redistribution of ressources ) N.A. N.A. 2.5 FTEs 2.5 FTEs 3.5 FTEs 3.5 FTEs 4.5 FTEs 4.5 FTEs Consumers Benefits R educed cyber incidents Neutral + ++ ++ ++/+++ ++/+++ +++ +++ Enhanced consumer choice & transparency + + ++ ++ ++ ++ ++ + ++ + Costs End-user prices (indirect) Neutral/+ Neutral/+ + + ++ ++ +++ +++ * based on available quantitative data Table SEQ Table \* ARABIC 9 : Comparison of policy options according to the economic impact and efficiency Social impacts, impacts on fundamental rights and environmental impacts As regards the social impact, as well as the impact of fundamental rights , and notably data protection and protection of privacy, it is expected that policy options 3 and 4 would have a more positive impact, as attacks affecting insecure products with digital elements have serious consequences in the personal sphere and for society as a whole. Therefore, these two policy options, which would ensure a higher level of cybersecurity for these products, would be more impactful on fundamental rights and social aspects. Since policy option 4 a) and b) would cover also standalone software, considering the importance of such products (such as apps) for social aspects and personal data, it would be expected that the positive impact would be the highest for policy option b) . Furthermore, third-party assessment would increase the assurance level of the security of higher risk hardware and software products, hence the social impact and impact on fundamental rights would be the highest for policy option 4 b) ii). No major environmental impact is expected for any of the policy options considered. However, strengthening the cybersecurity of products with digital elements notably through policy option 4 which would have the widest scope of application could have positive environmental impacts by contributing to wider use of latest generation digital infrastructure and services, which are more sustainable. Coherence As regards the coherence with the EU strategic policy priorities in the area of cybersecurity , policy options 3 and 4 would deliver the most on t he establishment of common European cybersecurity standards for connected products as forseen under the EU’s Cybersecurity Strategy for the Digital Decade . Policy option 4 b), presenting the widest scope and covering all products with digital elements, would be the most aligned with the announced objective. Regarding other horizontal EU legislation in the area of cybersecurity , both policy 3 and 4 would present strong synergies with the supply chain security requirements included in the NIS2 Directive , no w close to completing adoption . E ntities under NIS2 will have to consider the vulnerabilities specific to each direct supplies (such as of software for example) and the overall quality of products and cybersecurity practices of their suppliers, including development procedures. Horizontal requirements for all products with digital elements, including third-party assessment for higher risk products, as foreseen under policy option 4 b) ii) , would strengthen this provision most and close the circle of supply chai n security guarantees . Regarding the EU Cybersecurity Act , policy option 1 would be the most coherent as it foresees to continue developing such schemes. However, both under policy option 3 and 4, a certificate or statement of conformity issued under a n European cybersecurity certification scheme may be used to demonstrate the presumption of conformity with requirements of that legal act . As regards the coherence with other relevant product legislation , both policy options 3 and 4 and respective sub-options, would include specific cybersecurity requirements of the likes that are not currently covered by the NLF legislation. Furthermore, the act setting out the horizontal cybersecurity requirements would set out a rule of the type of lex specialis, specifying that w here, for a certain category of products with digital elements , the cybersecurity risks addressed by the essential requirements are covered by other more specific requirements of other Union harmonization legislation, these horizontal requirements shall not apply to those products to the extent that that specific Union legislation covers such risks. As regards the RED Delegated Regulation for inter-connected radio equipment, it would be implemented until the horizontal requirements start applying . As the horizontal requirements would be more specific , the RED Delegated act requirements would become obsolete. Alternatively, compliance with the horizontal cybersecurity requirements could be presumed to provide compliance with the cybersecurity requirements of RED delegated act. Moreover, when preparing the standardisation request for the horizontal cybersecurity requirements, it will be ensured that the standardisation work done for the RED Delegated Regulation is preserved and complemented only where needed. When it comes to the coverage of the whole life cycle and duty of ca re , policy options 3 i) and ii) and 4 a) and b) would be compatible with the future EU framework on liability for defective products, to be review ed , which is expected to introduce liability for situations when damages a re triggered by vulnerabilities . The liability of an economic operator may be reduced or disallowed when, having regard to all the circumstances, the damage is caused both by a defect in the product and by the fault of the injured person [including, for example, rejecting a software security update] or any person for whom the injured person is responsible . Proportionality As regards the proportionality of the intervention , policy options 3 , 4 a) and b) do not go beyond what is necessary to meet the specific objectives satisfactorily. Any additional compliance costs would be outweighed by the benefits brought by a higher level of security of products with digital elements and ultimately an increase of trust of users in these products. For these reasons, but also for the need to ensure legal certainty and avoid any further fragmentation of product-related requirements on cybersecurity on the internal market, the open public consultation and the targeted consultation have shown a wide overall support of various stakeholders , both industry and national authorities for a horizontal intervention setting out cybersecurity requirements for products with digital elements . S takeholder support In the public consultation , respondents were asked to rate the effectiveness of various types of policy interventions ranging from further voluntary certification schemes and amending existing legislation regulating specific products to mandatory horizontal cybersecurity requirements for hardware and software. Respondents agreed that horizontal requirements for hardware and software would be the most effective measure , and rated it respectively 4.08 and 4.09 on a scale from 1 to 5. This includes consumer organisations (5.00), respondents identifying themselves as users (4.22), notified bodies (4.17), MSAs (5.00) and manufacturers of products with digital elements (3.85), as well as SME users and manufacturers (4.05). The other types of interventions were rated as follows: Further voluntary European cybersecurity certification schemes for products with digital elements and services: overall (2.99), national market surveillance bodies (2.0), consumer associations (1.3), public administrations as users (2.9), SMEs as users (3.2), hardware manufacturers (2.5), software manufacturers (3.4), SMEs in their role as manufacturers (2.7). EU public procurement guidelines taking into account cybersecurity requirements: overall (3.72), national market surveillance bodies (2.5), consumer associations (2.3), public administrations as users (4.1), SMEs as users (4.2), hardware manufacturers (3.3), software manufacturers (4.1), SMEs in their role as manufacturers (3.7). Amending existing legislation regulating specific products with a digital dimension (such as the legislation on lifts or gas appliances): overall (3.39), national market surveillance bodies (3.5), consumer associations (3.0), public administrations as users (4.5), SMEs as users (3.5), hardware manufacturers (2.2), software manufacturers (3.3), SMEs in their role as manufacturers (2.1). There are several reasons why policy option 4 is broadly supported by the manufacturers of products with digital elements despite the relatively high cost compared with other types of intervention. First of all, the security of products with digital elements also depends on the security of components integrated into those products. Manufacturers therefore have to rely on their upstream supply chain manufacturers taking security seriously. A horizontal intervention would ensure that manufacturers could integrate components developed to meet certain security requirements. Secondly, a horizontal intervention would provide manufacturers with a high degree of legal certainty, as it would do away with the current piecemeal approach of Union NLF product legislation when it comes to cybersecurity. Finally, under a horizontal intervention, higher costs related to cybersecurity would no longer translate into a competitive disadvantage for manufacturers , as their direct competitors would be required to develop products living up to the same high standards. As stressed under 'efficiency', there is nevertheless a concern by manufacturer regarding the compliance costs related to the inclusion of all non-embedded software into the scope of a possible horizontal initiative (as foreseen under option 4b). On the contrary, such an approach is strongly supported by users. Overview and overall assessment of all policy options The table below presents a simplified overview of negative and positive impacts by type of impact. left 104384 The symbols ⬛ and ⬛ indicate respectively positive and negative impacts as compared to the status quo. For each symbol a maximum scale of 1 to 3 (maximum positive or negative assessment) is used. *) Synergies with other relevant legislation 0 0 The symbols ⬛ and ⬛ indicate respectively positive and negative impacts as compared to the status quo. For each symbol a maximum scale of 1 to 3 (maximum positive or negative assessment) is used. *) Synergies with other relevant legislation Table SEQ Table \* ARABIC 10 : Overall impact of the various policy options While Option 1 is causing no major additional costs for businesses and MSAs, it is unlikely to be adequate to address the problems identified. While legal uncertainty will be slightly reduced due to Commission guidance, it will not have the effect to significant ly chang ing security market practices. Option 1 is also expected to deepen market fragmentation in the absence of horizontal cybersecurity requirements. Option 2 is causing limited compliance costs except under the scenario where the RED delegated act would be extended to include all software, where compliance costs would be high (for economic operators and MSAs). Option 2 would only partially adequate ly address the identified problems, as gaps will remain regarding the coverage of hardware (e.g. wired hardware). Furthermore, option 2 could also have the effect of deepen ing market fragmentation by taking a product-specific approach instead of introducing horizontal requirements. Option 3 is linked to somewhat higher additional compliance costs, however lower than Option 2 (under the scenario of amending RED delegated act). Horizontal requirements for hardware and software received strong stakeholder support. Both under 3i) and 3ii) horizontal requirements would avoid market fragmentation for hardware products and embedded software. While compliance costs would slightly increase under option 3ii), mandatory third-party assessment for higher risk products would be even more effective to enhance cybersecurity, and ease market surveillance. However, under option 3, a significant gap would remain for enhancing cybersecurity of and preventing market fragmentation for non-embedded software products. Option 4 would lead to higher costs for businesses and market surveillance authorities, while such costs would be lower under option 4 a) if only critical software is covered, compared to option 4 b). Option 4a) including third-party assessment received strong stakeholder support. Most stakeholders disagreed that self-assessment could be sufficient. However, option 4 a)ii) would again leave a gap for a large part of the software market (estimated at 90%). Option 4 b) including third-party assessment would bring the most significant compliance costs. It was nevertheless strongly supported by stakeholders. The compliance costs would be proportionate to the significant cost savings that can be drawn from reduced cybersecurity incidents and from having to comply with multiple product-specific cybersecurity requirements. Under option 4 b)ii) mandatory third-party assessment for higher risk products would be even more effective to enhance trust of users , and ease market surveillance, while higher compliance costs would be limited to a narrow category of products presenting a higher risk. Preferred option Rationale and benefits of the preferred option Policy option 4 sub-option b) ii) emerges as the preferred option based on the assessment of effectiveness against the specific objectives and efficiency of costs versus benefits , and coherence with the existing EU and policy framework . The option would deliver the best results, while compensating higher compliance costs with significant cost savings. It would have the highest compliance costs, both for businesses and MSAs and slightly higher prices for end-users. However, it would also bring the highest benefits in terms of costs savings due to the reduction of cybersecurity incidents and harmonised cybersecurity requirements. Furthermore, additional compliance costs for conformity assessment would only apply to a limited category of products justified on the basis of their higher risk . O ption 4 b) would ensure the setting out of specific horizontal cybersecurity requirements for all products with digital elements being placed, made available in the internal market , and would be the only option covering the entire digital supply chain . Standalone software, equally exposed to vulnerabilities, would also be covered by such regulatory intervention, thus ensuring a coherent approach towards all products with digital elements , with a clear share of responsibilities of various economic operators. This would ensure a design and development of products with digital elements that would have cybersecurity as an ingrained feature, while at the same time guaranteeing a proportionate approach that would avoid unnecessary burden on manufacturers and the other economic operators on the value chain. The security requirements set out would be objective-oriented and not product- or sector-specific, while at the same time ensuring sufficient granularity to generate a tangible impact on the level of cybersecurity of products with digital elements . As regards the way in which manufacturers would be able to demonstrate conformity with the security requirements, sub-option (ii) emerges as the preferred choice: two risk categories informing self-assessment ( by default ), third-party conformity assessment ( for critical products ). Sub-option (ii) is proportionate, as the vast majority of products with digital elements would be subject to self-assessment, which is generally associated with the lowest administrative burden and compliance costs for manufacturers. At the same time, it would also be effective in ensuring an adequate level of assurance for a small number of products carrying a higher risk, by subjecting these products to mandatory third-party conformity assessment. This policy option also brings added value by covering duty of care and whole life cycle aspects after the placement of the products with digital elements on the market, to ensure, among others, appropriate information on security support and provision of security updates. This policy option would also come to most effectively complement the recent review of the NIS framework, by ensuring the prerequisites for a strengthened supply chain security. Application of the ‘one in, one out’ approach "INs" : administrative costs related to third-party assessment (certification), documentation and reporting The preferred option is likely to lead to an increase of compliance costs for businesses. The total market affected is detailed in section 5.1 , and would represent a total turnove r of up to EUR 1 485 billion and 615 272 companies/products (see also Annex 3 ) . First, hardware and software manufacturers will be impacted by adjustment costs as a result of the new and additional cybersecurity requirements and internal testing costs . And secondly, conformity assessment procedures involving a third-party when placing products on the market and documentation requirements will lead to additional administrative costs. These adjustment and administrative costs and the methodology behind them are explained in detail in section 6 , including the limitations beh ind these quantitative estimates . In total, it is estimated that t his initiative would lead to additional administrative costs of approximately EUR 8.9 b illio n for the whole of the EU ('IN'), taking into account BaU costs . The one-off administrative costs would amount to EUR 7 . 6 b illio n , with recurrent costs of EUR 1 . 3 b illio n. These costs have to be put into perspective with the administrative savings linked to this initiative ('OUT') detailed below. The administrative costs under the preferred option are estimated under section 6 , and summarised in table 7 . They include the costs related to certification that would apply to 10% of the market (estimated share of critical products with digital elements, estimated at EUR 1.1 bn, or 25 000 EUR by company/product with BaU costs at 40% for hardware manufacturers and 25% for software manufacturers , see Annex 4 ) and costs related to conformity other than certification (EUR 7.8 bn, or 12 600 EUR by company/product). The impacted market is represented by the indicators SD and ICT-EXT-ADJ. Furthermore, the assumption is taken of one product by company and an average product development cost of 140 000 EUR. In order to distinguish between one-off and recurrent costs , regarding the third-party assessment costs, at a level of a company, for each new product that has to be tested the one-off costs will be higher than recurrent costs, therefore it is assumed that 70% of the costs represent one-off costs (e.g. auditing and reviewing of documentation by external party and fees to notified body) and that 30% represent recurrent costs related to the maintenance of the certification (e.g. regular audit for the maintenance of the certification). However, this differentiation of one-off and recurrent costs could not be corroborated by secondary or primary data. Regarding other types of administrative costs, including documentation and reporting, no granular data is available. For documentation and information obligations, it is estimated that the one-off costs would be slightly higher (linked to the creation of the documentation), while recurrent costs would still exist due to the obligation for the manufacturer to keep its documentation up to date and to provide information to the users throughout the lifecycle. A significant part of the other types of administrative costs could be linked to reporting obligations. The costs of reporting obligations would be both one-off (e.g. putting in place a reporting system) and recurrent. Based on the primary data gathered , it is assumed that the documentation and reporting obligations would respectively represent 60 % and 4 0% of the total costs. Furthermore, both for documentation and reporting obligations, one-off costs would be higher than recurrent costs , and can be estimated respectively around 12.5% based on the same primary data . In detail, the administrative costs related to documentation and reporting can be described as follows : Requirements related to the declaration of conformity and marking of the digital products Where compliance of the product with the applicable requirements has been demonstrated by that procedure, draw up an EU declaration of conformity and affix the CE marking. Keep the E U declaration of conformity up-to-date. Ensure that each digital product is accompanied by a copy of the EU declaration of conformity. Keep the EU declaration of conformity for 10 years after the product has been placed on the market. Keep a register of complaints, non-conforming products and product recall, and keep distributors informed of any such monitoring. Ensure that products bear a type, batch or serial number or other element allowing their identification, or, where the size or nature of the product does not allow it, that the required information is provided on the packaging or in a document accompanying the product. Indicate the manufacturers' name, registered trade name or registered trademark, and the address at which they can be contacted, on the product or, where that is not possible, on its packaging or in a document accompanying the product. Requirements related to reporting of the digital products Report to ENISA exploited vulnerabilities and incidents having an impact on the security of the product with digital elements. Inform the user about any incident having an impact on the security of the product with digital elements. Immediately inform the relevant national competent authority should the product present cybersecurity risks that pose threats to the general public or the life and health of persons. Upon identifying a vulnerability in an open-source component and where the manufacturer or developer has integrated the component into its product, report the vulnerability to the maintainer of the component. Further to a reasoned request from a competent national authority, provide it with all the information and documentation necessary to demonstrate the conformity of the product, in a language, which can be easily understood by that authority. Cooperate with that authority, at its request, on any action taken to eliminate cybersecurity risks posed by the product, which they have placed on the market. Requirements related to technical documentation of the digital products Draw up the ne cessary technical documentation before the pr oduct is placed on the market in a language that is accepted by the notified body. Keep the technical documentation up-to-date. Keep the technical documentation for 10 years after the product has been placed on the market. Make the technical documentation available to authorities upon request. The table below summarises the administrative costs related to certification, documentation and reporting for o ne company /product, and at aggregated level. The costs are based on the products currently available on the market (using the SD and ICT-EXT-ADJ indicators), as it is not possible to estimate how many products will arrive on the market every year. In practice , the new obligations under the preferred option wou l d only apply after a transition period to new products placed on the market (grandfathering clause ). The re curent costs are assumed to be annual. These estimations were made based on limited quantitative data available. Therefore, the first evaluation of this initiative (see Section 9 ) should explore a more granular assessment of the administrative costs on businesses. Per company One-off costs Recurrent costs (annual) Total Administrative costs linked to testing Certification for critical products (third-party conformity assessment) By company/product: EUR 17 500 Aggregated costs: EUR 0.8 bn (70% of the costs are audit cost by the notified body to obtain the certification) By company /product : EUR 7 500 Aggregated costs: EUR 0.3 bn (30% are related to monitoring the certification,) Average b y company/product 25 000 EUR (with BaU costs of 40% for hardware manufacturers and 25% for software developers) Aggregated: EUR 1.1 bn Other administrative costs : documentation and reporting Documentation, such as creation and updating of technical documentation, EU declaration of conformity; affixing the CE marking; Creation of and updating the risk assessment; Information and instructions for the user, including when providing software updates. By company/product: 6615 Aggregated costs: EUR 4 . 1 bn By company/product: 945 EUR Aggregated costs: EUR 0.6 bn by company/product: 9% of product development costs (in average additional EUR 12 600 , of which EUR 7560 documentation and 5040 reporting costs, for average product development costs of 140 000 EUR) Aggregated : EUR 7.8 bn ( of which EUR 4.7 bn for documentation and EUR 3.1 bn for reporting) Reporting to market surveillance authorities Reporting of exploited vulnerabilities and cybersecurity incidents to ENISA By company/product: EUR 4410 Aggregated costs: EUR 2. 7 bn By company/product: EUR 630 Aggregated costs: EUR 0 . 4 bn TOTAL By company/product (in average): EUR 25 060 (for average development costs of 140 000 EUR, ca. 17% additional product development costs ) Aggregated average: EUR 7 . 6 bn By company (in average): EUR 12 540 for average development costs of 140 000 EUR, ca. 9% additional product development costs ) Aggregated average: EUR 1 .3 bn by company/product covered by the initiative: EUR 37 600 , ca. 26% additional product development costs , for an average of 140 000 product development costs. Aggregated: 8.9 bn EUR Table SEQ Table \* ARABIC 11 : Overview of one-off and recurrent administrative costs "OUTs" : administrative savings due to reduced compliance costs with the upcoming NIS2 Directive The administrative costs should be offset with removed administrative costs linked to the initiative. In total, these administrative cost savings are estimated to represent approximately EUR 6.95 b illio n . Administrative costs savings are related to two main sources. First, the initiative will facilitate compliance with administrative costs related to supply chain managamenet under the upcoming NIS2 Directive. Second, the initiative will prevent fragmented rules at national and EU level related to the cybersecurity of products with digital elements. Only the first source of potential administrative savings could be quantified. Under the upcoming NIS 2 Directive , entities must take cybersecurity risk management measures, including measures to secure their supply chains. The approximately 110 000 entities in the scope of NIS2 would therefore experience significant cost savings brought about by the preferred policy option , which would enhance the security of the products with digital elements used in the whole supply chain . S upply chain requirements under NIS2 would for instance include managing the contractual relationships with suppliers and auditing suppliers to verify that purchased products comply with the cybersecurity requirements. In the context of the Impact Assessment of the NIS2 Directive, the costs related to "Security elements concerning supplier relationships and supplier-specific risk assessment " where estimated as one-off costs of hiring in average 1 FTE by company , and a potential increase of 2-4% in recurrent purchase ICT security costs . One FTE position can be estimated at a cost of EUR 66 560 , which would represent EUR 7.3 b illio n one-off costs for the 110 000 entities covered by NIS2. According to the Commission’s impact assessment for the revision of the NIS Directive, the average ICT security spending of companies in 2020 is of approximately 9.14 % of their ICT spending. According to an ENISA survey , the median spending of an entity covered by NIS for IT security spending was EUR 2 million per entity in 2020, which leads to an aggregated value of EUR 220 b illio n , of which 2-4% (taking an average of 3%) would amount to EUR 6.6 b illio n recurrent costs. Taking into account that the initiative will not apply directly to IT services , it is assumed that the initiative would lead to 5 0% of compliance cost reduction with the requirement related to supply chain security for e ssential and important entities. Hence, the cost savings would respectively represent in total EUR 6 . 95 b illio n , with EUR 3 . 65 b illio n from one-off costs and EUR 3.3 b illio n recurrent costs . Cost savings One-off cost savings Recurrent cost savings Costs savings on compliance with NIS2 obligations (supply chain security requirement for essential and important entities) By company: 0.5 FTE (in average: EUR 33 280) for NIS entities Aggregated average: EUR 3.65 bn By company: 1-2% additional ICT security spending, for NIS entities (around 30 000 EUR by company, taking an average of 1.5%) Aggegrated average: EUR 3.3 bn Administrative costs Aggregated average: EUR 7.6 bn Aggregated average: EUR 1.3 bn Total Administrative burden (administrative costs minus cost savings) Aggregated: EUR 3 . 9 5 bn Aggregated: - EUR 2 bn Table SEQ Table \* ARABIC 12 : Overview of cost savings and total administrative burden Moreover, cost savings would stem from hvaing one horizontal framework. T nstead of potentially conflicting rules at national level or a piec emeal approach at EU level, the preferred option is likely to offset compliance costs by introducing one set of streamlined requirements for the same type of product with digital elements at EU level, which would reduce regulatory costs for the manufacturers . Indeed, most stakeholders favour a harmonised and coordinated approach at the EU level as revealed in the open public consultation, targeted survey, workshops and interviews. However, the costs related to streamlining security requirements could not be estimated. Taking into account on the one side, the administrative costs related to the initiative under the preferred policy option and on the other side, the administrative savings, the total administrative burden of the preferred option for businesses operating in Europe would be of approximately EUR 1.95 b illion , for an overall market value covered by the initiative of up to EUR 1317 billion in production value and EUR 14 85 billion in turnover (based on 2019). How will actual impacts be monitored and evaluated? By [ 36 months ] after the date of application of the initiative and every four years thereafter, the Commission shall submit a report on the evaluation and review of the initiative to the European Parliament and to the Council . The report shall be made public. The application of the regulation should in principle be set for approximately 24 months following its entry into force, to allow sufficient time to the economic operators to adapt and prepare adequate implementation. As regards the monitoring of the impact of the regulation, certain indicators would be considered for this purpose, to be assessed by the Commission, where appropriate with the support of ENISA. Depending on the operational objective to be reached, some of the monitoring indicators based on which the success of the horizontal cybersecurity requirements would be assessed are as follows: For assessing the level of cybersecurity of products with digital elements : S tatistics and qualitative analysis on incidents affecting products with digital elements and the way these were handled. These could be gathered and assessed by the Commission and be based on the information reported to ENISA. R ecords of known vulnerabilities and analyses of how these were handled. Such analysis could be conducted by ENISA , based on the European vulnerability data base set up based on NIS2 and information reported to ENISA under this initiative. S urveys amongst manufacturers of hardw are and software to monitor progress. For assessing the level of information on security features, security support, end-of-life and duty of care : results of surveys to be conducted by the Commission, with support from ENISA for both consumers and businesses. For assessing the implementation, the Commission would aim to ensure that the conformity assessments are effectively performed . To this end, the coordination of notified bodies will be promoted. Furthermore a standardization request could be issued and its implementation followed. The Commission will also ver if y the capacity of the notified bodies. As regards the application , by means of the reports of Member States, the Commission will verify that national initiatives do not concern aspects covered by the regulation. The following table lists provisional and non-exhaust ive indicators, indicating how meeting the set general and specific objectives can be measured. Specific objective Indicator Baseline Frequency Target Source Ensure that manufacturers improve the security of their products with digital elements since the design and development phase and throughout the whole life cycle of those products Number of serious incidents in the Union resulting from vulnerabilities in products with digital elements 2024 Annual Reduction of incidents by roughly 20 to 33 % (difficult to measure as other developments may influence the outcome) Aggregate incident reporting mechanism under the NIS2 Share of hardware and software manufacturers that follow a systematic secure development life cycle 2024 Biennial 100 % Surveys amongst hardware and software manufacturers Qualitative analysis of the security of products with digital elements 2024 Biennial n/a ENISA, surveys amongst security experts Maturity of secure development practices in manufacturers: quantitative and qualitative assessment of vulnerability databases; frequency of security patches made available by manufacturers; average number of days between vulnerability discovery and the provision of security patches 2024 Biennial Reduction of vulnerabilities by 20 to 33 % (difficult to measure as other developments may influence the outcome) Higher frequency of patches Shorter average number of days between vulnerability discovery and the provision of security patches ENISA, market surveillance, surveys amongst security experts, European vulnerabilities database set up on the basis of NIS2 , cybersecurity studies Ensure a coherent cybersecurity framework Absence of targeted product-specific national cybersecurity legislation 2024 Biennial Absence of targeted product-specific national cybersecurity legislation Surveys, studies, TRIS notification procedure under Directive 2015/1535 Enhance the transparency as regards the security properties of products with digital elements Share of products with digital elements that are shipped with information on security properties 2024 Biennial 100 % of products with digital elements shipped with information on security properties ENISA, market surveillance bodies, studies Enable organisations and consumers to use products with digital elements securely Share of products with digital elements that are shipped with user instructions on secure use 2024 Biennial 100 % of products with digital elements shipped with user instructions on secure use ENISA, market surveillance bodies, studies Table SEQ Table \* ARABIC 13 : Indicators for monitoring and evaluation Glossary of abbreviations Acronym Meaning AI Artificial Intelligence B2B Business to Business B2C Business to Customer BaU Business as Usual CAGR Compound Annual Growth Rate CLA Cybersecurity Labelling Scheme CN Combined Nomenclature CPU Central Processing Unit CRA Cyber Resilience Act CSD Consumer Sales Directive CSIRTs Cyber Security Response Teams DDoS Distributed Denial of Service DoC Declaration of Conformity DoP Declaration of Performance eIDAS (Regulation) Regulation on electronic identification and trust services for electronic transactions in the internal market ENISA European Union Agency for Cybersecurity EO Executive Order (US) FTE Full Time Equivalent GDPR General Data Protection Regulation GPSD General Product Safety Directive GPSR General Product Safety Regulation (proposal) IA Impact Assessment IaaS Infrastructure as a service (cloud service model) ICS Industrial Control System ICT-SC ICT – standard classification IoT Internet of Things METI Ministry of Economy, Trade and Industry of Japan MDR Medical Devices Regulation MID Measuring Instrument Directive MR proposal Machinery Regulation Proposal MSA Market Surveillance Authority MSD Market Surveillance Services Directive MSR Market Surveillance Regulation NIS (Directive) Directive concerning measures for a high common level of security of network and information systems across the Union NIST National Institute of Standards and Technology – US Department of Commerce NLF New Legislative Framework NTIA National Telecommunications and Information Administration (US) OSS Open Source Software OT Operational Technology OWASP Open Web Application Security Project PaaS Platform as a service (cloud service model) PED Pressure Equipment Directive RED Radio Equipment Directive RRD Recreational Craft and Personal Watercraft Directive SaaS Software as a Service (cloud service model) SBOM Software Bill of Materials SDLC Secure Development Life Cycle SMEs Small and Medium -sized Enterprises SOCs Security Operation Centres TFEU Treaty on the Functioning of the European Union TSD Toy Safety Directive Glossary of terms and definitions Term Meaning or definition Ancillary service A digital service the absence of which would prevent the product [tangible and intangible] from performing one of its functions CE marking The letters ‘CE’ appear on many products traded on the extended Single Market in the European Economic Area (EEA). They signify that products sold in the EEA have been assessed to meet high safety, health, and environ mental protection requirements. Certification The provision by an independent body of written assurance (a certificate) that the product, service or system in question meets specific requirements , following certain procedures . Conformity assessment T he process demonstrating whether specified requirements relating to a product, process, service, system, person or body have been fulfilled (point (12) of Article 2 of Regulation (EC) No 765/2008) . Conformity self-assessment A conformity assessment performed by the manufacturer without third party involvement. The manufacturer himself or an accredited in-house conformity assessment body that forms a part of the manufacturer's organization, carries out all required controls and checks, establishes the technical documentation and ensures the conformity of the production process. Cybersecurity The activities necessary to protect network and information systems, the users of such systems, and other persons affected by cyber threats Product with digital elements Hardware and software p roducts which can be directly or indirectly connected to another device or network, as follows: any device or group of inter–connected or related devices, one or more of which, pursuant to a program, perform automatic processing of digital data . E.g. end devices such as: laptops, smartphones, sensors and cameras; smart robots; smart cards; smart meters; mobile devices; smart speakers or networks, such as: routers; switches. e mbedded software: Firmware or other software that is essential for the primary function of the end-product and is either: (i) pre-installed in a product; or (ii) separately placed on the market by the manufacturer and downloaded to a product at a later stage. E.g. firmware, basic operating systems; network system; storage and security management. n on - embedded software (‘standalone’ software): Software that is additional to the primary function of the device on which it is downloaded. E.g. extended operating system, mobile apps. Distributed denial-of service (DDoS) attack A malicious attempt to disrupt the normal traffic of a targeted server, service or network by overwhelming the target or its surrounding infrastructure with a flood of internet traffic. End of life (of a product with digital elements ) The state of a product having reached the end of its first use until its final disposal. European cybersecurity certification scheme According to the EU Cybersecurity Act, it means a comprehensive set of rules, technical requirements, standards and procedures that are established at Union level and that apply to the certification or conformity assessment of specific ICT products, ICT services or ICT processes . Intended purpose The use for which a product with digital elements is intended by the provider, including the specific context and conditions of use, as specified in the information supplied by the provider in the instructions for use, promotional or sales materials and statements, as well as in the technical documentation Life cycle (of a product with digital elements ) Consecutive and interlinked stages of a product from first use to final disposal. New Legislative Framework (NLF) A framework built on Regulation (EC) No 765/2008 and Decision No 768/2008/EC bringing together all the elements required for a comprehensive regulatory framework to operate effectively for the safety and compliance of industrial products with the requirements adopted to protect the various public interests and for the proper functioning of the single market. The new legislative framework was adopted to improve the internal market for goods and strengthen the conditions for placing a wide range of products on the EU market. It is a package of measures that streamline the obligations of manufacturers, authorised representatives, importers and distributors, improve market surveillance and boost the quality of conformity assessments. It also regulates the use of CE marking and creates a toolbox of measures for use in product legislation. Source: European Commission, Internal Market, Industry, Entrepreneurship and SMEs Ransomware Type of malware that prevents or limits users from accessing their system, either by locking the system's screen or by locking the users' files until a ransom is paid Software Bill of Materials (SBOM) Document or description that provides details about the components used to build a software application. Open source project A project that anybody is free to use, study, modify, and distribute your project for any purpose. Open source software (OSS) Software that is distributed with its source code, making it available to anyone and for any purpose with all its rights. It grants users the rights to use, study, change, modify and distribute. Open-source software may be developed in a collaborative public manner. Placing on the market The first making available of the product on the Union market. Making available on the market Any supply of a product for distribution or use on the Union market in the course of a commercial activity, whether in return for payment or free of charge. Small and medium-sized companies An enterprise that satisfies the criteria laid down in Commission Recommendation 2003/361/EC of 6 May 2003 concerning the definition of micro, small and medium-sized enterprises (OJ L 124, 20.05.2003, p. 36): employs fewer than 250 persons, has an annual turnover not exceeding €50 million, and/or an annual balance sheet total not exceeding €43 million. Standard A technical specification, adopted by a recognised standardisation body, for repeated or continuous application, with which compliance is not compulsory. There could be international, European, harmonized and national standards. Supply chain Network between an entity and its suppliers to produce and distribute a specific product or to provide a certain service to the end user. Supply chain security Ensuring appropriate measures concerning security-related aspects of the relationship between and entity and its suppliers or service providers. This may entail for an entity to take account of the vulnerabilities specific to each supplier or service providers, the quality of products and cybersecurity practices of their suppliers and service providers, including security development procedures, etc. Third party conformity assessment Under the New Legislative Framework, a conformity assessment that requires the intervention of a third party, e.g. an external conformity assessment body (so-called " not ified body") . Such a body must be impartial and fully independent from the organisation or the product it assesses . Users Companies, public administrations, consumers as well as any other types of entities that deploy and operate products with digital elements , including essential and important entities covered by the revised NIS Directive (such as operators of critical infrastructure) . Vulnerability Vulnerabilities are weaknesses in the computational logic of a digital system that, once discovered, provide attackers with an opportunity to breach the system. Article 4(8) of the Commission’s proposal for a revision of the NIS Directive (COM(2020) 823 final) defines a vulnerability as a “weakness, susceptibility or flaw of an asset, system, process or control that can be exploited by a cyber threat” . Zero-day vulnerabilities Vulnerabilities discovered by attackers before hardware or software manufacturers become aware of them. As a result, zero-day vulnerabilities can be exploited before the manufacturer has the possibility to develop a fix. List of tables TOC \c "Table" Table 1: Problem drivers, specific objectives and policy options PAGEREF _Toc113494619 \h 23 Table 2: Main impacts and stakeholders affected PAGEREF _Toc113494620 \h 40 Table 3: Overview of compliance costs on businesses under policy option 1 PAGEREF _Toc113494621 \h 43 Table 4: Overview of compliance costs on businesses under policy option 2 PAGEREF _Toc113494622 \h 45 Table 5: Overview of aggregated compliance costs on businesses under policy option 3. PAGEREF _Toc113494623 \h 47 Table 6: Overview of aggregated compliance costs on businesses by sub-option under policy option 4 PAGEREF _Toc113494624 \h 50 Table 7: Overview of aggregated direct costs versus benefits for businesses by policy option 4 PAGEREF _Toc113494625 \h 54 Table 8: Overview of aggregated costs for public authorities by policy option PAGEREF _Toc113494626 \h 60 Table 9: Comparison of policy options according to the economic impact and efficiency PAGEREF _Toc113494627 \h 76 Table 10: Overall impact of the various policy options PAGEREF _Toc113494628 \h 80 Table 11: Overview of one-off and recurrent administrative costs PAGEREF _Toc113494629 \h 85 Table 12: Overview of cost savings and total administrative burden PAGEREF _Toc113494630 \h 86 Table 13: Indicators for monitoring and evaluation PAGEREF _Toc113494631 \h 88 List of Annexes TOC \o "1-3" \h \z \u Annex 1: Procedural information PAGEREF _Toc113489992 \h 2 Annex 2: Stakeholder consultation (synopsis report) PAGEREF _Toc113489993 \h 4 Annex 3: Who is affected and how? PAGEREF _Toc113489994 \h 27 Annex 4: Analytical methods PAGEREF _Toc113489995 \h 54 Annex 5: Background information on the problem definition PAGEREF _Toc113489996 \h 57 Annex 6: Global Developments PAGEREF _Toc113489997 \h 63 Annex 7: Comparison of the RED Delegated Regulation vs Policy option 4 (comprehensive horizontal regulation for all products with digital elements) PAGEREF _Toc113489998 \h 65 Annex 8: Extract from the preliminary findings of the Study supporting the Commission preparatory work for the Cyber Resilience Act (N° 2019-0024) PAGEREF _Toc113489999 \h 66 Annex 9: Table illustrating the potential interplay between a horizontal regulatory intervention (notably policy option 4) with existing product-related legislation PAGEREF _Toc113490000 \h 73 Annex 10: EU Funding programmes PAGEREF _Toc113490001 \h 91 Annex 11: The New Legislative Framework (NLF) PAGEREF _Toc113490002 \h 92 Annex 12: Illustration of two-level risk approach to conformity assessment in policy option 4 PAGEREF _Toc113490003 \h 95 Annex 13: Regulatory gap analysis PAGEREF _Toc113490004 \h 96 Annex 14: Standards related to products with digital elements PAGEREF _Toc113490005 \h 108 Annex 1: Procedural information Lead DG, Decide Planning/CWP references Lead DG: Directorate-General for Communications Networks Content and Technology (CNECT). Decide: PLAN/2022/56. CWP: Commission Work Programme 2022, Making Europe stronger together ( COM(2021) 645 final ) under Policy objective A Europe Fit for the Digital Age (initiative number 6). Organisation and timing The initiative constitutes a core part of the single market and was announced by President von der Leyen i n her 2021 State of the Union address. The Commission Work Programme for 2022 envisages the adoption of this Act for Q3 2022 under Policy objective A Europe Fit for the Digital Age (initiative number 6). It is based on Article 114 TFEU since it aims to improve the functioning of the internal market by setting harmonized cybersecurity rules on all products with digital elements placed on the Union market. The impact assessment process started with opening of a public consultation and publishing the C all for E vidence for stakeholder comments for a period of 10 weeks from 16 March 2022 until 25 May 2022. For details on the consultation process, see Annex 2 . The inter-service group (ISG) met on 28 February 2022 and on 2 June 2022 before submission of the Staff Working Document to the Regulatory Scrutiny Board on 13 June 2022. The ISG consists of representatives of the Secretariat-General, and the Directorates-General CNECT, COMP, JUST, GROW, LS, HOME, SANTE, FISMA, AGRI, JRC, DEFIS, TRADE, ENV, ENER, EMPL, EAC, MOVE, RTD, TAXUD, MARE, EEAS, ECFIN and CLIMA. Consultation of the RSB On 13 June 2022, the DG CNECT submitted the draft Impact Assessment to the Regulatory Scrutiny Board, in view of a hearing on 6 July 2022. The Regulatory Scrutiny Boar d issued a positive opinion with reservations on 8 July 2022 . Evidence, sources and quality The Commission carried out an extensive consultation in preparation of this Impact Assessment report. It benefit ed from consultation activities already carried out in 2021 for the exploratory study contracted by the Commission and implemented by a consortium made of Wavestone, CEPS , ICF and CARSA to assess the need for horizontal cybersecurity requirements for products with digital elements . To ensure a high level of coherence and comparability of analysis for all potential policy approaches, a second study led by the same consortium was contracted to collect evidence and conduct analyses in the first half of 2022. In addition to the Commission open public consultation and feedback on the Call for Evidence, the external contractors collected evidence from a variety of stakeholders through targeted interviews with experts covering different domains, focus groups, two workshops and a targeted online consultation. Moreover, to further support evidence based analysis, the Commission has conducted extensive desk research, covering a wide spectrum of policy studies and reports. They have been quoted in the main body of the Impact Assessment. The quality of the analytical methods is detailed in Section 6 of this report and Annex 4 below. Annex 2: Stakeholder consultation ( s ynopsis report) Consultation scope and objectives The consultation activities aim at collecting the views of Member State competent authorities, Union bodies dealing with cybersecurity, hardware and software manufacturers , importers and distributors of hardware and software, trade associations, researchers and academia, notified bodies and accreditation bodies, cybersecurity industry professionals, consumer organisations and other users of products with digital elements , and citizens. All these different stakeholder groups are expected to have important information and insights as regards possible actions to improve the cybersecurity of products with digital elements , as well as interest in and opinions on shaping the debate about the possible options for the future. The stakeholder consultation ha d two objectives: collect views on the state of cybersecurity as regards products with digital elements , and collect views on policy options for a future market intervention and their respective impacts. It will pose general questions designed to collect feedback from the general public and more technical questions targeting expert stakeholders. The Commission issued the terms of reference for a second study to assist the Commission in evaluating the existing legal and policy framework and to identify policy objectives and propose and assess the expected impacts of a limited number of policy interventions. The second study run for 10 months from February 2022 until December 2022. Relevant links: Study on the need of cybersecurity requirements for ICT products ( link ) Commission Work Programme 2022 ( link ) Call for Evidence for an impact assessment ( link ) Mapping of stakeholders The Commission consulted a broad range of stakeholders listed below according to their interest and presumed expertise in the subject matter: Member State competent authorities and bodies (such as national cybersecurity authorities). Union bodies dealing with cybersecurity such as the EU’s cybersecurity agency ENISA (European Union Agency for Cybersecurity) or CERT-EU (Computer Emergency Response Team for the EU Institutions, bodies and agencies). Hardware and software manufacturers , including manufacturers of hardware components, ICSs, computers, mobile phones, Internet-of-Things devices, home automation systems, and non-embedded software, such as operating systems or user applications. Importers and distributors of hardware and software , which either import products with digital elements from third countries or distribute them throughout the internal market (such as high street retailers and online shops). Trade associations representing hardware and software manufacturers but also importers and distributors, such as DIGITALEUROPE, the European DIGITAL SME Alliance, Orgalim, the Information Technology Industry Council (ITI) or the Interactive Software Federation of Europe (ISFE). Consumer organisations and users of products with digital elements and citizens , such as the European Consumer Organisation (BEUC), the European Association for the Co-ordination of Consumer Representation in Standardisation (ANEC) and companies, in particular operators of essential services and digital service providers under the NIS Directive in their role as users of products with digital elements . Researchers and academia (focussing on those with expertise in secure products with digital elements development life cycles and the design of secure products with digital elements ). Notified bodies and accreditation bodies , which play an important role in implementing EU product regulations that are based on the NLF. Cybersecurity industry professionals , such as pen testers and white hat hackers. Consultation activities The consultation activities aimed to obtain input on the five main evaluation criteria based on the EU Better Regulation Guidelines (effectiveness, efficiency, relevance, coherence, EU-added value) as well as the potential impacts of possible options for the future. Both the open public consultation and the targeted surveys developed by the study contractor were structured according to the logic of the five criteria. The following consultation activities were organised: A first study: In December 2021, the Commission has published a study on the need of cybersecurity requirements for products with digital elements , which had been conducted by a consortium consisting of ICF, Wavestone, CARSA and CEPS (the exploratory study). The exploratory study has identified several market failures leading to a suboptimal level of cybersecurity of products with digital elements . It has further analysed existing EU and national legislation, and assessed possible regulatory interventions. It concludes that a horizontal legislation laying down requiring across sectors would represent the most cost-effective policy option, creating greater security in the Single Market while enhancing business competitiveness. However, it also concluded that the Commission should perform a more comprehensive and quantitative assessment of the potential policy options. An Open Public Consultation with questions targeting citizens, stakeholders and cybersecurity experts. It included questions regarding the current state of cybersecurity as regards products with digital elements . It focused on policy options for a potential regulatory intervention. The survey contributed to the collection of diverse opinions and experiences from all stakeholder groups. A smaller set of questions was available to all participants. Respondents such as professionals in the field, or organisations with specific knowledge and expertise were directed to respond to a set of targeted questions within the same online survey. The Public Consultation, implemented according to the Commission's Better Regulation Guidelines for stakeholder consultations, was carried out for a 10-week period, starting in March 2022. The questionnaire was made available in all 24 official EU languages, ensuring that the public consultation is accessible to as many stakeholders as possible, especially citizens. Surveys organised by the contractor. An online survey was launched on 16 May 2022 and gathered 24 responses at the time of the finalisation of the impact assessment. T he participants were handpicked to cybersecurity experts with an understanding in the areas of cybersecurity public policy, cybersecurity requirements and potential compliance and enforcement costs. The survey was designed to receive detailed feedback on the various aspects of the different policy options, as opposed to the public consultation, the purpose of which was to receive general high-level feedback by a wide range of stakeholders, including non-experts. Participants were presented with the different policy options, and the detailed requirements under policy option 4. Participants were requested to provide cost estimations on compliance and enforcement costs and to provide feedback on the other ty pes of impacts. Workshops organised by the contractor. Two workshops have been organised, gathering around 100 representatives from all 27 Member States representing competent authorities, hardware and software manufacturers , importers, distributors, notified bodies, accreditation bodies, and cybersecurity experts. The workshops took place in April and May 2022 and were in addition to the three workshops organised in the framework of the exploratory study. Workshop #1 on scope and definitions, policy interplay and cybersecurity requirements. The workshop took place online on 28 April 2022. The study supporting the Commission preparatory work for the upcoming regulatory intervention was presented. In three interactive sessions the scope and definition, policy interplay and cybersecurity requirements were discussed with the stakeholders. 115 people participated, representing industry, governmental agencies, consumer organisations and universities. Workshop #2 on risk profiles, conformity assessment procedures and likely impacts. The workshop took place online on 10 May 2022. There were 108 participants. Around half of which represented industry (interests) and around one third represented participants from the public sector across various member states. Other participants included EU agencies, universities and consumer organisations. For the respondents, the main driver for a risk categorization (potential physical harm, use, and potential misuse) was dependent on the specific example provided. Most respondents indicated that conformity assessments other than self-asses sment could be necessary (84 %). Expected cost s as consequences of requirements ranged from “low” for internal product testing/self-assessment, to “high” for security updates and whole life cycle requirements. For all other requirements, “medium” received the most votes. Expert interviews were conducted to gain a deeper understanding of current cybersecurity challenges related to products with digital elements , and to discuss policy options for a potential regulatory intervention. The experts were selected by the Commission who also conduct ed the interviews during the first and second quarters of 2022. Experts include d engineers developing digital hardware and software products, professional users, and representative of consumer organisations. This add ed to the 52 “semi-structured interviews” that were carried out by the exploratory study. Bilateral discussions with national cybersecurity authorities, the private sector and consumer organisations. The Commission reach ed out to national cybersecurity authorities and private sector and consumer representatives during the first and second quarters of 2022. Reports by the Contractor, as part of the s tudy supporting the Commission preparatory work for the Cyber Resi lience Act . SME test - consultations with SMEs Additional efforts have been made to gather views from SMEs on the impact of the policy options. However, it has been very difficult to get substantial input from SMEs. SMEs have been included in the consultation activities as follows: The initiative was discussed at the SME envoy network and classified as "relevant" on 6 April 2022 . The public consultation, targeted survey on impacts and workshops have been disseminated through the GROW Small Business Act network of EU SME business associations and the European Enterprise Network (cooperation with GROW A.2. unit). Due to time constraints, it was not possible to carry out a proper SME panel consultation ( which requires to be open for 8 weeks, language translations needed, EUsurvey required, and a summary of results after the consultation). In addition, DG CNECT presented the initiative at several meetings with various SME associations. For instance: GROW Meeting with SME stakeholders on Wednesday 11 May 2022; Joint conference on 10 May 2022 of the European industry federations Europump (European Pumps Industry Association), CEIR (European Taps and Valves Industry Association) and Pneurop (European compressors, vacuum pumps and pneumatic tools industry association; presentation and discussion of the regulatory intervention at the European Digital SME Alliance working group on cybersecurity on 5 May 2022. Targeted outreach was done to key SME stakeholders, such as the Digital SME Alliance and their individual members . In the context of the study supporting this report , a targeted list of SMEs was established to be invited to the workshops. In addition, several interviews were done with SMEs related to the impacts of the initiative. Outcome of the consultation activities: In the context of the public consultation, o nly few individual companies represen ting SMEs participated (14 in total) . This included 7 m edium -sized companies (50 to 249 employees), 5 s mall -sized companies (10 to 49 employees), and 2 m icro -sized companies (1 to 9 employees) . In order to achieve a more representative panel of responses, trade associations representing SMEs have also been considered. In total, 47 organisations representing SMEs have been identified, including providers, users, trade associations and other types of companies (e.g. service providers). A number of SMEs participated in the workshops: o ut of the 223 participants in the workshops 1 and 2 , 19 participants represented SMEs , including individual companies and trade associations. Consultation webpage & communication activities Anyone interested was able to provide feedback at different stages of the policy cycle on the Have your say page. Stakeholders that wished to be notified by e-mail on new public consultations could follow the RSS Feed or subscribe to Commission at work – Notifications . Synopsis report of the open public consultation Profile of respondents A total of 167 responses to the OPC were received . Almost two-thirds of responses came from companies/businesses and business associations (35.3% and 28.1% respectively), while 13% of responses came from public authorities. 7.8% of responses came from EU citizens, 2.4% of responses each from consumer organisations and non-governmental organisations (NGOs). 1.8% came from academic/research institutions and 1 response from a trade union. In total, 59 companies/businesses responded. Among them, 45 were large, 7 medium, 5 small, and 2 micro. Turning to responses received by the country, more than half of the responses came from Belgium (44; 26.3%) and Germany (43; 25.7%) while 22 responses came from non-EU countries (13 from the United States). No responses were received from the following Member States: Croatia, Cyprus, Ireland, Latvia, Lithuania, Luxembourg, Malta, Portugal, Romania, Slovakia, and Slovenia. Q1: Overall level of cybersecurity of products with digital elements Respondents were asked to rank the overall level of cybersecurity of products with digital elements marketed within the European Union on a scale from 1 to 5 with 5 indicating a very high level of cybersecurity. The majority of respondents (53%) indicated that the overall level of cybersecurity is reflected at level 3, while 23% of respondents indicated level 2 and 12% indicated level 4. There were no significant differences between respondent types. The majority of large companies (55%) ranked the overall level of cybersecurity of products with digital elements marketed within the European Union with a 3. Medium companies were split, although 43% of their responses also indicated level 3. Among the small and micro companies, level 3 was also reflected in the majority of responses – 50% of micro companies and 40% of small companies. For small companies, the rest of the responses were equally split between levels 1, 2 and 5 (20% each). Respondents were also asked to elaborate on their answers. Most respondents have stated that an average level of cybersecurity across all types of products with digital elements is difficult to establish as certain differences can be observed across sectors, product types or whether they are marketed for businesses or consumers. Several respondents have highlighted different gaps and obstacles hindering progress that they observed in the overall level of cybersecurity of products with digital elements . Conversely, several respondents have also indicated signs of progress and improvements they observed. Q2: Level of risk of cybersecurity incidents Respondents were asked how the level of risk of cybersecurity incidents affecting products with digital elements has evolved during the last five years . The majority of respondents (54%) indicated that the risk level has increased significantly and 40% of respondents indicated that the risk level has increased. Only a small minority of respondents (4%) indicated that the risk level has remained the same over the last 5 years and only 1% of respondents mentioned the risk level has decreased significantly. There were no significant differences between respondent types. The majority of large companies have indicated that the risk level has increased – 38% of them have indicated that the risk level has increased and a further 49% indicated that the risk level has increased significantly. The majority of medium companies (57%) also indicated that the risk level has increased significantly and all (100%) micro companies indicated the same response. Among small companies, the majority of responses indicated that the risk level has increased: 40% indicated the level has increased, and a further 40% indicated that it increased significantly. Respondents were also asked to elaborate on their answers and they provided various types of examples of cybersecurity threats that have been observed to increase during recent years . Several respondents also indicated underlying causes (e.g. the proliferation of interconnected devices on the market, increased reliance on technology due to remote working, increased sophistication of attacks, geopolitical tensions) that they think are increasing the risk level of cybersecurity threats. Other respondents have indicated that the real level of risk is sometimes difficult to assess . Q3: Impact of cybersecurity incidents affecting products with digital elements Respondents were asked to score several possible consequences of cybersecurity incidents based on their actual negative impact on them or their organisation by using a scale from 1 to 5 with 5 indicating a very high negative impact. The consequences that have been ranked the highest in terms of their negative impact were ‘reputational damage’ and ‘financial cost of disruption’ (e.g. due to a ransomware attack), as they have both been ranked with an average of 4. However, very close to this level of perceived negative impact were also ‘damage to fundamental rights’ (3.8 average score), ‘financial cost of implementing measures to respond to a cybersecurity incident’ (3.8 average score) and ‘compromising the security of our economy and society’ (3.7 average score). There were no significant differences between respondent types. Company size breakdown: The financial cost of implementing measures to respond to a cybersecurity incident: The majority of large companies (47%) and the majority of medium companies (57%) selected level 4. Micro companies' responses were equally split (50%) between levels 4 and 5, while small companies were also equally split on levels 4 and 5 (40% each), with the rest of 20% of votes being cast to level 3. The financial cost of disruption (e.g. due to a ransomware attack): Large companies indicated mixed responses: 31% for level 5, 20% for level 5 and 15% each for levels 2 and 3. The majority of medium companies (43%) indicated level 4, while 40% of small companies indicated and a further 40% of them indicated level 5. Micro companies were equally split (50%) between levels 4 and 5. Reputational damage: Most responses from large companies were equally split between levels 3, 4 and 5 (24% each), while only 7% of responses went to each levels 1 and 2. The majority of medium companies (43%) indicated level 4, the majority of small companies were split between levels 4 and 5 (40% each) and micro companies were equally split between levels 4 and 5 as well (50% each). Compromising the security of our economy and society: 27% of responses from large companies indicated level 4, 18% the levels 3 and 5 each and only 16% indicated level 2. The majority of medium companies (43%) and all (100%) micro companies indicated level 5 while small companies were equally split between levels 1 to 5 (20% each). Damage to health and life: The majority of large companies indicated levels 1 (24%) and 2 (27%). Only 9% indicated levels 5, and 11% indicated each level 3 and 4. Among the medium companies, most responses were received by level 5 (29%). However, 28% of medium companies also refrained from responding here. The majority of small companies (60%) indicated level 2. The rest of the responses were split between levels 1 and 4 (20% each). Micro companies were equally split between levels 3 and 5 (50% each). Damage to fundamental rights (e.g. privacy, protection of personal data, consumer protection) : Responses from large companies were mixed: most responses from large companies indicated level 4 (22%) and 20% each were allocated to levels 2 and 4, while 16% indicated level 3. The majority of medium companies (43%) indicated level 5, while the majority of small companies (40%) indicated level 3. The remaining responses by small companies were equally split between levels 2, 4 and 5 (20% each). Micro companies were equally split between levels 4 and 5 (50% each). Environmental damage: The majority of responses from large companies were split between level 1 (23%) and level 2 (31%). The majority of responses from medium companies were similarly split between levels 1 (28%) and 2 (22%), with a further 14% allocated to level 3. For medium companies, levels 1 and 3 received 19% of responses each. 46% of medium companies refrained from answering this question. Within small companies, 32% indicated level 2 and a further 24% indicated level 1. 40 micro companies did not indicate a level, and among those which did, the most responses went to levels 1 and 4 (16% each). Respondents were also asked to elaborate their answers. Several stakeholders have indicated that for certain sectors (e.g. healthcare) or certain types of companies (e.g. SMEs) the negative impacts of cybersecurity incidents are more prominent. Other stakeholders have also reiterated the link between the consequences of cybersecurity incidents to their underlying causes or to the circumstances in which they appear. Several stakeholders have also pointed out that certain negative consequences are already covered by existing sectoral legislation. Q4: Impact on users Respondents were asked to rank several impacts on users based on their agreement with the statement on a scale from 1 to 5 with 5 indicating that they fully agree with it. As a result, respondents indicated that they mostly agree with the fact that the user bears additional costs due to the need to deploy highly-priced technical security solutions (ranked with an average of 4) and with the fact that the user bears the additional cost when affected by a cybersecurity incident (also ranked with an average 4). The statement ‘the user bears additional costs due to highly-priced cybersecurity insurance was ranked slightly lower at 3. There were no significant differences between respondent types. There were no significant differences between respondent types. Company size breakdown: The user bears the additional cost when affected by a cybersecurity incident: Most large companies were split between levels 4 (38%) and 5 (33%). Most medium companies were also split between levels 4 (29%) and 5 (29%). The majority of small companies (40%) and all micro companies (100%) indicated level 5. The user bears additional costs due to highly-priced cybersecurity insurance: Responses from large companies were mixed: 22% indicated level 4, 16% indicated level 5, while 20% indicated level 2 and a further 11% level 3. Among medium companies, most respondents indicated level 3 while levels 2, 4 and 5 received each 14% of responses. The majority of small companies (40%) indicated level 2, while micro companies were equally split (50%) between levels 4 and 5. The user bears additional costs due to the need to deploy highly-priced technical security solutions: Most responses from large companies were split between levels 3 (22%), 4 (26%) and 5 (27%). Similarly, among medium companies, most responses were split between levels 3 (14%), 4 (29%) and 5 (29%). The highest number of small companies (40%) indicated level 3 while micro companies were equally split (50%) between levels 2 and 5. Respondents were also asked to elaborate their answers. Several stakeholders detailed their responses by indicating how the impacts on users differ based on certain specific circumstances (e.g. whether the user is a consumer or a professional user, the size of the user, type of products with digital elements in case, whether the market is B2B or B2C). Several stakeholders also had specific comments regarding the cyber insurance market, especially concerning the increased cost of insurance premiums . Other stakeholders have indicated additional impacts (such as the psychological impact or loss of confidence in products with digital elements ) that they think will affect the users. Q5: Awareness and understanding of cybersecurity properties of products with digital elements Respondents were asked the extent to which they were aware of the cybersecurity risks associated with products with digital elements (on a scale from 1 to 5 with 5 indicating that they strongly agreed) : 79% declared to be either aware or strongly aware; only 4% were not aware of security risks linked to products with digital elements . Company breakdown: 75% of large companies agreed with this statement; 48% of medium companies agreed, while 24% were neutral; most (67%) small companies also agreed; micro companies generally agreed (55%); were neutral (10%) and disagreed (25%). The survey asked whether there is sufficient and clear information about the cyber security properties of products with digital elements (on a scale from 1 to 5 with 5 indicating that you strongly agreed) : 46% of respondents believed that this was not the case; 33% of them had neutral feelings, while only 17% thought there was enough information. Large companies generally disagreed (38%) or were neutral (38%); medium companies also disagreed (56%) or were neutral 29%; small companies disagreed (42%) or were neutral (33%); micro companies disagreed (35%) or were neutral (40%). Respondents were asked about the extent to which they understood the cybersecurity properties of products and had the skills to operate them securely (on a scale from 1 to 5 with 5 indicating that they strongly agreed): 64% of them agreed or strongly agreed with this statement; 16% were neutral, and 14% did not believe to understand cyber security properties or have the competencies to use products securely. It has to be specified in this context that even if the percentage of respondents agreeing with this statement is high, it should be interpreted in view of the categories of respondents that were predominantly replying to the public consultation (namely cybersecurity experts) and that only very few citizens participated in the survey. 75% of large companies agreed; medium companies generally agreed (57%) and 24% disagreed; small companies generally agreed (54%), but 29% disagreed. The survey asked whether respondents valued products’ usability and price over cyber security features (on a scale from 1 to 5 with 5 indicating that they strongly agreed): 46% of them disagreed with this statement; 33% neither disagreed nor agreed and only 12% seemed to privilege usability and price over cyber security. Most large companies disagreed (52%) or were neutral (31%); medium companies were mostly neutral (43%) and disagreed (47%); small companies disagreed (42%), were neutral (33%), but also partially agreed (17%); micro companies tended to disagree (30%) or be neutral (40%). Q6: The role of the manufacturers in addressing cybersecurity vulnerabilities and incidents Respondents were asked whether hardware manufacturers were effectively addressing the cybersecurity vulnerabilities and incidents affecting their customers (on a scale from 1 to 5, with 5 indicating that they strongly agreed): 37% thought this was not the case; 29% were neutral; 28% thought they were being effective. Company breakdown: large companies mostly disagreed (35%), were neutral (32%) and agreed (29%); medium companies mostly disagreed (50%) or were neutral (27%); small companies mostly disagreed (50%) or were neutral (20%); micro companies generally agreed (50%) or were neutral (25%). The survey asked the extent to which software manufacturers were effectively addressing the cybersecurity vulnerabilities and incidents affecting their customers (on a scale from 1 to 5, with 5 indicating that they strongly agreed): 33% disagreed or strongly disagreed software manufacturers were effectively doing it; 30% were neutral, and 34% believed they were instead effective. Large companies disagreed (35%) or agreed (35%); medium companies disagreed (32%), were neutral (27%) or disagreed (27%); small companies disagreed (37%) or were neutral (33%) and only some agreed (21%); micro companies mostly agreed (45%) or were neutral (25%). Q7: Aspects having the biggest impact on manufacturers ’ decisions related to cybersecurity of products with digital elements Most manufacturers (65%) reported that the potential reputational damage and the loss of users’ trust following an incident were very relevant factors in their decision-making regarding the cyber security of their products with digital elements . 74% of large companies thought it was very relevant, compared to 36% of medium enterprises; 47% of small companies believed it was relevant too, compared to 93% of micro companies. Most manufacturers (77%) declared that customer expectations, including contractual obligations , were either relevant or very relevant in their decision-making regarding the cybersecurity of their products with digital elements ; 20% did not have an opinion about it. Companies opted for either relevant or very relevant: large (84%); medium (64%); small (65%) or micro (93%). Most manufacturers (66%) agreed or strongly agreed that public procurement practices had a big impact on their decision making regarding the cybersecurity of their products with digital elements ; 24% did not know. Companies opted for either relevant or very relevant: large (72%), medium (36%), small (58%) and micro (86%). Respondents also pointed out other aspects which influence their decision-making regarding the cyber security of products with digital elements , including (ranked based on frequency, from most to least mentioned): threat scenario (i.e. cyber security risks and attack vectors); type and intended use of the product; general security standards and requirements, deriving from compliance, legislation and best practices; safety concerns; other requirements, such as usability and interoperability; supply chain; production, operation, and maintenance costs. Q8: Cybersecurity of products with digital elements in the product life cycle Respondents were asked the extent to which hardware and software manufacturers took the cybersecurity of their products with digital elements into account in the design phase (on a scale from 1 to 5 with 5 indicating that cybersecurity is taken very seriously) of a product life cycle and the results ranged mainly from not seriously (29%), neutral (19%) and seriously (21%). Large companies thought it was taken seriously (40%) but also not seriously (33%); most medium companies (52%) believed it was not taken seriously; most small companies were neutral (27%) or thought it was not taken seriously (36%); 48% of micro companies believed it was taken seriously. Respondents were asked the extent to which hardware and software manufacturers took the cybersecurity of their products with digital elements into account in the development phase (on a scale from 1 to 5 with 5 indicating that cybersecurity is taken very seriously) of a product life cycle and the results ranged mainly from not seriously (25%), neutral (26%) and seriously (19%); an additional 16% thought that these are taken very seriously. Large companies generally indicated it was taken seriously (42%) or not taken seriously (32%); medium companies thought it was not taken seriously (47%) or were neutral (19%); small companies believed it was taken seriously (33%) and not seriously (29%). Respondents were asked about the extent to which hardware and software manufacturers took the cybersecurity of their products with digital elements into account during the release of the product on the market phase (on a scale from 1 to 5 with 5 indicating that cybersecurity is taken very seriously) of a product life cycle and results ranged mainly from not seriously (25%), neutral (26%) and seriously (21%). 34% of large companies thought it was taken seriously and 29% were neutral; 47% of medium companies believed it was not taken seriously; 36% of medium companies were neutral and 27% thought it was not taken seriously; 47% of micro companies believed it was taken seriously and 14 were neutral. Respondents were asked the extent to which hardware and software manufacturers took the cybersecurity of their products with digital elements into account after the release of a product, namely maintenance and evolution of the product phase (on a scale from 1 to 5 with 5 indicating that cybersecurity is taken very seriously), and results ranged mainly from not seriously (24%), neutral (32%) and seriously/very seriously (27%). Companies of all sizes were generally neutral or tended to think it was not taken seriously: large (37%); medium (47%), and small (27%). Only micro companies thought it was taken seriously (33%) compared to non-seriously (14%). Q9: Effectiveness of measures to increase cyber security of products with digital elements The survey asked the extent to which (on a scale from 1 to 5 with 5 indicating that a measure would be very effective) guidelines or recommendations for the development of secure products with digital elements issued at the EU level addressed to manufacturers could be effective in increasing the cybersecurity of products with digital elements marketed in the EU: almost half (47%) agreed these could be effective, while 27% were neutral; 25% did not believe these measures would be effective. Companies of all sizes tended to think these could be effective: large (49%); medium (29%), small (45%) and micro (59%) or were generally neutral (respectively, 20%, 38%, 46% and 23%). The survey asked the extent to which (on a scale from 1 to 5 with 5 indicating that a measure would be very effective) further voluntary European cybersecurity certification schemes for products with digital elements and services could be effective in increasing the cybersecurity of products with digital elements marketed in the EU: 37% disagreed these could be effective; 31% were neutral, and 31% agreed these measures would be effective. 40% of large and 46% of medium companies stated they could be effective; 33% of small companies thought they could be effective and the same percentage believed the opposite; micro companies were mainly neutral (36%) or thought they could be effective. The survey asked the extent to which (on a scale from 1 to 5 with 5 indicating that a measure would be very effective) EU public procurement guidelines taking into account cybersecurity requirements could be effective in increasing the cybersecurity of products with digital elements marketed in the EU: 60% agreed these could be effective; 28% were neutral; 9% disagreed these measures would be effective. Most companies gave neutral answers or tended to agree these could be effective: large (56%); medium (63%), small (58%) and micro (55%). The survey asked the extent to which (on a scale from 1 to 5 with 5 indicating that a measure would be very effective) amending existing legislation regulating specific products with a digital dimension (such as the legislation on lifts or gas appliances) could be effective in increasing the cybersecurity of products with digital elements marketed in the EU: 51% agreed these could be effective; 17% were neutral; 27% disagreed these measures would be effective. 55% of large companies believed it could be effective and so did 54% of medium ones; small companies had mixed feelings but 46% also believed they could be effective; 36% of micro companies instead declared these might not be effective or were neutral about it (31%). The survey asked the extent to which (on a scale from 1 to 5 with 5 indicating that a measure would be very effective) introducing mandatory horizontal cybersecurity requirements for hardware products could be effective in increasing the cybersecurity of products with digital elements marketed in the EU: 72% agreed these could be effective; 13% were neutral; 10% disagreed these measures would be effective. Most companies of all sizes thought these could be effective, namely large (73%), medium (71%), small (67%) and micro (81%). The survey asked the extent to which (on a scale from 1 to 5 with 5 indicating that a measure would be very effective) introducing mandatory horizontal cybersecurity requirements for software products could be effective in increasing the cybersecurity of products with digital elements marketed in the EU: similarly to the question above, 74% agreed these could be effective; 10% were neutral; 11% disagreed these measures would be effective. Most companies of all sizes believed these could be effective, namely large (76%), medium (71%), small (81%) and micro (66%). When asked to elaborate on their answers, respondents highlighted the following themes: Mandatory horizontal legislation is the preferred option vs “softer” approaches (as already found in the survey above); Requirements must be clear as well as limit fragmentation/duplication ; Alignments with existing legal instruments . Q10: Requiring manufacturers to act Respondents were asked to assess the impact (on a scale from 1 to 5 with 5 indicating that a measure would have a very high impact) of requiring manufacturers to make available information and provide instructions on securely installing, operating and using the product in question: 70% reported this would have a high or very high impact; 22% were neutral, and 8% suggested this would have a low or very low impact. Most companies of all sizes thought this could have a high impact, namely large (71%), medium (67%), small (54%) and micro (90%). Respondents were asked to assess the impact (on a scale from 1 to 5 with 5 indicating that a measure would have a very high impact) of requiring manufacturers to take corrective actions (such as patching, recalling or withdrawing a product) when a product is found to be not secure: 86% reported this would have a high or very high impact; 7% were neutral and 7% suggested this would have a low or very low impact. Most companies of all sizes thought this could have a high impact, namely large (83%), medium (88%), small (83%) and micro (95%). Q11: Relevance of cyber security measures to users The survey asked the extent to which (on a scale from 1 to 5 with 5 indicating that a measure is very relevant) making available technical documentation (containing information to demonstrate the conformity of the product to the applicable requirements) on the cybersecurity properties of a product (such as on risks and proper use) would help users assess cybersecurity properties of products with digital elements : 47% reported this would be relevant or very relevant; 26% were neutral and 25% suggested this would not be relevant. Companies of all sizes generally thought this could be relevant, namely large (49%), medium (46%), and micro (55%); small companies were mostly neutral (39%). The survey asked the extent to which (on a scale from 1 to 5 with 5 indicating that a measure is very relevant) making available an EU Declaration of conformity (stating that all the relevant requirements of the applicable legislation are satisfied) would help users assess cybersecurity properties of products with digital elements : 51% reported this would be relevant or very relevant; 25% were neutral and 19% suggested this would not be relevant. Companies were either neutral or tended to agree this could be relevant, namely large (57%), medium (33%), small (46%) and micro (41%). The survey asked the extent to which (on a scale from 1 to 5 with 5 indicating that a measure is very relevant) affixing a symbol of compliance such as CE marking would help users assess the cybersecurity properties of products with digital elements : 51% reported this would be relevant or very relevant; 22% were neutral and 22% suggested this would not be relevant. Most large (57%), small (50%) and micro (41%) companies stated this could be relevant; medium ones instead either disagreed (38%) or were neutral (29%). The survey asked the extent to which (on a scale from 1 to 5 with 5 indicating that a measure is very relevant) training on the secure use of products with digital elements would help users assess the cybersecurity properties of products with digital elements : 57% reported this would be relevant or very relevant; 23% were neutral and 17% suggested this would not be relevant. Most companies of all sizes declared this could be effective, namely large (50%), medium (54%), small (63%) and micro (73%). Respondents elaborated upon their answers and highlighted the following themes: Equipping users with the right cyber security knowledge; Security information provided to users should be easy and understandable; Be clear about the expected lifetime of a product and consequential security updates; A symbol/label of compliance could also be useful. Q12: Effectiveness of cyber security requirements subjecting different products and services Respondents were asked the extent to which (on a scale from 1 to 5 with 5 indicating that they strongly agreed) they believed subjecting hardware products marketed in the EU to cybersecurity requirements would be an effective measure: 67% either agreed or strongly agreed; 16% were neutral and 10% either disagreed or strongly disagreed. Most companies of all sizes declared this could be effective, namely large (65%), medium (58%), small (60%) and micro (56%). Respondents were asked the extent to which (on a scale from 1 to 5 with 5 indicating that they strongly agreed) they believed subjecting embedded software marketed in the EU to cybersecurity requirements would be an effective measure: 77% either agreed or strongly agreed; 9% were neutral and 9% either disagreed or strongly disagreed. Most companies of all sizes declared this could be effective, namely large (77%), medium (83%), small (79%) and micro (59%). Most companies of all sizes declared this could be effective, namely large (57%), medium (54%), small (63%) and micro (59%). Respondents were asked the extent to which (on a scale from 1 to 5 with 5 indicating that they strongly agreed) they believed subjecting hardware products with higher cybersecurity risks marketed in the EU to cybersecurity requirements would be an effective measure: 85% either agreed or strongly agreed; 4% were neutral and 4% either disagreed or strongly disagreed. Most companies of all sizes declared this could be effective, namely large (82%), medium (88%), small (83%) and micro (86%). Respondents were asked the extent to which (on a scale from 1 to 5 with 5 indicating that they strongly agreed) they believed subjecting all standalone software products marketed in the EU to cybersecurity requirements would be an effective measure: 58% either agreed or strongly agreed; 19% were neutral and 16% either disagreed or strongly disagreed. Most companies of all sizes declared this could be effective, namely large (59%), medium (54%), small (63%) and micro (56%). Respondents were asked the extent to which (on a scale from 1 to 5 with 5 indicating that they strongly agreed) they believed subjecting software products subject to higher cybersecurity risk marketed in the EU to cybersecurity requirements would be an effective measure: 86% either agreed or strongly agreed; 18% were neutral and 5% either disagreed or strongly disagreed. Most companies of all sizes declared this could be effective, namely large (84%), medium (92%), small (83%) and micro (82%). Respondents elaborated upon their answers and highlighted the following topics: Any EU legislation should adopt a risk-based approach ; The importance of clear definitions and scope . Q13: Appropriateness of existing EU regulation The survey asked the extent to which (on a scale from 1 to 5 with 5 indicating that they strongly agreed with a statement) existing EU regulations appropriately addressed cybersecurity of tangible products with digital elements (hardware) throughout their life cycle: 41% of respondents either strongly disagreed or disagreed; 28% were neutral and 13% either agreed or strongly agreed. Large companies selected 3 (33%) and 2 (24%). Medium companies opted for 2 (67%). Small companies were divided into 1, 2, 3 and 5 (20% for each). Micro companies were evenly split between 3 and 4. The survey asked the extent to which (on a scale from 1 to 5 with 5 indicating that they strongly agreed with a statement) existing EU regulation appropriately addressed cybersecurity of intangible products with digital elements (software) throughout their life cycle: 46% of respondents either strongly disagreed or disagreed; 28% were neutral and 12% either agreed or strongly agreed. Large companies opted for 2 (33%) and 3 (31%). Medium companies chose 2 (50%), while small companies 1 (40%). Micro companies were evenly split between 3 and 5. The survey asked the extent to which (on a scale from 1 to 5 with 5 indicating that they strongly agreed with a statement) existing EU regulation appropriately addressed all relevant cybersecurity risks (material and non-material damages) related to the use or misuse of a product with digital elements : 43% of respondents either strongly disagreed or disagreed; 25% were neutral, and 15% either agreed or strongly agreed. Large companies chose 3 (32%) and 2 (22%), while 50% of Medium companies opted for 2. Small companies were divided for all responses (20% each), except for 2. Micro companies were equally divided between 2 and 5. Q14: Risk of increasing costs and legal uncertainty in the absence of an EU initiative The survey asked the extent to which (on a scale from 1 to 5 with 5 indicating they fully agreed) there was a risk of increasing costs and legal uncertainty for market stakeholders in the absence of an EU initiative , namely in a scenario in which the Member States could adopt national laws placing certain requirements on manufacturers as opposed to horizontal cybersecurity requirements at European level: 85% either agreed or strongly agreed; 9% were neutral and 4% either disagreed or strongly disagreed. Most companies of all sizes declared this could be effective, namely large (86%), medium (83%), small (92%) and micro (86%). Respondents elaborated upon their answers and almost unanimously concluded that an EU-wide initiative was to be preferred compared to single initiatives at the member state level. Q15: Legal requirements related to the cybersecurity of products with digital elements for manufacturers Respondents who identify as manufacturers were asked to respond whether their products with digital elements are subject to legal requirements as regards their cybersecurity . They were also advised to take into account in their answer European, national but also legislation stemming from third countries. The majority of respondents who replied to this question (65%) indicated that their products with digital elements are subject to legal requirements as regards their cybersecurity, while only 3% indicated the opposite. Out of the 65% of respondents who indicated ‘yes’, the vast majority were represented by business associations (25% of responses) and companies/business organisations (37% of responses). The majority of large companies (67%) indicated that their products with digital elements are subject to legal requirements as regards their cybersecurity. 28% of medium companies also responded positively although 43% indicated that they are not concerned by this question and a further 29% did not respond. The majority of small companies (60%) and 50% of micro companies also responded although the other 50% of micro companies did not provide an answer. Respondents were also asked to indicate which of their products with digital elements are subject to which legal requirements as regards their cybersecurity and to specify the relevant product categories and applicable legislation . The following categories of products were mentioned together with the applicable legislation: information and communications technology (ICT) products, services, and processes – are subject to certification frameworks under the Cybersecurity Act (EU/2019/881); radio equipment (electrical and electronic equipment that can use the radio spectrum for communication and/or radio determination) - is subject to Radio Equipment Directive. The proposed delegated act (2021) expands that scope from smart appliances and cameras to connected radio equipment like cell phones, laptops, alarm systems, wearable health monitoring devices, home automation, and other internet-connected devices; digital services providers (online search engines, online marketplaces, and cloud computing services) – are subject to the security of the Network and Information Systems Directive (NIS 2.0); motor vehicles – are subject to Regulation 2018/858 on type approval for motor vehicles; Regulation (EU) 2019/2144 (General Safety Regulation), and UN Regulation 155 on uniform provisions concerning the approval of vehicles with regards to cyber security and cyber security management system; UN Regulation 156 on software updates and software management system; Regulation 2014/53 Radio Equipment Directive (for radio equipment of motor vehicles); medical products – subject to Medical Device Regulation, In-Vitro Diagnostic Regulation, Machinery Directive, General Product Safety Directive, Radio-Equipment Directive (RED-DR not for MDR/IVDR products but in scope for accessories and non-medical products); financial products – subject to PSD2, EBA-Guidelines, requirements of the European Central Bank, NIS-Directive, future Digital Operational Resilience Act (DORA), BSI Act (BSIG), Prudential requirements for IT (BAIT). Other types of horizontal legislation (from the EU and third countries) mentioned by several stakeholders were: the EU’s General Data Protection Regulation – which covers the requirements related to protecting data, and breach reporting; the California Consumer Privacy Act and California IoT Cybersecurity Law; products in the scope of the Sales of Goods Directive (EU) 2019/771 need to provide security updates; the Regulation (EU) 2019/881 of the European Parliament and of the Council of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and information and communications technology cybersecurity certification and repealing Regulation (EU) No 526/2013 (Cybersecurity Act). Q16: Responsibility of hardware and software manufacturers Respondents were asked whether hardware and software manufacturers should be responsible for the full life cycle of a product with digital elements (such as by being required to provide updates). The vast majority of respondents (88%) indicated a positive answer to the question, while only 9% indicated a negative one. There were no significant differences between respondent types. Responses were in their majority affirmative for all sizes of companies: 80% of large companies, 86% of medium companies and 100% of both small and micro companies. Respondents who indicated that hardware and software manufacturers should be required to provide security updates were also asked for how many years should they be required to do so . Most respondents (13%) who provided several fixed numbers of years for this obligation indicated 5 years as the ideal period for which hardware and software manufacturers should be required to provide security updates. 9% of respondents also indicated 10 years as their ideal timeframe, while only 7% of respondents indicated a lower timeframe of 3 years. Most large companies refrained from responding (40%) or preferred to provide other responses than the ones indicated (40%). Likewise, 60% of small companies preferred to offer another response. The same applies to medium companies as 43% did not respond and 29% did not know or had no opinion. However, 14% each indicated 3 and 4 years as their responses. Micro companies' responses were equally split between 1 and 10 years. The majority of stakeholders (51%) who responded to this question chose to detail their response rather than pick a fixed number of years. Several responses indicated that the obligation should exist for the entire life cycle of the hardware/software product. A few responses also disagreed with the idea of an obligation that would exist throughout the entire life cycle of the hardware/software product. Others stressed that the timeframe of the obligation should be adapted based on the type of hardware/software product provided or other specific circumstances. Others stressed that providing updates is not sufficient . Q17: Approaches contributing to the cybersecurity of a product with digital elements Respondents were asked to rank to what extent several approaches contribute to the cybersecurity of a product with digital elements by using a scale from 1 to 5 with 5 indicating that the measure would be very effective. The measure deemed most effective and which received the higher score (4.8) was the measure indicating that ‘cybersecurity is taken into account during all phases of the development process (security by design)’. The next best average score was 4.7 and was awarded by respondents to the measure stipulating that ‘Hardware and software manufacturers provide updates when vulnerabilities are discovered, including after a product has been put on the market’. At the other end of the spectrum, the measure deemed least effective and which received the lowest score (3.3) stipulated that ‘Hardware and software manufacturers should make available to relevant stakeholders (e.g. end-users) a list containing the details and supply chain relationships of various components used in building the product with digital elements (so-called Software Bill of Materials)’. There were no significant differences between respondent types. Respondents were also asked to indicate which other measures taken by hardware and software manufacturers could improve the cybersecurity of products with digital elements . Among the additional measures that have been indicated were: the utilisation of strong technical protection mechanisms, including encryption; an improved mechanism for assistance from national security/cybersecurity authorities to help the private sector address dynamic cybersecurity risks; continuous education, training and assessment of the personnel of the organization to the specific requirements, implementation mechanisms, secure coding principles, etc.; manufacturers must be required to effectively communicate the supply chain relationship of the myriad of components, from different hardware and software manufacturers , that make up the IoT device; manufacturers should assure the robustness of their software/service towards ransomware attacks. For instance, measures that protect already stored backups from being modified, requiring multi-factor authentication for access to backup infrastructures, requiring separate authentication for application management and backup infrastructure management, penetration testing backup infrastructure annually, testing reinstallation of backups periodically etc . ; training of consumers, especially vulnerable consumers; the adoption of bug bounty programs; open-source approach/sources open and auditable; commitment to the Digital Responsibility Goals; for the critical software/hardware products, periodic recertification/testing of software and hardware products by independent 3rd parties and government entities. Q18: Approaches regarding higher risk products with digital elements Respondents were asked whether products with digital elements with a higher risk should be subject to a stricter process of demonstrating conformity with cybersecurity requirements . The vast majority of respondents (88%) indicated an affirmative answer while only a small minority (5%) disagreed. There were no significant differences between respondent types. Companies of all sizes also overwhelmingly responded yes: large (84%), medium (83%), small (100%) and micro (100.00%). Respondents were also asked to indicate what would be the categories of risk that a risk-based methodology should take into account when hardware and software manufacturers would be required to demonstrate their compliance with cybersecurity requirements . A large majority of responses (87%) indicated that a risk-based methodology should include ‘the intended use of a product (such as for the provision of health services, as an industrial control system or in a safety context)’. A slightly lower share of responses (83%) also indicated that the methodology should include ‘the functionality of a product (such as whether it has a network interface or not, or whether it controls certain security features of a digital system)’. On the other hand, only 44% of responses stressed the need to include ‘the societal importance of a product (for example measured in market share or number of users)’. Similarly, companies of all sizes prioritise the functionality and the intended use of a product. Within the responses received from respondents who wished to elaborate, it was observed that several respondents expressed their concerns about the definition of high-risk categories or their view that a case-by-case analysis would be more appropriate. Other respondents raised new aspects that should also be taken into account when developing risk methodologies: a potential stricter process of demonstrating conformity should take into consideration the respective sector in which the product is to be deployed; not only the vulnerability itself but also the exploitability is important. Hence, market share and the number of users counts; the impact of a product on the continuity of the operation (i.a. how deeply it is intertwined with other systems) should also be taken into account; the New Legislative Framework (NLF) has proven to be highly effective in addressing different risk levels of products, e.g. with different modules provided as the basis for conformity assessment procedures and determination of the appropriate risk. This should be applied in the same way in the case of cybersecurity; the larger the market share, the greater the range for cyber attacks (potential victims); the risks to rights and freedoms of individuals (not covered by the "societal importance" risk category above). Respondents were asked who should determine the risk associated with a product and, as a result, its risk categorisation . The majority of respondents (52%) indicated that risks and risks categorisation should be determined by ‘an independent body responsible for verifying compliance with the cybersecurity requirements’ while ‘a competent authority’ was indicated by 39% of respondents. Similarly, most companies of all sizes chose the same answer, in addition to indicating that manufacturers should also be involved. Among the respondents who chose to elaborate their answer or to provide a different answer, a few indicated other actors that should be involved in the determination of risk and risk categorisation : an independent body responsible for standardisation like ISO IEC for critical components; the user/customer; the risk associated with a product and, as a result, its risk categorization should be developed jointly in a multi - stakeholder approach. Q19: Self-declaration Respondents were asked to assess if a self-declaration of conformity by a hardware or software manufacturer gives sufficient confidence that security requirements are met (on a scale from 1 to 5 with 5 indicating that you strongly agree). Most of all respondents responded with 2 (28%), followed by 3 (23%). The response from companies was more positive, with 27% choosing 3, and 23% responding 5. Most large companies responded with 3 (33%), followed by 2 (19%), and medium companies with 2 (33%). Small companies were equally split between 1 and 5 (40% each), while the two Micro companies were between 2 and 5. Q20: Third-party verification Respondents were asked if they consider that self-declaration is not enough to demonstrate compliance with security requirements, do they think that the involvement of a third party should be required under certain circumstances . Most respondents answered yes (79%), 13% answered no, while 8% didn’t know. There was no difference between the respondent groups. The majority of large (83%), medium (80%), small (100%) and micro (100%) companies also answered yes. Respondents were asked under which circumstances should third-party verification apply . Most respondents answered that if a product presents a higher risk (68%). The majority of large (63%), medium (50%), small (100%) and micro (100%) companies agreed. Those that responded “other” were asked to elaborate. While some respondents thought that self-assessment can be sufficient (in combination with standards, market surveillance and the disciplining effect of the market), nevertheless clear majority said that third-party verification is needed, especially for higher-risk products to ensure compliance, objectivity and accountability. Q21: Effectiveness of horizontal requirements Respondents were asked to what extent they agree that cyber risks can propagate across borders and sectors at high speed, which is why cybersecurity rules for products with digital elements should be aligned at the Union level . Most respondents strongly agreed (71%) and agreed (21%). There was no difference among the respondent types. The majority of large (70%), medium (83%), small (60%) and micro (100%) companies also strongly agreed. Respondents were asked to what extent they agree that horizontal cybersecurity requirements for products with digital elements would increase the awareness of users when it comes to cyber risks . Most respondents agreed (54%) and strongly agreed (24). There was no difference among the respondent types. Large companies agreed (51%) and strongly agreed (24%). Medium companies strongly agreed (50%). 40% of small companies disagreed, while the rest of the responses were split between all the other responses. 100% of Micro companies strongly agreed. Respondents were asked to what extent they agree that horizontal cybersecurity requirements for products with digital elements would enhance and ensure a consistently high level of the security of products with digital elements . Most respondents agreed (43%) and strongly agreed (42%). There was no difference among the respondent types. Large companies strongly agreed (45%) and agreed (33%). Medium companies strongly agreed (67%). Small companies strongly agreed (40%) and agreed (20%). Micro companies strongly agreed (100%). Respondents were asked to what extent they agree that horizontal cybersecurity requirements would improve the functioning of the internal market by levelling the playing field for manufacturers of products with digital elements as regards cybersecurity features . Most respondents strongly agreed (47%) and agreed (34%). There was no difference among the respondent types. Large companies agreed (40%) and strongly agreed (36%) Medium companies strongly agreed (67%). Small companies were split between strongly agreeing (40%) and strongly disagreeing (40%). Micro companies strongly agreed (100%). Q22: Horizontal requirements for digital dual-use products The EU Action Plan on synergies between civil, defence and space industries underlines the importance of promoting and applying common standards across sectors and the increased relevance of products with digital elements that are used both in a civilian and military context (‘dual-use products’). Respondents were asked to what extent could horizontal requirements applying to digital dual-use products contribute to moving the security performance of such products closer to the needs of the defence community and to raising the overall level of cybersecurity in civilian uses (on a scale from 1 to 5 with 5 indicating a very positive contribution). Most respondents did not know/had no opinion (47%). Among those who had, most selected 4 and 5 (16% each). Large companies didn’t know/had no opinion (48%), followed by 4 (17%). Medium companies chose 4 and 5 (33% each). Small companies indicated 3 (50%), and the rest were split between 2 and 5 (25% each). Micro companies were split between 1 and 5. Respondents were asked to elaborate. Some respondents with caveats, but in general agreed with the question . Some expressed scepticism and stressed the differences between the sectors, differing security requirements and potential price increases for consumers . Q23: The impact on costs Respondents were asked to assess the impact of guidelines or recommendations for the development of secure products with digital elements issued at the EU level addressed to manufacturers on their costs (on a scale from 1 to 5 with 5 indicating that the intervention would be very costly). Most large companies (49%) responded that the impact on costs will be 2. The responses from medium companies were mixed and equally distributed across 1 and 5 (20%). Most small companies (40%) responded that the impact on costs will be 4. The response from two Micro companies was mixed, equally distributed between 1 and 5. Respondents were asked to assess the impact of further voluntary European cybersecurity certification schemes for products with digital elements and services on their costs (on a scale from 1 to 5 with 5 indicating that the intervention would be very costly). The majority of large (47%), medium (60%) and small (40%) companies responded that the impact on costs will be 3. The response from two micro companies was mixed, equally distributed between 2 and 5. Respondents were asked to assess the impact of EU public procurement guidelines taking into account cybersecurity requirements on their costs (on a scale from 1 to 5 with 5 indicating that the intervention would be very costly). Most large companies (28%) responded 2. Most medium companies (60%) responded 3. Small companies were divided between 2 (40%) and 3 (40%), while two micro companies were between 1 and 5. Respondents were asked to assess the impact of amending existing legislation regulating specific products with a digital dimension (such as the legislation on lifts or gas appliances) on their costs (on a scale from 1 to 5 with 5 indicating that the intervention would be very costly). Companies of all sizes provided equally split responses, with large companies between 4 (28%) and “Don’t know/no opinion” (28%), medium companies between 3 (40%) and 5 (40%), small companies between 1 (40%) and “Don’t know/no opinion” (40%), and two micro companies between 1 and 5. Respondents were asked to assess the impact of introducing mandatory horizontal cybersecurity requirements for hardware products on their costs (on a scale from 1 to 5 with 5 indicating that the intervention would be very costly). Large companies' responses closely clustered around 3 (26%) and 4 (23%). Most medium companies responded with 3 (40%), while most small companies indicated 1 (40%). Two micro companies were split equally between 1 and 5. Respondents were asked to assess the impact of introducing mandatory horizontal cybersecurity requirements for software products on their costs (on a scale from 1 to 5 with 5 indicating that the intervention would be very costly). Large companies responded closely between 3 (26%), 4 (23%), 5 (25%). Medium companies were split between 3 (40%) and 5 (40%). Most small companies responded with 1 (40%), while two micro companies were split between 2 and 5. Respondents were asked to elaborate on their answers, by quantifying the costs if possible. Multiple respondents noted that it is difficult to quantify and provide costs . Several respondents noted that the benefits will likely outweigh the costs . Most stakeholders who provided written responses expressed overall support for the horizontal requirements . Conversely, multiple stakeholders expressed the dangers of legislative fragmentation . Q24: Proportionate obligations for SMEs Respondents were asked if subjecting SMEs to the same obligations as larger companies would ensure that SME hardware and software manufacturers , including individual entrepreneurs, are subject to proportionate obligations (balance between administrative burden and compliance costs on the one hand and a high level of cybersecurity on the other hand) under European legislation introducing mandatory horizontal cybersecurity requirements (on a scale from 1 to 5 with 5 indicating that you strongly agree with a statement). Large companies responded with 4 (30%) and 5 (21%). Most medium and small companies chose 5 (40% within each size category). Two micro companies were split between 4 and 5. Respondents were asked if introducing simplified procedures to demonstrate conformity for SMEs and individual entrepreneurs would ensure that SME hardware and software manufacturers , including individual entrepreneurs, are subject to proportionate obligations (balance between administrative burden and compliance costs on the one hand and a high level of cybersecurity on the other hand) under European legislation introducing mandatory horizontal cybersecurity requirements (on a scale from 1 to 5 with 5 indicating that you strongly agree with a statement). Most large companies responded with 4 (24%) and 3 (20%). Medium companies were equally divided between all 5 responses (17% per each response). Small companies were divided between 2 and 5 (20% per response). Two micro companies chose 5. Respondents were asked to elaborate on which other approaches could ensure proportionate obligations vis-à-vis SME hardware and software manufacturers , including individual entrepreneurs. Several respondents suggested reducing the cost of/simplifying assessment and certification. Several respondents stressed that obligations should be based on the criticality of the product rather than the company size. Several respondents discussed horizontal regulation as a solution. Q25: The impact on competition Respondents were asked if mandatory cybersecurity requirements will put smaller hardware and software manufacturers at a disadvantage compared with larger competitors (on a scale from 1 to 5 with 5 indicating that you strongly agree with a statement). Large companies responded 4 (30%) and 2 (23%). Medium companies were split between 1 and 2 (30% per response). Most small companies chose 1. Two micro companies were split between 2 and 5. Respondents were asked if mandatory cybersecurity requirements will put EU hardware and software manufacturers at a disadvantage in the non-EU markets compared to non-EU competitors that are not subject to such requirements (on a scale from 1 to 5 with 5 indicating that you strongly agree with a statement). Large companies chose 2 (33%) and 1 (21%). Most medium companies responded 2 (50%). Small companies we divided between 1 and 3 (40% each), while two Micro companies between 1 and 5. Q26: The impact on fundamental rights Respondents were asked if horizontal cybersecurity requirements for products with digital elements would enhance the protection of privacy and personal data (on a scale from 1 to 5 with 5 indicating that you strongly agree with a statement). Most respondents selected 5 (41%), followed by 4 (32%). There were no outliers among the different types of respondents. Large companies chose 5 (42%) and 4 (33%). Medium companies selected 5 (50%) and 3 (33%). Small companies indicated 3 (40%) and the rest were split between 4 and 5 (20% each). Micro companies chose 5 (100%). Respondents were asked if horizontal cybersecurity requirements for products with digital elements would ensure a high level of consumer protection (on a scale from 1 to 5 with 5 indicating that you strongly agree with a statement). Most respondents chose 4 (38%), followed by 5 (36%). There were no outliers among the different types of respondents. Large companies chose 5 (42%) and 4 (35%). Medium companies selected 5 (65%). Small companies indicated 3 (40%) and the rest were split between 4 and 5 (20% each). Micro companies chose 5 (100%). Q27: Other challenges Respondents were asked to elaborate if in addition to the issues above, are there other cybersecurity-related challenges not directly linked to the cybersecurity of products that the Cyber Resilience Act should include to enhance the cyber resilience of the internal market. Multiple stakeholders stressed end-user education/responsibility, digital literacy, skills and training. Multiple respondents discussed the need to ensure legislative coherence and avoid duplication and fragmentation. Related to this, some respondents want to narrow the scope of the CRA. Several respondents discussed sector-specific solutions. Annex 3: Who is affected and how? The f ollowing stakeholders would be mainly affected by the initiative: Software manufacturers Hardware manufacturers Importers of products with digital elements Distributers of products with digital elements End-users, including businesses , public authorities and consumers Market surveillance authorities Accreditation and notifying authorities Notified bodies The initiative would broadly and most significantly impact the EU software and hardware market. A high-level market overview has been provided in section 5.1.1 . This Annex includes a more a detailed overview of the market players that woul d be affected by the initiative developed by the supporting study , and the overview of aggregated costs and benefits for the preferred policy option . Market Analysis: hardware and software manufacturers The EU software market Methodology Based on the data gathered by a recent study which provided for a breakdown of the software and software-based services market , the following categories can be identified: (1) Software products ; (2) Software-related services ; (3) Cloud computing ; (4) Games. Figure SEQ Figure \* ARABIC 3 : Software market segmentation The proxy used ( Software Development - SD ) is not an official Eurostat statistic but represents an indicator built for the purpose of this impact assessment. It aims to provide an estimation of the size of the market and is based on the following NACE 2 activities : [J582] Software publishing, which encompasses; [J5821] Publishing of computer games; [J5829] Other software publishing, and [J6201] Computer programming activities. It is worth noting that the data included in this proxy indicator excludes activities linked to consultancy activities ([J6202]) facilities management activities ([J6203]) and other information technology and computer service activities ([J6209]) in line with the scope of the initiative. The software market in Europe has been growing steadily. Due to constraints of available data, the analysis has been narrowed down by looking at a set of six Member States for which complete data was available. Hence, considering a sub-set of EU Member States, the SD appears to be growing in all its main indicators (i.e. production value, turnover and total number of enterprises) over the past five year. While production value and turnover increased of 36 % and 39 % respectively, the number of enterprises in the sector experienced a prominent growth, equal to approximately 44 %. Year 2015 2016 2017 2018 2019 Czech Republic 51 669 55 637 61 157 68 229 72 712 Germany 867 11 793 12 705 13 889 14 874 France 20 868 23 131 23 894 24 797 26 816 Italy 19 359 20 157 20 784 20 773 20 384 Hungary 7 094 7 593 8 647 10 320 11 755 Poland 24 141 23 266 21 954 23 525 25 547 TOTAL 124 000 141 577 149 141 161 533 172 088 Table 1 4 : SD by country – turnover between 2015 and 2019 in EUR million The Project Team aggregated the statistics provided by Eurostat concerning the structure of the industry by employment class size in order to assess the presence of SMEs within the software market . Due to confidentiality, data is not available for all the Member States, therefore the Project Team has selected a sample of countries with full datasets to assess the proportion of SMEs within the software market. Additionally it is worth noting that the data presented in REF _Ref106015612 \h \* MERGEFORMAT Table 14 constitutes an over-estimation of the number of enterprises as the granularity level available in the dataset does not encompass [J6201] as an indicator but provides the aggregated [J620] which also includes computer consultancy activities ([J6202]), computer facilities management activities ([J6203]) and other information technology and computer service activities ([J6209]). The results illustrate that the software industry is almost entirely composed of SMEs. In fact, whereas the total number of enterprises for the selected sample amounted to 341 781 in 2019, the number of SME operating in the software market in the same year ( REF _Ref106015612 \h \* MERGEFORMAT Table 15 ) reached 340 918, accounting for 99 . 7 % of the total. The very large majority (94 %) of SMEs operating in the software market are micro enterprises (less than nine employee). SMEs account for 5 % and 1 % of the market respectively, both relatively more present in the software publishing activity, accounting for a cumulative 11.7 % of total SMEs. However, when looking at the turnover generated by SMEs ( REF _Ref106015645 \* MERGEFORMAT Table 1 6 ) in the software market for sample countries, it accounts for 41 % of the EUR 305 444 billion which shows the important relative weight of big market players that may constitute only 0 . 3 % of enterprises in the market but generate 59 % of revenue. SME size (n° of employees) All Micro Small Medium (0-9) (10-49) (50-249) [J582] Software publishing 14 379 12693 1 326 360 [J620] Computer programming, consultancy and related activities 326 539 307 667 15 648 3 224 Total 340 918 320 360 16 974 3 584 % of SMEs 100 % 94 % 5 % 1 % Table 1 5 : SD in sample EU countries – number of SMEs in 2019 SME size (n° of employees) All Micro Small Medium (0-9) (10-49) (50-249) [J582] Software publishing 11 410 . 8 1 735 . 7 3 662 . 4 6 012 . 7 [J620] Computer programming, consultancy and related activities 113 242 . 3 35 740 . 2 34 009 . 1 43 493 Total 124 653. 1 37 475 . 9 37 671 . 5 49 505 . 7 % of SMEs 100 % 30 % 30 % 40 % Table 16 : SD in sample EU countries – turnover in million in 2019 According to the literature, it is in principle possible to segment the open source software (OSS) market into commercial open source and non-commercial open source. In opposition to its counterpart, commercial open source is defined as “ open source software projects that are owned by a single firm that derives a direct and significant revenue stream from the software ” . However, as it also emerged during the consultations for this study (interviews, workshop), it is difficult to estimate the commercial value of commercial open source software solely. Therefore, the values provided in this Box are to be considered at an over-evaluation of the market as it encompasses non-commercial OSS as well. It is estimated that companies located in the EU invested around EUR 1 billion in OSS in 2018 , which resulted in an overall impact on the European economy of between EUR 65 and 95 billion according to a DG CNECT study . In the same study, a survey carried on 900 companies revealed that small and micro enterprises can attribute over half their revenues to OSS, and particularly OSS related services. Respondents (and particularly small and micro respondents) also reported a high percentage of innovation-related expenses, and almost 50 % of their OSS contributions related to internal product development and another 40 % to already existing OSS. When looking at the key actors in the OSS market, EU OSS manufacturers (solo manufacturers , academics, government personnel and employees) contribute significantly to the global OSS ecosystem. However, it is employees of small and very small businesses that are most likely to contribute OSS code (“commits”) in the EU, whereas in other markets, such as the US, commits are mostly made by large manufacturers of products with digital elements . European contributors are estimated to be at least 260 000, representing 8 % of the almost 3.1 million EU employees in the computer programming sector in 2018. 50 % of contributors are already within the ICT industry (8 % of all employees participated in OSS development EU-wide). 2019 2020 Growth Open Source Software & IT Services market Production Value (in million EUR) 5 233 5 684 8 . 6 % Share in software market 10 . 30 % 10 . 70 % - Employment (FTEs) 52 400 56 700 8 . 2 % Zoom into Open Source Software production values (in EUR million) Open Source Software 365 403 10 . 4 % Infrastructure Software & Platforms 199 229 15 . 1 % Application Software Products 129 138 7 . 0 % SaaS 27 36 33 . 3 % Table 17 : A closer look at the OSS market in France As a representation of the growth of the OSS market in the Member States, Table 17 above includes key metrics to assess the size and growth of such a market in a sample country (France). The data shows a rapid growth of OSS in France, a growth that is assessed as slightly higher than the overall software market, as the market share of OSS & IT services is estimated to have grown by 0.4 percentage points between 2019 and 2020. Similarly, when looking more closely to software available as OSS, a vast majority both in terms of production and growth is carried by infrastructure software and platforms, followed by application software products. Open Source Software as a Service (SaaS) remains a minimal part of the OSS available on the market (8 . 9 % in 2020) but is the fastest growing market segment (33 . 3 % from 2019 to 2020). Box 4 : The open source software (OSS) market – outlook Trends in the EU software market Along with the rest of the ICT sector, the economic outlook for the software market is positive, having continued to grow throughout the pandemic crisis. Indeed, spending in the software market has seen a year to year growth rate of about 5 % in 2020, a number expec ted to remain constant in 2021. As highlighted by the European Parliament in the Global Trends to 2035 , the software market will continue evolving with a high reliance on automation and artificial intelligence in many industries. According to the International Data Corporation (IDC), AI spending is expected to rise by 33 % between 2020 and 2023. The software market is also impacted by technological advancements such as the surge of big data analytics and faster data processing enables business to drive down costs and better define their business strategies by leveraging business intelligence tools and software enabling to make informed decisions based on data (e.g. market trends and consumer buying patterns). The global business intelligence software market size was valued at EUR 23.87 billion in 2018 and is expected to witness a CAGR of 10.1 % from 2019 to 2025. Trade in EU software market According to the CN classification, the software is classified according to : The media on which it's been recorded and the nature of the software. Media include CD, DVD, Laserdisc, Minidisc and other laser-read disks. Even though there are differences in the manufacturing and recording - or writing - processes, these are all designed to be read by some kind of laser system once recorded, floppy disks, magnetic tapes, magnetic stripe cards, memory cards, cartridges for video games consoles. For the purposes of Tariff classification, software categories include: programs and data, sound recordings, computer games, films, pictures and image files, games for video games consoles. As explained at the beginning of this section, this classification is fully based on products and cannot be directly compared to classifications based on economic activity (e.g. NACE). The latter is at the same time more aggregated, but also better able to reflect the intangible nature of the activities underlying the production of software. We have then selected the code 8523 (Discs, tapes, solid-state non-volatile storage devices, ‘smart cards’ and other media for the recording of sound or of other phenomena, whether or not recorded, including matrices and masters for the production of discs) that covers all those software categories. In percentage terms, compared to hardware, the software share of extra-EU imports is lower, and it is separated from that of intra-EU27 imports by 18 percentage points (see Figure 4 ) . When looking at the figure by country, Ireland (EUR 629 329 645) and the Netherlands (EUR 974 898 158) have higher values of imports from extra-EU27 than intra-EU27. Also, Germany (highest value of extra-EU imports in absolute terms, namely EUR 1 028 886 828), Poland (EUR 584 605 358) and France (EUR 453 722 408) have high values of extra-EU imports, however, for those countries values are lower than intra-EU27 imports. Figure SEQ Figure \* ARABIC 4 : Imports , intra and extra EU27, in percentage shares based on values in EUR, 2021, software Figure SEQ Figure \* ARABIC 5 : Imports , intra and extra EU27, values in EUR, 2021, software The EU hardware market Methodology Proxies were used to assess the dimension of the hardware market. The data on ICT-SC could be considered as under-representative of the overall market for hardware products as it does not account for manufactured products produced in other sectors (e.g. smart toys) , which can be digitally connected. This can lead to an underestimation of impacts. Therefor e, the analysis of impacts also considers the extended classification (ICT-EXC-ADJ), representing a sub-set of 2-digit NACE 2 activities of the manufacturing sector combined with a weighting coefficient allowing for a more accurate assessment of the hardware market The proxies used to provide an estimation of the size of the market are: ICT manufacturing sector – standard classification (ICT-SC), representing a sub-set of 3-digit NACE 2 activities of the manufacturing sector. The ICT-SC is used by Eurostat as standard classification for economic activity. The NACE 2 activities included in the ICT-SC are: [C261] Manufacture of electronic components and boards; [C262] Manufacture of computers and peripheral equipment; [C263] Manufacture of communication equipment; [C264] Manufacture of consumer electronics; and [C268] Manufacture of magnetic and optical media. It is worth noting that the data on ICT-SC could be considered as under-representative of the overall market for hardware products as intended by the scope of this study, as it does not account for products manufactured in other sectors (e.g.; smart toys in C324) which can be digitally connected. Nevertheless, at present, ICT-SC appears to be the most appropriate proxy to assess the hardware market as similar classifications are also used in relevant publications. ICT manufacturing sector – extended classification (ICT-EXC), representing a sub-set of 2-digit NACE 2 activities of the manufacturing sector. The ICT-EXC is not an official Eurostat statistic but represents an indicator built by the Project Team for the purpose of this study. The NACE 2 activities included in the ICT-EXC are: [C26] Manufacture of computer, electronic and optical products; [C27] Manufacture of electrical equipment; [C28] Manufacture of machinery and equipment n.e.c.; [C30] Manufacture of other transport equipment; [C32] Other manufacturing; and [C33] Repair and installation of machinery and equipment. The ICT-EXC can be considered the upper limit for the assessment of the size of the hardware market. It is worth noting that the ICT-EXC assumes that all the products manufactured in these sectors are digital or feature a digital component. This is indeed a relevant limitation of this approach as it overestimates the size of the hardware market. For this reason, the Project Team applied a weighting coefficient allowing for a more accurate assessment of the hardware market. Particularly, this study applies the percentage of enterprises integrating digital processes to the selected ICT-EXC indicators to all the NACE 2 2-digit activities selected by the Project Team (see above) , with the exception of C26 which is considered in its entirety . The calculation of the different indicators will be performed by using the formula below, providing ICT-EXT adjusted (ADJ) results. The Project Team recognises that the percentage of enterprises integrating digital processes (K in the formula below) represents a sub-optimal coefficient as it does not refer to the production of products with digital elements within the sectors, but to measures of digital intensity within the production process. This happens because the NACE classification is ‘economic activity-based ’ , and not ‘product-based’ classification. As the coefficient differs for each NACE 2 activity, REF _Ref106015988 \h \* MERGEFORMAT Table 1 9 presents the coefficient applied to each activity for the purpose of this study. Hence, the parameters of the NACE 2 activities are adjusted by multiplying the total value with the coefficients of Table 1 9 . ICT-EXT-ADJ indicator = C26 * K C26 + C27 * K C27 + C28 * K C28 + C30 * K C30 + C32 * K C32 + C32 * K C32 Table 18 shows the NACE 2 activities included by the Project Team in the different proxies used to assess the hardware market. Table 18 : Proxies and NACE 2 activities Table 19 : Share of enterprises implementing digital processes by NACE2 activity – ICT-EXT-ADJ ICT manufacturing sector – standard classification In 2019, the production value of the EU-27 ICT-SC amounted to EUR 222 billion. During the same year, the sector recorded a turnover of EUR 285 billion with a total number of enterprises of 22 773. As the database contains several breaks in the time series of the abovementioned indicators, the Project Team narrowed down the analysis by looking at a set of six Member States for which complete data was available. Hence, considering a sub-set of EU Member States, the ICT-SC appears to be growing in all its main indicators (i.e.; production value, turnover and total number of enterprises) over the past five year. REF _Ref106016142 \* MERGEFORMAT Table 20 , REF _Ref106016144 \* MERGEFORMAT Table 21 and REF _Ref106016148 \* MERGEFORMAT Table 22 illustrate the upward trend over time of these indicators in the selected countries. Particularly, while production value and turnover increased of 21 % and 23 % respectively between 2015 and 2019, the number of enterprises in the sector experienced a less prominent growth, equal to approximately 13 % over the same reference period. Year 2015 2016 2017 2018 2019 Czech Republic 8 071 . 5 8 193 . 4 8 351 . 8 9 676 . 7 9 427 . 7 Germany 33 698 . 4 33 270 . 9 33 069 . 9 34 186 . 6 34 841 . 1 France 16 067 . 5 16 487 . 5 14 895 . 8 22 653 . 9 26 720 . 1 Italy 10 382 . 7 10 695 . 5 10 927 . 5 11 720 . 1 12 087 . 0 Hungary 9 540 . 3 9 908 . 3 10 596 . 7 10 174 . 7 12 320 . 2 Poland 7 608 . 5 7 101 . 0 7 805 . 9 8 110 . 9 8 042 . 4 TOTAL 85 368 . 9 85 656 . 6 85 647 . 6 96 522 . 9 103 438 . 5 Table 20 : ICT-SC by country - production value between 2015 and 2019 in EUR million Year 2015 2016 2017 2018 2019 Czech Republic 8 315 . 1 8 391 . 6 8 860 . 9 10 190 . 8 9 956 . 7 Germany 37 761 . 7 37 459 . 8 37 671 . 6 43 272 . 4 41 746 . 9 France 16 792 . 0 17 439 . 5 15 387 . 2 23 585 . 0 27 364 . 9 Italy 10 495 . 0 10 770 . 6 11 093 . 8 11 293 . 2 11 678 . 3 Hungary 10 939 . 4 11 453 . 1 12 113 . 0 11 491 . 5 14 143 . 9 Poland 8 127 . 0 7 675 . 4 8 207 . 4 8 981 . 8 8 895 . 9 TOTAL 92 430 . 2 93 190 . 0 93 333 . 9 108 814 . 7 113 786 . 6 Table SEQ Table \* ARABIC 21 : ICT-SC by country - turnover between 2015 and 2019 in EUR million Year 2015 2016 2017 2018 2019 Czech Republic 2 348 2 326 2 303 2 238 2 260 Germany 3 762 3 684 3 644 4 275 4 423 France 1 693 1 632 1 381 1 417 1 416 Italy 3 370 3 327 3 265 3 204 3 303 Netherlands 919 909 926 1 015 1 050 Poland 1 738 1 896 2 019 2 428 2 448 Slovakia 621 920 974 1 388 1 414 TOTAL 14 451 14 694 14 512 15 965 16 314 Table 22 : ICT-SC by country - number of enterprises between 2015 and 2019 When referring to turnover, it is difficult to assess the share of the revenues related to B2C and B2B . Nevertheless, by looking at the German hardware market, it is possible to highlight that revenues from hardware sales are equally split between B2B (48 . 1 %) and B2C (51 . 9 %) sectors in 2018. The reason behind this split is the strong consumer business stream connected to the sale of smartphones, laptops and general consumer. This represents an important distinction with the software and services market where the B2B component is predominant, accounting for more than two-thirds of the overall sales. The device market – outlook The device market is a segment of the IT hardware market, including PCs and phones sub-segments. While the PCs’ segment encompasses physical units of computing systems (e.g.; tablets), the phones’ segment includes mobiles and fixed lines used both by businesses and consumers. The global revenues of the device market amounted to EUR 766 billion in 2021 , with Europe accounting for 24 % of the total ( EUR 184 billion ) . The phones’ segment represents the most relevant part of the device market with a total revenue of EUR 511 million in 2021 and expected to reach EUR 586 billion by 2026 (CAGR equal to 2.8 %). The European phones’ market accounts for 23 % of the total in 2021 ( EUR 117 billion) , with Germany and France being the two main markets (EUR 17 and 12 billion respectively) . The PC’ segment reached global revenues for EUR 255 billion in 2021, with Europe accounting for 26 % of the total ( EUR 66 billion ). The segment is expected to have a slower growth than the phones’ segment as the CAGR is expected to be 0.9 % until 2026. The Project Team aggregated the statistics provided by Eurostat concerning the structure of the industry by employment class size to assess the presence of SMEs within the hardware market . The results illustrate that the European ICT-SC manufacturing industry is almost entirely composed of SMEs. In fact, whereas the total number of enterprises amounted to 22 773 in 2019, the number of SME operating in the hardware market in the same year reached 22 119, accounting for 97 . 13 % of the total. The large majority (82 %) of SMEs operating in the hardware market are micro enterprises (less than nine employee). SMEs account for 14 % and 4 % of the market respectively, the latter being relatively more present in the manufacturing of electronic components and boards, amounting to 5 . 7 % of the total SMEs. However, when looking at the turnover generated by SMEs in the hardware market, it accounts for 21 . 9 % of the global turnover which shows the very important weight of larger companies that may constitute only 2 . 87 % of enterprises in the market but generate 78 . 1 % of revenue. SME size (n° of employees) All Micro ( 0-9 ) Small ( 10-49 ) Medium ( 50-249 ) Manufacture of electronic components and boards (C261) 9 669 7 333 1 781 555 Manufacture of computers and peripheral equipment (C262) 5 347 4 745 462 140 Manufacture of communication equipment (C263) 4 629 3 815 591 223 Manufacture of consumer electronics (C264) 2 462 2 201 198 63 Manufacture of magnetic and optical media (C268) 12 NA 12 NA Total 22 119 18 094 3 044 981 % SMEs 100 % 82 % 14 % 4 % Table 23 : ICT-SC in EU-27 - number of SMEs in 2019 by size SME size (n° of employees) All Micro ( 0-9 ) Small ( 10-49 ) Medium ( 50-249 ) Manufacture of electronic components and boards (C261) 19 071 . 7 2 346 . 0 5 357 . 8 11 367 . 9 Manufacture of computers and peripheral equipment (C262) 3 263 . 7 1 240 . 4 2 023 . 3 NA Manufacture of communication equipment (C263) 9 234 . 0 1 784 . 4 1 942 . 1 5 507 . 5 Manufacture of consumer electronics (C264) 2 595 . 8 325 . 4 725 . 2 1 545 . 2 Manufacture of magnetic and optical media (C268) 86 . 3 33 . 4 52 . 9 NA Total 34 251 . 5 5 729 . 6 10 101 . 3 18 420 . 6 % SMEs 100 % 82 % 14 % 4 % Table SEQ Table \* ARABIC 24 : ICT-SC in EU-27 – turnover in EUR million in 2019 by size The weight of the ICT manufacturing on the overall European economy was stable over the past five years and still appears to be limited, amounting to 0 . 41 % in 2019. REF _Ref106016412 \* MERGEFORMAT Figure 6 presents the evolution of the relative weight of the ICT-SC on the GDP of the main European economies (i.e . : Germany, France and Italy) between 2015 and 2019. While France experienced a substantial increase in the relative weight of the sector, Germany and Italy ICT-SC manufacturing did not change over the period under analysis. Furthermore, the graph outlines the average of the same indicator for a larger set of EU Member States . Figure SEQ Figure \* ARABIC 6 : Percentage of the ICT-SC on GDP - Value added at factor cost in the ICT-SC sector In 2018, the value added of the ICT sector in the EU-27 amounted to EUR 590 billion. Nevertheless, more than 90 % of the value-added concerns ICT services, with ICT-SC accounting for a marginal part over the total. Moreover, it is important to point out that, while the ICT service sector experienced an upward trend in the value-added between 2006 and 2018, the ICT-SC witnessed a slight decline in the same period. REF _Ref106016456 \* MERGEFORMAT Figure 7 presents the value-added trend over between 2006 and 2020 (please note that 2019 and 2020 represent nowcasted data. Figure SEQ Figure \* ARABIC 7 : ICT-SC value-added between 2006 and 2020 - EUR billion ICT manufacturing sector – extended classification When considering the ICT-EXT-ADJ , the production value of the EU-27 amounted to EUR 1 081 billion, the turnover to EUR 1 220 billion and the total number of enterprises of 249 513 in 2019. REF _Ref106016491 \* MERGEFORMAT Figure 8 provides a breakdown by NACE 2 activities of the estimated market size for hardware in 2019. The manufacture of machinery equipment and n.e.c. represents the main one for production value and turnover. On the contrary, repair and installation of machinery equipment is the NACE 2 activity with the highest number of enterprises. Figure SEQ Figure \* ARABIC 8 : Breakdown of indicators by NACE2 activities (ICT-EXC-ADJ) – EU27, 2019 Semiconductors (also known as chips) are substances that have specific electrical properties allowing them to ensure the conductivity between conductors and insulators, making them a founding component for computers and other electronic devices. Semiconductors are essential to many commonly used hardware products such as smartphones, tablets or PCs. The European Semiconductor Industry Association (ESIA) reported that yearly semiconductor sales in the European market reached EUR 44.57 billion in 2021, a 27 . 3 % increase versus 2020 . As global reliance on electronics continues to grow, the potential market for semiconductor manufacturers and retailers will continue to increase as well. 2022 is expected to reach two-digit growth compared to the previous year, with revenue from sales expected to amount to EUR 49 billion. Globally, semiconductor sales amounted to EUR 518.81 billion in 2021, a 26 . 2 % increase from 2020. Therefore, the European market for semiconductors represented, in 2021, 8 . 6 % of global sales, a slight increase from the 8 . 5 % of 2020. However, sales from 2019 to 2020 have seen a slower increase globally and even decreased in Europe as shown below . The lag encountered in the European semiconductor market has been increasingly catching up since 2020 with increasing forecasted sales. This growth in the European market is expected to exceed the global figure with the market share dedicated to European enterprises increasing from year to year. Semiconductor global and European market outlook 2019 2020 2021 2022* Global semiconductor sales (in EUR billion) 384 . 1 411 . 1 518 . 8 560 . 0 Growth - 7 % 26 % 8 % European semiconductor sales (in EUR billion) 37 . 2 35 . 0 44 . 6 49 . 4 Growth - -6 % 27 % 11 % European market share 9 . 7 % 8 . 5 % 8 . 6 % 8 . 8 % *Values for 2022 are forecast estimates The sharp increase in demand, fuelled by the effects of the COVID-19 pandemic, over the past three years has lead to a shortage in the supply of semiconductors heavily impacting a variety of industries such as automotive, health, defence or security. This global semiconductor shortage has exposed European dependency on supply from a limited number of companies and geographies, and its vulnerability to third country export restrictions and other disruptions in the present geopolitical context. Therefore, in line with the Commission’s objective of creating a state-of-the-art European chip ecosystem , the Commission released a proposal for a Regulation establishing a framework of measures for strengthening Europe's semiconductor ecosystem (Chips Act) . The EU Chips Act proposes to develop a thriving semiconductor ecosystem and resilient supply chain, while setting measures to prepare, anticipate and respond to future supply chain disruptions. To this end, if approved, the European Chips Act will have more than EUR 43 billion in place to support the development of European semiconductor supply chains. Box 5 : The semiconductor market – outlook Markets trends Despite the impacts of the COVID-19 pandemic, the IT budget of European companies appears to be growing in 2022, as outlined by a survey . Particularly, more than half of the sample declared that the IT budget will increase during the year. This trend appears to be more prominent when considering big (more than 500 employees) corporations where two-thirds of the sample signalled its intention to increase the budget. Within the IT budget, hardware represents the largest share of the spending (30 % in 2022), especially for SMEs. While not specific only the hardware market, an important trend concerning hardware is the continuous growth of the IoT sector . Particularly, IoT spending will grow at CAGR of 12.32 % from EUR 131 billion in 2019 to EUR 230 billion in 2024. By looking at the application level, the revenue in the European IoT market, including smart home technologies and smart finance technologies but excluding other IoT use cases, is projected to reach EUR 5.04 billion in 2022 and is foreseen to witness an CAGR equal to 10.5 % between 2022 and 2027, resulting in a market volume of EUR 8.14 billion by 2027 . Other IoT use cases (e.g.; autonomous cars, industrial IoT) represent more relevant market sub-segments, accounting for EUR 20.17 billion in 2020. It is worth noting that this figure includes software and thus, it is an over-representation of the market segment. An important trend concerning hardware is the continuous growth of the IoT market . The IoT market refers to all internet-enabled objects and devices that collect and exchange data. IoT products include wearables (e.g. smartwatch), smart home devices, security systems, thermostats, intelligent transportation, smart grids, and many more. They may also be referred to as connected things or smart devices. It is possible to define the European IoT market by considering it in three main ways : Infrastructure – the market is segmented into platform, mobile networks and access technologies, cloud solutions/storage and processing, analytics and security; Vertical – the market is segmented into healthcare, energy, public & services, transportation, retail, individuals, and others (e.g.; manufacturing); and Application – the market is segmented into smart home, smart wearable, smart cities, smart grid, IoT industrial internet, IoT connected cars, IoT connected healthcare, and others (e.g..; toys and drones). The IoT market represents an important part of the hardware market. The European IoT spending is expected to grow rapidly in the upcoming years. Particularly, IoT spending are forecasted to grow at CAGR of 12.32 % from EUR 131 billion in 2019 to EUR 230 billion in 2024. The IoT spending encompasses not only hardware but also connectivity, services and software spending. However, hardware remains the most relevant component of the spending, accounting for a third of the total. Looking at revenue from the IoT market in Europe, it increased in 2021 to around EUR 4.47 billion, up from around EUR 3.07 billion in 2020. By focusing at the application level (e.g. smart home, smart wearable, smart cities, smart grid, IoT industrial internet), the revenue in the European IoT market, including smart home technologies and smart finance technologies but excluding other IoT use cases, is projected to reach EUR 5.04 billion in 2022 and is foreseen to witness an annual growth rate (CAGR) equal to 10.5 % between 2022 and 2027, resulting in a market volume of EUR 8.14 billion by 2027 . Other IoT use cases (e.g.; autonomous cars, industrial IoT) represent more relevant market sub-segments, accounting for EUR 20.17 billion in 2020. It is worth noting that this figure includes software. Box 6 : The IoT market – outlook The hardware market is also experiencing new technological trends such as tinyML and low power wide area network (LPWAN). These technological developments seek to address the challenges of high operating costs of machine learning and IoT technologies, while increasing the power efficiency of traditional hardware. TinyML is a machine learning technology allowing users to run on-device, local, sensor data analytics at low-latency, low power and low bandwidth. Consequently, TinyML devices can operate ML applications while being unplugged on batteries for long periods of time (i..; in some cases years). This hardware technology is currently being used in several fields of application such as industrial productive maintenance, agriculture, healthcare and maritime conservation. LPWAN represents a set of low-power, long range area network technologies for small sensor-based data. As LPWAN operate with very little data rates and low power, the hardware underlying these systems can be developed at a very low cost. In 2020, the LPWAN market amounted to more than EUR 2.4 billion (with the European market surpassing EUR 575 million) and is expected to grow at a CAGR of over 60% between 2021 and 2027. Particularly, the German market is forecasted at more than EUR 3 billion by 2027 as both the government and the industry renewed their efforts to replace traditional approaches with LPWAN implementations. Trade in the EU hardware sector When selecting relevant codes from the CN classification to reflect the size of imports and exports of hardware, the methodological choice has been made to select all codes at 4-digit level (e.g. Electrical machines and apparatus, having individual functions) that classify computers and computer parts , as these codes cover for most of the machinery and other types of products such as basic units and components that play a digital function within a product. We are aware that, given the wide range of products and ‘smart’ products that the legislation could cover, some codes might be left out by this selection. While making the selection of these codes, the 8-digit level was studied too, in order to assess the relevance of including the specific codes or making a choice to exclude them (e.g. in case they refer to purely passive components, for example, code 8524 Flat panel display modules, whether or not incorporating touch sensitive screens are excluded because they do not incorporate drivers or circuits). The main codes selected are: 8443 Printing machinery used for printing by means of plates, cylinders and other printing components of heading 8442; other printers, copying machines and facsimile machines, whether or not combined; parts and accessories ( note: codes 8443 31, 8443 32 are particularly relevant for products with digital elements with smart functions as they refer to Machines which perform two or more of the functions of printing, copying or facsimile transmission, capable of connecting to an automatic data processing machine or to a network and – Other, capable of connecting to an automatic data-processing machine or to a network ). 8471 Automatic data-processing machines and units thereof; magnetic or optical readers, machines for transcribing data onto data media in coded form and machines for processing such data ( note: all sub-codes are highly relevant for products with digital elements ). 8473 Parts and accessories (other than covers, carrying cases, and the like) suitable for use solely or principally with machines of headings 8470 Calculating machines and pocket-size data recording, reproducing, and displaying machines with calculating functions, and to 8472 Other office machines (for example, hectograph or stencil duplicating machines, addressing machines, automatic banknote dispensers, coin-sorting machines) (note : this code represents all computer parts. There is a code 8542, that refers to electric circuits however, Eurostat does not include this code within the classifications linked to computers, computer parts, and software). 8504 Electrical transformers, static converters (for example, rectifiers) and inductors (code 8504 40 30 is – Of a kind used with telecommunication apparatus, automatic data-processing machines and units). 8514 Industrial or laboratory electric furnaces and ovens (including those functioning by induction or dielectric loss); other industrial or laboratory equipment for the heat treatment of materials by induction or dielectric loss. 8517 Telephone sets, including smartphones and other telephones for cellular networks or for other wireless networks; other apparatus for the transmission or reception of voice, images or other data, including apparatus for communication in a wired or wireless network (such as a local or wide area network), other than transmission or reception apparatus. 8518 Microphones and stands therefor; loudspeakers, whether or not mounted in their enclosures; headphones and earphones, whether or not combined with a microphone, and sets consisting of a microphone and one or more loudspeakers; audio-frequency electric amplifiers; electric sound amplifier sets. 8519 Sound recording or sound reproducing apparatus. 8521 Video recording or reproducing apparatus, whether or not incorporating a video tuner 8523 Discs, tapes, solid-state non-volatile storage devices, ‘smart cards’ and other media for the recording of sound or of other phenomena, whether or not recorded, including matrices and masters for the production of discs, but excluding products of Chapter 37. 8525 Transmission apparatus for radiobroadcasting or television, whether or not incorporating reception apparatus or sound recording or reproducing apparatus; television cameras, digital cameras and video camera recorders. 8526 Radar apparatus, radio navigational aid apparatus and radio remote control apparatus 8527 Reception apparatus for radiobroadcasting, whether or not combined, in the same housing, with sound recording or reproducing apparatus or a clock. 8528 Monitors and projectors, not incorporating television reception apparatus; reception apparatus for television, whether or not incorporating radio-broadcast receivers or sound or video recording or reproducing apparatus. 8543 Electrical machines and apparatus, having individual functions. 8544 Insulated (including enamelled or anodised) wire, cable (including coaxial cable) and other insulated electric conductors, whether or not fitted with connectors; optical fibre cables, made up of individually sheathed fibres, whether or not assembled with electric conductors or fitted with connectors (note: this code can be spurious, as it can include passive components). Following the definition, hardware imports from extra-EU countries and intra-EU imports are similar shares, with intra-EU imports only surpassing extra-EU ones by five percentage points (see Figure 9 ) . When looking at country by country figures, the value of intra-EU imports is higher than extra-EU ones for most countries with some notable exceptions, namely for the Netherlands (EUR 80 551 944 490, namely EUR 62 381 300 510 higher than intra-EU imports), Ireland (EUR 4 851 072 314, namely EUR 1 958 955 443 higher than intra-EU imports), Hungary (EUR 6 753 493 869, namely EUR 1 031 473 773 higher than intra-EU imports), and the Czech Republic (EUR 16 628 116 800, namely EUR 2 543 176 067 higher than intra-EU imports). Figure SEQ Figure \* ARABIC 9 : Imports, intra and extra EU27, in percentage shares based on values in EUR, 2021, hardware Figure SEQ Figure \* ARABIC 10 : Imports, intra and extra EU27, values in EUR, 2021, hardware Aggregated market for products with digital elements The global market for products with digital elements encompassing software and hardware has a total production value in of EUR 458 billion and turnover of EUR 550 billion in 2019 , if the hardware market is considered as only including the elements of the ICT-SC indicator. Considering the extended classification (ICT-EXT-ADJ), these values soar to EUR 1317 billion in production value and EUR 1485 billion in turnover for 2019. The number of enterprises operating in this sector is 388 532 when considering the limited scope of ICT-SC and of 615 272 with a broader scope as defined by the ICT-EXT-ADJ indicator with a vast majority being SMEs according to the Project Team’s estimations. Based on this data, these SMEs account for about 34. 4 % of the turnover generated in the market for products with digital elements for 2019. Table 25 and Table 26 illustrate these statistics. Indicators Software (SD) Hardware (ICT-SC) Total Production value (in billion EUR) 236 222 458 Turnover (in billion EUR) 265 285 550 % from SMEs 41 % 21 . 90 % 34 . 40 % Number of enterprises 365 759 22 773 388 532 % from SMEs 99 . 70 % 97 . 10 % 99 . 58 % Table 25 : Aggregated indicators for global market for products with digital elements in 2019 in the EU (SD & ICT- SC) Indicators Software (SD) Hardware (ICT-EXT-ADJ) Total Production value (in EUR billion) 236 1 081 1 317 Turnover (in EUR billion) 265 1 220 1 485 % from SMEs 41 % 21 . 90 % 34 . 40 % Number of enterprises 365 759 249 513 615 272 % from SMEs 99 . 70 % 97 . 10% 99 . 58 % Table 26 : Aggregated indicators for global market for products with digital elements in 2019 in the EU (SD & ICT-EXT-ADJ) Summary of (aggregated) costs and benefits - preferred policy option I. Overview of Benefits (total for all provisions) – Preferred Option Description Amount Comments Direct benefits Prevent internal market fragmentation n/a Affected stakeholders: Economic operators, in particular h ardware and software manufacturers Public authorities (market surveillance authorities) Enhanced security and transparency of products with digital elements n/a Affected stakeholders: Users (B2B and B2C ; public authorities ) Reduced number of cyber incidents By company/product: 20 to 33% of reduction of cybersecurity incidents At aggregated level: approximately EUR 180 to 290 billion annually for businesses No quantitative data for consumers and public authorities Affected stakeholders: Users (B2B and B2C ; public authorities ) Economic operators, in particular h ardware and software manufacturers (as regards reputational damage) Improvement fundamental rights and in particular protection of personal data and privacy against breaches n/a Affected stakeholders: Data subjects (citizens and consumers) Increased turn-over due to conformity assessment Affected stakeholders: Notified bodies Indirect benefits Decrease in risk mitigation costs (such as cyber insurance etc.) n/a Affected stakeholders: Users (B2B and B2C ; public authorities ) Higher uptake of digital solutions due to increased trust n/a Affected stakeholders: Hardware and software manufacturers Importers, distributors Decrease in compliance costs, such as for operators of essential services under the NIS Directive and entities subject to the GDPR By company: One off: 0.5 FTE (in average: EUR 33 280) for NIS entities Recurrent: 1-2% additional ICT security spending, for NIS entities (around 30 000 EUR by company, taking an average of 1.5%) Aggregated: EUR 6.95 bn , with EUR 3.65 bn from one-off costs and EUR 3.3 bn recurrent costs. Affected stakeholders: Business users public authorities Increased global competitiveness by integrating security early in the development process and CE marking n/a Affected stakeholders: Hardware and software manufacturers Positive social impact, in particular reduced number of cybercrime n/a Affected stakeholders: Businesses Consumers Public authorities Citizens Fewer incidents with a negative environmental impact n/a Affected stakeholders: Society as a whole Administrative cost savings related to the ‘one in, one out’ approach* Decrease in compliance costs, such as for operators of essential services under the NIS Directive and entities subject to the GDPR By company: One off: 0.5 FTE (in average: EUR 33 280) for NIS entities Recurrent : 1-2% additional ICT security spending, for NIS entities (around 30 000 EUR by company, taking an average of 1.5%) Aggregated: EUR 6.95 bn , with EUR 3.65 bn from one-off costs and EUR 3.3 bn recurrent costs. Affected stakeholders: Business users Public authorities Prevent internal market fragmentation due to impending divergent national rules n/a Affected stakeholders: Manufacturers of hardware and software Table 27 : Overview of Benefits (total for all provisions) – Preferred Option (1) Estimates are gross values relative to the baseline for the preferred option as a whole (i.e. the impact of individual actions/obligations of the preferred option are aggregated together); (2) Please indicate which stakeholder group is the main recipient of the benefit in the comment section;(3) For reductions in regulatory costs, please describe details as to how the saving arises (e.g. reductions in adjustment costs, administrative costs, regulatory charges, enforcement costs, etc.;); (4) Cost savings related to the ’one in, one out’ approach are detailed in Tool #58 and #59 of the ‘better regulation’ toolbox. * if relevant II. Overview of (aggregated) costs – Preferred option Citizens/Consumers Businesses Administrations One-off Recurrent One-off Recurrent One-off Recurrent Direct adjustment costs (triggered by security requirements, information obligations) N.A. N.A. *Familiarisation wit h new requirements: N.A. *Information on security of products with digital elements : N.A. * Secure product development: By company/product: + 30.5% secure product development costs (with BaU costs at 50%) Aggregated: EUR 13.13 billion (together with life cycle approach , taking into account BaU costs of 50% ) * Testing costs self-assessment : in average 18 400 EUR by product Aggregated cost: EUR 7 bn *Standardisation costs: N.A. * Familia risation with new requirements: N.A. * Appointing new market surveillance authorities ( if applicable ): EUR 1 600 000 per year * ENISA (EU Agency for Cybersecurity) : For handling reporting of vulnerabilities and incidents: 4.5 FTE Direct administrative costs N.A. N.A. *Conformity assessment (third party-assessment) : By company/product: third-party assessment: in average EUR 25 000 Aggregated: EUR 1 . 1 billion * Documentation and reporting (including c reating and updating DoC and technical documentation , affixing CE marking , and reporting ) : By product/company: +9% product development costs Aggregated: EUR 7.8 billion (based on average product unit of EUR 140 000) * Accreditation framework: N.A. (for notified bodies) N.A. N.A. Direct regulatory fees and charges N.A. N.A. N.A. N.A. N.A. N.A. Direct enforcement costs N.A. N.A. N.A. N.A. * Monitoring and enforcement new requirements : A dditional enforcement costs by product: in average EUR 12 500 Aggregated EUR 7.7 billion Indirect costs * Hi gher initial prices of products with digital elements with digital elements * Higher initial prices of products with digital elements N.A. N.A. Costs related to the ‘one in, one out’ approach Total Direct adjustment costs N.A. N.A. *Familiarisation wit h new requirements: N.A. *Information on security of product s with digital elements : N.A. *Secure product development: EUR 1 3 .1 3 billion * Testing costs (self-assessment) : self-assessment : in average 18 400 EUR by product Aggregated: EUR 7 billion Indirect adjustment costs N.A. N.A. N.A. N.A. Administrative costs (for offsetting) N.A. N.A. * Certification : By company/product: in average 25 000 EUR (BaU costs of 40% for hardware and 25% for software) Aggregated: EUR 1 . 1 billion * Documentation and reporting: By product/company: additional 9% of product development costs Aggregated: EUR 7.8 billion (based on average product unit of EUR 140 000) Table SEQ Table \* ARABIC 28 : Overview of costs – Preferred option Annex 4: Analytical methods General approach The appraisal of impacts by policy option relies on primary and secondary data collection. The collection of primary data included more specifically a workshop organised on 10 May 2022 by the contractors , an online targeted survey conducted by ICF SA, a s well as a set of telephone interviews , including with SMEs . Furthermore, in the public consultation , respondents were asked questions about impacts on costs, competition and fundamental rights that are relevant for the impact assessment. The online survey was launched on 16 May 2022 and at the moment of writing the impact assessment, the number of valid responses reached 24. In addition, the study team has conducted complementary interviews focused on cost estimates. Some additional consultation s (with SMEs in particular) have been held as well. Survey participants, workshop participants and interviewees have unanimously and consistently stressed the difficulties in providing exact figures . The main reason is that some of the requirements can be interpreted in different degrees of stringency which would impact costs in a very different way. Furthermore, the costs vary greatly depending on the type of product. Q uantitative cost estimations , even if gathered by the external Study , could not be triangulated and verified, and therefore have only been used for the cost aggregation to a very limited extent. Key assumptions for the quantification of economic impacts Several assumptions were made in order to quantify and compare the economic impacts of the different policy options. Number of products on the market In order to quantify the economic impacts of the policy options, the assumption was taken that one company produces one product as there is no possibility to know the number of products on the market. While this is an underestimation of the number of products, it is partially compensated by the fact that the number of companies is overestimated by using the ICT-EXT-ADJ indicator. Furthermore, the aggragted estimations have been made based on the assumption that all products currently on the market would be impacted, while under policy option 3 and 4, costs would actually occur for new products being placed on the market. Cybersecurity is mostly adding costs on the design of a produt, therefore looking at the number of products (e.g. number of connected devices) on the market, where some data is available, would not have been relevant. It would have been relevant to know more precisely how many products are developed by the manufacturers of hardware and software products on the EU market. However, no such data exists. While a methodological choice had to be made in the IA report, other possibilities to estimate the number of products are not excluded, such as looking at the basic analysis of a typical company structure – possibly by category of size and scopes. It could have been estimated how many products a company would develop according to its size , which would have lead to similar number of produts (when combined with a more conservative indicator) . Given that more than 99% of the market are SMEs, with 94% being micro companies, most companies on the market would effectively not develop more than one or few product s . Alternative approaches for calculating the number of products have been considered for comparison, for instance such as dividing the turnover by the average cost of one unit of product with digital elements (EUR 140 000). This would however have led to an overestimation, as turnover also includes revenues. An alternative proxy could have been to take the investments in software/hardware to be divided by the average costs for one unit of product with digital elements (EUR 140 000) , but such data was not available. Share of manufacturers already applying security requirements and testing Furthermore, for quantifying the costs and benefits , it had to be assumed how many manufacturers would likely apply the full costs of secure product development, i.e. the percentage of companies that do not yet implement adequate security practices. B ased on available data, it was estimated that currently less than 50 % of manufacturers have a systematic approach to product development in place. This estimate was based on a number of assumptions and proxies, making most use of the scarce research and data available. More specifically: (i) according to a probe into a large number of products with digital elements developed by Microsoft, the introduction of secure development life cycles was found to reduce the number of vulnerabilities in a product by 66 % ; and (ii) based on the analysis of three different studies on the maturity of manufacturers of products with digital elements in the US (2010), Norway (2015) and Finland (2021), it was estimated that currently less than 50 % of manufacturers have a systematic approach to product development (see alos Section 6.5) . While the study on US manufacturers is indeed less recent than the other two, there is evidence that shows that the overall picture has not changed since then: A very recent study on software vulnerabilities has concluded that “in 15 years, the vulnerability landscape hasn’t changed; through the lens of the metrics in this paper we aren’t making progress.” , which suggests that there has been little (if any) improvement in how manufacturers approach product security. Therefore, it has been assumed that around 50% of manufacturers have currently adequate security practices in place for products with digital elements. C ost estimation s o f secure product development In order to aggregate the costs for integrating security in product development, a number of assumptions had to be made . First, a percentage of additional product development costs had to be defined. T he Venson model calibration shows that the application of software security practices can impact the cost estimations ranging from a 19 % additional effort, on the first level of the security scale, to a 102 % additional effort, on the highest level of the scale. In order to classify the practices of secure software development, three broad categories were identified: (1) Security Requirements, and Design, (2) Secure Coding and Security Tools, and (3) Security Verification, describing different security practices according to five security levels (Nominal; High; Very High; Extra High; Ultra High) . It is estimated that the baseline security requirements aimed for in policy option 3 and 4 would equal to the security levels between "high" and "very high". Implementing security product and process requirements would represent additional product development costs between 19 % and 42 % , hence an average of 30.5 %. Second , an average estimation had to be made for the cost of a developing a product with digital elements . According to the data available, h ardware product development costs are estimated between USD 50 000 and USD 300 000 , and software product development are similarly estimated around the same range (USD 50 000 and USD 250 000 ) . Taking the median value, the average price/cost of the development of a product with digital elements could be estimated at USD 150 000, i.e. approximately EUR 140 000 . This average development costs is comparable to other estimations, such as the one done for the unit cost of an AI system in the context of the Impact Assessment for the AI Act . By using the coefficient proposed by Venson (taking the average of 30.5 %), the additional costs of security requirements for a product with digital elements could represent on average EUR 42 700 for one product with digital elements unit if this product has no security features in place. Annex 5: Background information on the problem definition Piecemeal coverage of cybersecurity in EU policies and impending national intervention While EU law lays down cybersecurity requirements for some categories of products with digital elements , the vast majority of hardware and software products is currently not covered by any EU legal act. Nonetheless, under the NLF , the EU’s blueprint for product regulation, there is a small number of legal acts providing for product-related cybersecurity requirements . T hese include the (RED) together with a recently adopted delegated regulation , which cover IoT devices outfitted with a radio interface; the Medical Devices Regulation (MDR) as well as the In Vitro Diagnostic Medical Devices Regulation , which cover both tangible medical products as well as software; the relevant regulations on motor vehicles and their trailers, which also provide, among others, for empowerments the adoption of implementing or delegated acts concerning uniform procedures and technical specifications or updating technical requirements that may also concern cybersecurity-related aspects; the Measuring Instruments Directive (MID) , which regulates measuring instruments or the Commission’s recent proposals for a Machinery Regulation (MR) , as well as a Regulation laying down harmonised rules on AI . In addition, there are a few European product laws that provide some rules regarding the cybersecurity of products, albeit only in a partial manner: These include the Toy Safety Directive , which regulates the safety of toys; the Machinery Directive , which covers machinery products, including software ensuring safety functions; the Non-Automatic Weighing Instruments Directive ; the ATEX Directive , which covers equipment and protective systems intended for use in potentially explosive atmospheres and covers some software related risks. An example of this partial coverage is the Non-Automatic Weighing Instruments Directive, which requires manufacturers to ensure that instruments are not adversely affected by external equipment connected to them and that instruments have no characteristics likely to facilitate fraudulent use, but lacks a more comprehensive approach to cybersecurity. Most hardware, such as wired IoT devices or computer components, including chipsets, memory chips or processors, as well as the vast majority of software products, such as operating systems, user applications, server software or software libraries, are not covered by any European legal act. The exploratory study contracted by the Commission and conducted in 2020-2021 to assess the need for horizontal cybersecurity requirements for products with digital elements conducted a gap analysis , comparing the cybersecurity objectives of certification schemes set out in the Cybersecurity Act (Article 51) against the identified cybersecurity-relevant requirements of 37 pieces of EU legislation concerning ICT products, including all legislation related to the NLF, as well as legislation with a strong link with cybersecurity and data protection, which can affect even indirectly and to a limited extent manufacturers (e.g. the eIDAS Regulation, GDPR , the NIS Directive, Radio Equipment Directive , General Product Safety Directive ( GPSD ) ). Among the study’s most relevant findings of the gap analysis the following could be mentioned: The current EU legislative framework does not cover all security objectives of the Cybersecurity Act, with fragmentation and gaps related to cybersecurity requirements for products with digital elements . This is illustrated below. Figure SEQ Figure \* ARABIC 11 : Gap analysis of the current EU legislative framework The legislation related to the NLF does not address fully the cybersecurity requirements for products with digital elements ; Some pieces of legislation contain cybersecurity requirements that concern services rather than products and are therefore addressed to entities/service operators. While they can indirectly affect the cybersecurity level of products with digital elements used to operate the service, they are not setting any clear obligations on the manufacturers of products with digital elements . In such cases (for example GDPR obligations on data controllers or NIS obligations on operators of essential services), the way the service operators implement the respective requirements (where there is some room for discretion) may affect in various ways the manufacturers of products with digital elements . This, in the absence of corresponding legislation setting requirements for security of products, may ultimately lead to misalignments of cybersecurity requirements and additional complexity for the manufacturers; There are different levels of granularity in the definition of the scope of products covered by the EU legislative framework that may lead to uneven burden on manufacturers of similar products or of products that may have similar importance from a cybersecurity point of view; There are different levels of granularity of cybersecurity requirements in the legislation in scope; Some pieces of legislation require the manufacturer or service provider to issue “notifications” in case of a security breach or risk , which is an objective that is not present in the Cybersecurity Act, while for some other relevant pieces of legislation such notification obligation does not exist. Such notifications may ultimately have consequences on the cybersecurity of the products that may have been concerned by such incidents and, absent a horizontal approach on similar products, may lead to an uneven playing field for manufacturers and/or uneven protection of security; and The safety aspects of products in scope are overall more addressed than the security aspect s. Furthermore, the follow-up study to support this impact assessment, contracted by the Commission in 2022, found in its preliminary in-depth analysis of relevant existing EU legislation, notably product-related, that requirements regarding software are very rarely covered by such legislation, and, even when this is the case, it is difficult to ascertain the precise cybersecurity requirements or obligations. Furthermore, it found that most of the pieces of legislation targeting product safety do not address the cybersecurity of the products falling under their scope. Moreover, the follow up study also analysed the interplay between the regulatory intervention and the Commission Data Act proposal and concluded that the scope of the latter is different and hence the two pieces of legislation would be complementary. See the more detailed preliminary analysis conducted by the study in Annex 8 Additional drivers not addressed by this intervention In addition to the main drivers described in the problem definition, the Commission has identified a number of additional problem drivers that have an impact on the security of products with digital elements as well as on the understanding of users as regards such products. These are described only very briefly in the impact assessment itself, as the regulatory intervention would not address them. Lack of bargaining power of users As described above, products with digital elements markets are often characterised by the presence of a few large manufacturers as a result of economies of scale and vendor lock-in . For example, economies of scale play a significant role when it comes to producing semiconductors, as the manufacturing process is characterised by major fixed costs. While the development of large-scale software solutions, such as operating systems, also comes at a high cost, concentration in software markets is rather explained by vendor lock-in and high switching costs: As computer programmes are usually developed in such a way that they are compatible with a specific operating system, users cannot simply switch to another operating system when they are not satisfied with the security properties of the system that they have been using so far. For example, when it comes to Microsoft’s operating system Windows, this has led the Commission to conclude that the company “can behave independently of its end-customers” . Irrespective of the reasons why some hardware and software products markets are controlled by a relatively small number of manufacturers, there are clear implications for the cybersecurity of the products offered on these markets and the security needs of users: businesses, such as operators of essential services under the NIS Directive, often lack the negotiating power to ensure that hardware and software suppliers provide products matching their own security needs. This is even more so the case when it comes to individual consumers. Lack of qualified security professionals While products with digital elements markets do not provide the right incentives for hardware and software manufacturers to take cybersecurity seriously, manufacturers are also constrained by a shortage of information security professionals in the labour market. In a recent report, the European cybersecurity agency ENISA concludes that “there is a lack of skilled and qualified personnel in the labour market to work in cybersecurity roles and who can sufficiently address the range of cyber threats posed”. The International Information System Security Certification Consortium reports that in 2021 the gap in cybersecurity professionals in Europe amounted to 199 000 (up from 168 000 in 2020). In North America, where much of the hardware and software used in Europe is designed or developed, the skills gap amounted to 402 000 (up from 376 000 in 2020). According to another recent survey, 55 % of businesses worldwide report unfilled information security vacancies, with 60 % of businesses reporting that it takes three months or longer to fill a vacancy. While a European initiative on security of products with digital elements cannot address deficiencies in the labour market, it is worth noting that the European Union has launched a number of initiatives to reduce the digital skills gap in general and the cybersecurity skills gap in particular. For instance, the Digital Europe Programme supports the development of a skilled talent pool of digital experts with EUR 580 million over the period 2021-2027, explicitly mentioning skills related to cybersecurity as one of its operational objectives. In addition, the European Cybersecurity Skills Framework developed by ENISA aims at creating a common understanding of the roles, competencies and skills required across the EU to alleviate the skills shortage in information security. Lack of cybersecurity awareness and skills of users Users often choose products with digital elements ill-suited for their needs or configure them in such a way that they can be breached easily because they are either not fully aware of the risks associated with the products they deploy or lack the necessary technical skills. According to a recent survey amongst 3 000 consumers, while 69 % consider themselves as being good or very good in protecting their accounts, two thirds reuse passwords either for some or sometimes even for all their accounts. In addition, only one third are able to correctly define a set of basic internet security terms. A study from June this year has surveyed 553 parents in the UK “that families do not consider home IoT devices to be significantly different in terms of threats than more traditional home computers, and believe the major risks to be largely mitigated through consumer protection regulation. As a result, parents focus on teaching being careful with devices to prolong device life use, exposing their families to additional security risks and modeling incorrect security behaviors to their children.” The lack of awareness not only applies to consumers but also to business users. For example, only half of company leaders and a third of employees acknowledge the risk that cybercrime poses to their organisations. Update habits are one way to measure the awareness of users of the risks associated with the technology that they use. For instance, Android users are known to delay or even entirely forgo updating applications installed on their systems despite the fact that updates are essential to patching critical holes in users’ mobile devices. It does not come as a surprise that generally speaking inexperienced users are much less likely to install crucial security updates than proficient IT users. Similarly, companies regularly fail to patch critical holes in their networks, with a large number of incidents being the result of unpatched but long known vulnerabilities in products. When it comes to cybersecurity skills, even companies regularly fail to configure their systems correctly. For example, cybersecurity incidents following a misconfiguration of cloud systems were responsible for the exposure of more than 33 billion data records in 2018 and 2019. Organisations mostly affected were tech companies, health care providers and governments. The EU is addressing digital skills through the Digital Europe Programme, which supports the development of a skilled talent pool of digital experts with EUR 580 million over the period 2021-2027, explicitly mentioning skills related to cybersecurity as one of its operational objectives. In addition, ENISA together with the Commission and the Member States organises European Cyber Security Month on an annual basis to promote cybersecurity among EU citizens and organisations and provid e up-to-date online security information through awareness raising activities and sharing of good practices . While awareness and lack of skills are important sources of incidents, manufacturers often do too little ensure that their products can be used securely “out of the box” by inexperienced users. One way to help inexperienced users is to ship products with all security settings set to maximum ( security by default ) or by automatically applying security updates without requiring an intervention by the user. Asked in the public consultation to which extent consumers understand the cybersecurity properties they should expect from products and to which extent they have the skills to operate them securely, consumers organisations gave a rating of only 1.67 (on a scale from 1 to 5). Annex 6: Global Developments United States In May 2021, an Executive Order (EO) was issued by the US President, charging operational federal agencies, including the National Institute of Standards and Technology (NIST) in the US Department of Commerce, with developing guidelines for enhancing cybersecurity through a variety of initiatives related to the security and integrity of the software supply chain. The EO established a detailed plan for taking steps to secure the federal software supply chain and called for NIST to publish guidelines for establishing best practices to detect vulnerabilities and requirements that all critical software delivered to government customers, including a software bill of materials to ensure transparency of supply chain. It also included milestones that agencies must meet to demonstrate progress toward the goals. In 2021, NIST also initiated a pilot program on cybersecurity labelling for IoT products. In the same year, as required by the EO, NIST released its definition of critical software and published guidance for outlining security measures for critical software use and minimum standards for manufacturers ’ testing of their software source code. In mid-2021, the National Telecommunications and Information Administration (NTIA) released a minimum definition of a software bill of materials (SBOM). In February 2022, NIST issued guidance for s upply c hain s ecurity . In July 2021, both the House of Representatives and the Senate of United States of America began drafting legislation in two se parate committees. In particular, the House’s Homeland Security Committee introduced seven bipartisan bills, five of which focused strictly on strengthening cybersecurity, while the Senate’s Homeland Security and Governmental Affairs Committee introduced ‘The Supply Chain Security Training Act,’ calling it a ‘bipartisan legislation to help protect against cybersecurity threats and other technological supply chain security vulnerabilities that arise when the federal government purchases services, equipment or products.’ Recently, the US Department of Defense released a report titled ‘Securing Defense Critical Supply Chains’ , where it presents its priorities and capabilities to make stronger the USA industrial base and to create a network of domestic and applied supply chains to meet national security needs. In particular, the report identifies cyber posture, characterised by industrial security, counterintelligence and cybersecurity - as one of the strategic enablers necessary to build overall supply chain resilience . United Kingdom Some developments in terms of supply chain security have been furthered also in the United Kingdom. In May 2021, the U.K. government announced that it was seeking advice on defending against digital supply chain attacks from organisations that either consume IT services, or Managed Service Providers that provide software and services. While the feedback has not been released to the public yet, the U.K. government has noted that it will result in the re-evaluation of supply chain risks, reviewing policies, and likely implementing new guidelines and frameworks to strengthen specific areas of digital supply chain security. It could also mean the introduction of new, country-wide legislation for software firms and IT service providers. Moreover, following a work carried out in 2018 on telecom supply chain security, in May 2022, the Department for Digital, Culture, Media, and Sport (DCMS) opened up a survey that closed in early July and invited comments from industry experts and tech nology organisations on stepping up supply chain security across the UK. Asia: examples of Japan and Singapore The Ministry of Economy, Trade and Industry of Japan (METI) envisages the development of a super-smart society in which cyberspace and physical space are integrated in a sophisticated manner, the so-called "Society 5.0". To meet the cybersecurity challenges stemming from this scenario, the Japanese government published the Cyber-Physical Security Framework (CPSF) Ver1.0 on April 18, 2019, which outlines security measures against new risks in Society 5.0 and propose a “Three-Layer Approach” to articulate risks and appropriate measures in the whole supply chain. The second layer is represented by the actual connection of the physical and cyberspace, namely the IoT systems themselves. In this context, the METI published in March 2020 a draft of the “ IoT Security Safety Framework ” with a guideline on how to guarantee security for IoT devices and systems . In this context, METI introduced a method for classifying IoT devices and systems based on their risk profiles. IoT devices are classified alongside two axes: (1) the degree of difficulty of recovery from the incidents; (2) perspective of economic impact from the incident. The Cybersecurity Labelling Scheme (CLS) is an instrument issued by the Cyber Security Agency of Singapore to manage the cybersecurity of consumer IoT products. The Cybersecurity Labelling Scheme is a voluntary scheme, except for Wi-Fi Routers, for which it is mandatory to meet the baseline cybersecurity requirements. The CLS covers Wi-Fi Routers and Smart Home Hubs, and it is open to all other categories of IoT devices. The labelling scheme foresees different level similar to the assurance levels in EU certification schemes. The highest level involved third-party testing. Annex 7: Comparison of the RED Delegated Regulation vs Policy option 4 (comprehensive horizontal regulation for all products with digital elements ) Horizontal cybersecurity requirements for all products with digital elements (including inter-connected radio-equipment) RED Delegated Regulation (RED DA) Scope internet-connected radio equipment and wearable radio equipment (’wireless’), including laptops, smartphones and tablets yes yes Wired-only connected products yes no Non-embedded (standalone) software yes no Non-radio components (e.g. processors) yes no Requirements & obligations Cybersecurity dimension (protection of network , ensure data protection and relevant aspects on privacy and fraud dimension yes (more specific – e.g. addressing cybersecurity risks to availability, integrity, confidentiality; vulnerability handling, transparency and information to users’ obligations, etc.; the more specific requirements would fit into the very generic cybersecurity requirements of RED D elegated Regulation ) yes (very generic) Duty of care and whole life cycle yes no Conformity assessment Conformity assessment Self-assessment , and third-party assessment for a narrow share of critical products, and potentially mandatory EU certification for highly critical products Self-assessment Table SEQ Table \* ARABIC 28 : Comparison RED Delegated Regulation vs Policy option 4 Annex 8: Extract from the preliminary findings of the Study supporting the Commission preparatory work for the Cyber Resilience Act (N° 2019-0024) A focus on software The analysis revealed that software is rarely explicitly mentioned in the legislative texts of relevant legislative acts, and even when this is the case, it might be difficult to ascertain the relative cybersecurity requirements or obligations. This is particularly true for pieces of legislation that are currently under review, such as the Machinery Directive - which makes limited references to hardware and software when talking about control systems (Essential Health and Safety Requirement 1.2) - and the GPSD - which does not currently provide enough legal certainty about the coverage of the specific features of new technology products, such as software updates or the evolving nature of new technologies. The EC aimed to update these pieces of legislation to address challenges brought by new technological developments , hence clarifying the role of software with regard to the overall product functioning and its possible impact on health and safety of consumers. To do so, the Proposal for a Regulation on Machinery Products further clarifies the definition of ‘safety component’ to include not only physical components but also non-physical components such as software performing a safety function and placed independently on the market (Article 3(3)). Furthermore, it adapts the definition of ‘machinery’, including machinery missing only the upload of a software intended for the specific application of the machinery under it and not under the definition of partly completed machinery (Article 3(1f)). However, it must be noted that pursuant to Article 2(2m) it would not apply to electrical and electronic products falling within the scope of application of Directive 2014/35/EU or Directive 2014/53/EU, such as household appliances, audio/video equipment and information technology equipment . The Proposal for a Regulation on General Product Safety (GPSR) updates the definition of ‘product’ included in Article 3(1) to ‘items that are interconnected or not to other items’ , and it expands the criteria for assessing the safety of products (Article 7h) to include the appropriate cybersecurity features necessary to protect the product against external influence. It is also worth mentioning that the GPSR will take over the role of ‘safety net’ (as the GPSD before) with regard to non-harmonised consumer products and to the harmonised consumer products for the aspects that are not covered by harmonised legislation. Software is also mentioned in the AI Act when defining AI systems (Article 3). The proposal directly links AI systems to software by clarifying that this software possesses key functional characteristics (listed in Annex I) and aims to accomplish a set of human-defined objectives. The reference to software is more explicit in other pieces of existing EU product safety legislation. This is the case for: the RED , which covers software " allowing radio equipment to be used as intended " (Article 4); the MDR , which already reflects the ongoing digitalisation process and covers software (Article 2), while addressing the cybersecurity of both hardware and software; and the Measuring Instrument Directive (MID) which mentions software within the requirements placed on the products falling under its scope and defines specific conformity assessment modules for electronic systems or systems containing software (see Annex I, II, VIII and IX). Furthermore, other pieces of EU legislation refer to software in their provisions. For instance, the Consumer Sales Directive (CSD) includes in its scope the notion of goods with digital elements, and thus applies to any digital content or digital service. Recital 14 of the CSD clarifies that digital content incorporated in or inter-connected with a product under the scope “can be any data which are produced and supplied in digital form, such as operating systems, applications and any other software ” regardless of the time of installation (before or after the sale). Software is also used to define compatibility and interoperability aspects of the goods falling under the CSD (Article 2). Another example of reference to software is the Market Surveillance Services Directive (MSD) which mandates manufacturers (Article 15) to provide, upon request of the approval authorities, information about software and algorithm which are necessary to demonstrate the conformity of a vehicle, system, component or separate technical unit. Software is also included in the notion of a product (Article 3) provided by the eIDAS regulation which defines product as “ hardware or software, or relevant components of hardware or software, which are intended to be used for the provision of trust services”. In conclusion, the new challenges brought by new technological developments prompted the EC to update some pieces of legislation, by clarifying the role of software within their provisions (e.g., MR, GPSR, AI Act) in light of their relevance for security of networks and rights of individuals in an increasingly connected environment. Software is considered by several pieces of EU legislation either as a way to define the products falling under their scope (e.g., MDR, RED, CSD, eIDAS) or to highlight certain characteristics of products which deserve particular attention from their manufacturers (e.g., MID, MSD). Approach to safety and security in the EU legislative framework on products The exploratory study concluded that the EU legislation on products focuses mainly on safety rather than security (see finding #7). This finding appears to be consistent with the intent of the EC to align the EU regulatory framework on products with the reference provisions set by Decision 768/2008/EC (part of the NLF) which placed obligations on economic operators along the supply chain (e.g., manufacturers, importers, distributors) to ensure the health and safety of consumers . However, the NLF does not contain provisions mandating economic operators to account for cybersecurity during the risk assessment and subsequent identification of NLF certification modules and self-declaration. As a result, security is accounted for only in some pieces of legislation which do not set horizontal cybersecurity requirements. Most of the pieces of legislation targeting product safety do not address the cybersecurity of products falling under their scope. For instance, the Recreational Craft and Personal Watercraft Directive (RRD) does not place any cybersecurity requirements on the products falling under the scope of the analysis nor on the main economic operators considered in Chapter II of the Directive. The essential requirements laid down in Annex I of the RRD mainly concern safety aspects such as the identification, the structure, the stability and other physical aspects of the products in scope. The Pressure Equipment Directive (PED) represents another example of a directive which covers safety without considering the security (and cybersecurity) aspect. The PED contains (Annex I) a set of general, design, manufacturing and other requirements that focus strictly on safety without safeguards aimed at addressing the cybersecurity of the measuring instruments. Over the past years, the EC has been seeking to address the new challenges on consumer safety posed by new digital technologies (e.g., software, AI, IoT) by putting forward pieces of EU product legislation which clearly addressed cybersecurity when connected to consumer safety. When looking at sector-specific regulation, it is possible to refer to two examples, namely the Measuring Instruments Directive (MID) and the MDR. Within Annex I, the MID includes essential requirements both on suitability of the equipment (ESHR 7), defining additional precautions to be used when the product is associated with a software and, on protection against corruption (ESHR 8). The requirement addresses the risk for a measuring instrument to be connected with another device and to be subject to an inadmissible influence. The MDR lays down essential requirements for medical devices that function through an electronic system or that are software themselves . These requirements mandate manufacturers to develop and build their products by applying risk management principles and by setting out requirements concerning IT security measures. It is important to point out that the MDR does not clarify which risks the regulation is seeking to address. Particularly, the MDR does not distinguish between functionality and safety risks as the poor functioning of a medical device has usually a direct (negative) effect on the health and safety of its user. It follows that the requirements set by the regulation focus on the reliable performance of the device . The most relevant requirements accounting for the cybersecurity of the products falling under the scope of the MDR are No. 14 (Construction of devices and interaction with their environment) and No. 17 (Electronic programmable systems), both included in Annex I of the regulation. Additionally, considering more horizontal pieces of legislation, the RED took another step forward in addressing cyber-related risks of inter-connected devices and wearables, with the RED Delegated Act which shall apply form 1 August 2024. In fact, the Directive foresees two requirements in Article 3(d), (e) and (f) which aim to address network protection and incorporate safeguards into products so to protect users’ privacy and personal data as well as to protect them against fraud. More recently, the GPSR proposal addresses cybersecurity risks that have an impact on the safety of consumers by mandating products to possess cybersecurity features (Article 7h) that can protect them from external influences (e.g., hacking). However, it is worth pointing out that manufacturers are mandated to consider cybersecurity risk only if Article 6(1a) on harmonised European standards and Article 6(1b) on national requirements do not apply. Furthermore, the Machinery Regulation proposal ( MR ) mandates new requirements (Annex III – 1.1.9 and 1.2.1) on the protection of machinery against corruption and unauthorised access. Particularly, while introducing the concept of security by design for machinery and control systems (i.e., those connected should be designed in such a way to minimise their exposition to hazardous situations), the requirements also stress the importance in the identification and subsequent protection of software and data that impact on the compliance of the machinery with health and safety requirements. On the other hand, when it comes to certain existing pieces of EU legislation discussion are ongoing on whether they should take into account cybersecurity aspects, such as the Toy Safety Directive (TSD). In this regard, the European Parliament expressed concerns in relation to the new risks posed by connected toys, particularly when they pose threat to child safety, security, privacy and mental health. Furthermore, while pointing out that connected toys show inadequate level of security, with no or limited measures to prevent cyber threats, the European Parliament called on the EC by updating the TSD or exploring other options to increase consumer protection such as the adoption of a horizontal piece of legislation on cybersecurity requirements for connected products and associated services . However, it is important to note that the Delegated Regulation adopted under the RED in October 2021 partially addressed the need for cybersecurity requirements on wireless toys (Article 1(2)c). In conclusion, while recognising the efforts put forward by the EC in relation to an increased cybersecurity of products marketed within the EU, security, and more specifically cybersecurity, still does not appear to be broadly embedded in the EU legislation on product safety . The requirements currently in place target specific types of products (e.g., medical devices, measuring instruments) and/or are cross-sectoral but focus only on digital devices with certain characteristics (e.g., wireless). Product life cycle approach The EU legislation on products currently relies on the concept of ‘ placing a product on the market’ . This notion appears to be challenged by new technological developments that allow products to evolve after this moment in time. For instance, software updates can change the functionalities of the product on which the software operates. Discussions on whether the NLF could be updated to incorporate the concept of a product life cycle approach are currently ongoing. However, as highlighted by an expert supporting the study, stakeholders have suggested that the focus of the NLF should remain on setting common reference provisions for placing a product on the market, with changes post-market placement being better addressed on an ad-hoc basis by individual pieces of legislation. Another possibility raised by stakeholders is to accommodate these developments by amending the suite of conformity assessment modules of the NLF, for instance by introducing a new component related to post-market placement verification. All in all, while being currently under evaluation, the NLF is not yet subject of a proposal to update and modernise it (i.e. no impact assessment is currently planned). As a notable exception to this static view of product compliance, the MDR foresees (in Annex I (3)) a specific requirement placed on manufacturers to establish, implement, document and maintain a risk management system for their products, meaning a process throughout the entire life cycle of a device, requiring regular systematic updating. Similarly, but more recently, the AI Act proposa l requires high-risk AI systems to be subject to a risk management system (Article 9). Moreover, the proposal sets requirements on record-keeping (Article 12) and accuracy, robustness and cybersecurity which shall also take into consideration the life cycle of high-risk AI systems. Furthermore, the activation of the delegated acts under the RED addresses software updates. Additionally, draft legislative proposals pertaining to the updating of EU harmonisation legislation, often take more of a product life cycle approach, reflecting the fact that change in products may occur post market placement, either due to software updates/upgrades or due to the circular economy. For instance, the GPSD is currently under revision to accommodate the ever-evolving nature of digital technologies (i.e., GPDR proposal). In fact, the Sub-group on AI, connected devices and other challenges for new technologies to the Consumer Safety Network recommended that the revision of the GPSD should clarify that products should be safe during their whole lifespan to accommodate for the new risks brought by digital technologies. Against this background, the GPSR put emphasis on the need for the product to be safe over its entire lifespan. In this regard, Article 12 (cases in which obligations of manufacturers apply to other economic operators) defines circumstances under which any economic operator that modifies “a product in such a way that conformity with the requirements of this Regulation may be affected, should be considered to be the manufacturer and should assume the obligations of the manufacturer” . The MR proposal also provides an example of how some aspects of changes (e.g., to software updates, AI and machine learning technologies) to products post-placement can already be addressed at the moment a product is placed on the market. The MR requires an upfront risk assessment as to any potential changes post-market if these risks bring a product into non-compliance with the essential requirements (Annex III -1c). Currently, there are significant challenges related to the issue of built-in obsolescence (i.e. products are designed to be replaced in a certain timeframe and will therefore no longer be supported). Within this context, there is a key question of ‘for how long (per product type) economic operators should provide security updates . Responsibilities set along the value chain Since its adoption in 2008, the NLF represented an important step forward in the strengthening of the EU Single Market. The NLF identifies the economic operators having an impact on product safety, while also defining their respective responsibilities and obligations within the value chain. Consequently, the sectoral and product-focused NLF-aligned legislation followed this framework to guarantee legal certainty to consumers and businesses operating within the Single Market. Nevertheless, new technological development and the shift toward greener and circular economy brought a broader set of economic operators to play a relevant role within the value chain. The EC is conducting an evaluation, assessing whether the NLF continues to be fit for purpose in the current economic reality and changing digital environment . The 2019 Market Surveillance Regulation (MSR) , which came into effect in 2022, introduced for most NLF-aligned laws (see Article 4(5)) the requirement for an EU-based economic operator in order to place a product on the market. One of the options is to contract an authorised representative (which was actually already defined in the NLF), while another is to use a fulfilment service provider (newly defined in the MSR). However, manufacturers/importers are not mandated to use an authorised representative or fulfilment service provider . This regulation represented a first step to address the challenges faced by market surveillance authorities when tracing non-compliant products imported into the Union and identifying the responsible entity within their jurisdiction. The MDR represents a comprehensive piece of legislation covering all economic operators in the value chain such as manufacturers (Chapter II, III and V), importers (Article 13), authorised representatives (Article 11) and distributors (Article 14). It is worth noting that manufacturers encompass also software manufacturers as long as their products have a medical purpose and thus can be classified as a medical software. While mainly targeting the manufacturers of medical devices, the MDR sets obligations on several economic operators to make sure that there are always multiple stakeholders responsible for provisions set by the regulation, particularly when products are manufactured from non-EU countries. Similarly, the RED stresses that all economic operators intervening in the supply and distribution chain should take appropriate measures to ensure that they only make available on the market radio equipment which is in conformity with the Directive and therefore it is necessary to provide for a clear and proportionate distribution of obligations (recital 27). On the other hand, responsibilities along the value chain had to be further clarified within the proposals for some pieces of legislation currently under review, as in the case of the GPSR (recital 24) and the MR (recital 25). It is interesting to note that the latter also clarifies that when a machinery is substantially modified according to the definition, the one that modifies the machinery becomes manufacturer and must comply with the relevant obligations (recital 36 and Article 15). Furthermore, as the complexity of the machinery supply chain is increasing, there is a general obligation of cooperation of third parties involved in the machinery supply chain, other than economic operators. It is also worth noting that the NIS2 proposal, while not covering any product, addresses, for the first time, cybersecurity of the digital supply chain (of special importance in the case of the IoT) (recital 43 and Article 5(2a)). Conformity Assessment Looking at the conformity assessment procedures, in general significant emphasis is put on the importance of standardisation in an effort to ensure greater conformity. In the context of this study, a comparative analysis of conformity assessment modules was done to elucidate the main approaches in view of studying the most similar and suitable modules for the planned initiative . The GPSD and GPSR proposal opt for a presumption of safety in case common standards as specified in the Directive are applied. Similarly, the MD R (Article 7) and MR proposal (Article 17) adopt a presumption of conformity of machinery when manufacturers apply harmonised standards, with self-assessment through Module A provided as default option, but not for high-risk machinery. In other cases, conformity assessment procedures as well as the involvement of third parties, greatly depends on the product classification adopted in the legislation: for instance, this is the case for the MDR (recital 60) as well as for the proposal on AI Act. Market surveillance Concerning market surveillance rules, the pieces of legislation analysed usually contain dedicated articles. However, it is worth mentioning that only some of them explicitly address certain aspects concerning post-market surveillance. This is particularly important when looking at new technologies, as these pose challenges related to the notion of placing a product on the market and the monitoring of its compliance with obligations and requirements post-market placement (i.e., life cycle approach). Products including new technologies can evolve and their safety features may change via software updates or machine learning after they have been placed on the market. For instance, AI Act proposal, sets out monitoring and reporting obligations for providers of AI systems regarding post-market monitoring and reporting, as well as the investigating of AI-related incidents and malfunctioning. Market surveillance authorities would also control the market and investigate compliance with the obligations and requirements for all high-risk AI systems already placed on the market (Article 61). It is worth mentioning that the new MSR , which amended the 2008 market surveillance provisions under Regulation (EC) 765/2008, aims at reinforcing the effectiveness of market surveillance in the EU, with an eye on addressing challenges posed by the digital age. As set out in Article 2, the Regulation applies to all products that are subject to one of the 70 EU safety instruments listed in Annex I - including the RED, the MDR, the MD and the TSD - in the absence of more specific rules on market surveillance; however, the provisions requiring an EU-based economic operator. Annex 9: Table illustrating the potential interplay between a horizontal regulatory intervention (notably policy option 4) with existing product-related legislation Legislation Potential relationship between the existing product legislation and a comprehensive horizontal regulatory intervention (policy option 4) Digital dimension Cybersecurity elements covered Possibility to opt for self-assessment when harmonised standards are applied Modules Types of products + other related remarks Examples of types of products NLF Main relevant articles Measuring Instruments - Directive 2014/32/EU No amendments necessary, intervention to complement. Essential requirements for suitability and protection against corruption yes yes (measuring instruments have embedded software) no All except A1, C1 Measuring instruments Water meters, gas meters, thermal energy meters, taximeters, automatic weighing instruments etc. yes 17, 19(2), 30 Radio equipment - Directive 2014/53/EU + Delegated Regulation RED DA to be implemented until the horizontal cybersecurity rules start applying . The upcoming legislation would then provide more specific cybersecurity requirements and it can be considered that the RED DA cybersecurity requirements would become obsolete at the time when the horizontal legislation starts applying . yes yes yes A, B+C, H All radio equipment Wi-Fi routers, AM/FM radios, TVs, mobile phones, laptops, computers, RFID devices, navigation devices, radar (all devices using wireless communication such as LTE, 5G, Bluetooth, GPS, RFID etc.) yes 3(3)(d)(e)(f) + DA (for scope and ER); 17 (conformity assessment) Medical devices - Regulation (EU) 2017/745 out right exclusion of medical devices from the scope of the horizontal regulation due to more specific requirements set out in the medical devices regulation that are at least equivalent with the cybersecurity requirements in the intervention. yes yes no H1-like, B-like, D-like, F-like Medical devices High frequency ventilators, wearable automated external defibrillators, implantable pacemaker pulse-generator, coronary stents, cardiovascular catheters including guidewires and electrodes for electrophysiological diagnosis; Devices intended to remove undesirable substances out of the body, devices intended to separate cells by physical means, long term corrective contact lenses, therapeutic devices intended to administer or exchange energy in a potentially hazardous way; Tracheostomy or tracheal tubes connected to a ventilator, short term corrective contact lenses, therapeutic devices intended to administer or exchange energy in a non-hazardous way, devices intended for recording X-Ray diagnostic images yes 52, Annexes IX - XI In vitro diagnostic medical devices - Regulation (EU) 2017/746 out right exclusion of medical devices from the scope of the horizontal regulation due to more specific requirements set out for in vitro diagnostic medical devices that are at least equivalent with the cybersecurity requirements of the intervention yes yes no B-like+D-like, H1-like In vitro diagnostic medical devices Reagent, reagent product, calibrator, control material, kit, instrument, apparatus, piece of equipment, software or system, and accessories. yes 48, Annexes IX - XI Machinery Regulation – DRAFT COM(2021) 202 Complementarity, as MR covers cybersecurity with an impact on safety. The regulatory intervention w ould complement with requirements going beyond those having an impact on safety. Specific clarifications (provisions and recitals) could be considered to spell out the interplay between the two pieces of legislation, notably on aspects relating to safety (e.g. cross-referencing to application of Annex III relevant provision - e.g. 'protection against corruption') . . yes yes yes, as a rule (not for high-risk machinery) Presumption of conformity of machinery when manufacturers apply harmonised standards; self-assessment by default option; third party assessment for high-risk machinery Machinery products: (a) machinery; (b) interchangeable equipment; (c) safety components; (d) lifting accessories; (e) chains, ropes, slings and webbing; (f) removable mechanical transmission devices; (g) partly completed machinery; Additionally, as compared to the current MD, the definition of safety component has been also clarified to include non-physical components such as software. A list of exclusions is also provided as in the current Machinery Directive, with few adjustments (some changes on vehicles to ensure nothing is left out) and further clarifications (mainly when such products are covered by other legislation, such as motor/vehicles, electrical equipment designed for use within certain voltage limits, etc.) All machinery embedding AI systems ensuring safety functions and (non-embedded) AI ensuring a safety function in machinery yes Annex III, 21, 22 Toy Safety - Directive 2009/48/EU Complementarity to RED and hence RED Delegated Regulation yes yes (very limited) yes Presumption of conformity for toys applying harmonised standards, self-assessment as default. Third-party notification when there are no standards, or not applied or published with restriction or upon choice of manufacturer Toys for Children (<14) AI-powered Toy Robots (e.g. Sphero, Cozmo, Hello Barbie) yes Annex I, 19 Machinery – Directive 2006/42/EU Directive to be replaced by Regulation (see above) yes yes (e.g. limited references to h/w and s/w in control systems) yes Presumption of conformity of machinery when manufacturers apply harmonised standards; self-assessment by default option. For high-risk machinery (listed in Annex IV) where no harmonised standards exist, (a) the EC type-examination procedure, plus the internal checks on the manufacture of machinery OR (b) the full quality assurance procedure. Note: High-risk machinery – listed in Annex I + COM empowerment for DA to update the list (if it poses a risk to human health taking into account its design and intended purpose + some criteria to establish that). Machinery products (incl. software ensuring safety functions, including AI systems) - ‘ safety component’ means a physical or digital component, including software, of machinery which serves to fulfil a safety function and which is independently placed on the market, the failure or malfunction of which endangers the safety of persons but which is not necessary in order for the machinery to function or may be substituted by normal components in order for the machinery to function. (a) machinery; (b) interchangeable equipment; (c) safety components; (d) lifting accessories; (e) chains, ropes and webbing; (f) removable mechanical transmission devices; (g) partly completed machinery; A list of exclusions is also provided a (mainly when such products are covered by other legislation, such as motor/vehicles, electrical equipment designed for use within certain voltage limits, etc.) yes 3(3), 12, 13, Annex I, Annexes VIII - X Transportable pressure equipment - Directive 2010/35/EU No amendments necessary, the regulatory intervention to complement. Essential requirements refer to requirements under ADR, RID and (Agreements on the carriage of dangerous goods by resp. road, rail or waterway), which seem to contain requirements linked to safety, and no specific cybersecurity requirements. yes no no type approval, supervision of manufacture, periodic/intermediate inspections and exceptional checks, initial inspections and tests, reassessment of conformity Transportable pressure equipment All pressure receptacles, their valves and other accessories + tanks, battery vehicles/wagons, multiple-element gas containers (MEGCs), their valves and other accessories yes 2(15), 4, 13 Motor vehicles and their trailers - Regulation (EU) 2018/858 Out right exclusion from the scope of the horizontal regulation due to more specific cybersecurity requirements where compliance with a specific UN regulation is required ( UN Regulation No 155 – Uniform provisions concerning the approval of vehicles with regards to cybersecurity and cybersecurity management system [2021/387]) yes yes no different forms of type-approval Motor vehicles and their trailers Motor vehicles, trailers, systems, components, separate technical units, parts, equipment no Recreational craft and personal watercraft - Directive 2013/53/EU No amendments necessary, intervention will complement . yes no for some A, A1, B+C, B+D, B+E, B+F, G, H, Post construction Assessment (PCA) Recreational craft, personal watercraft, propulsions engines Motorboats, sailboats, personal watercraft, propulsion engines, kill switches, steering wheels, fuel tanks, port lights yes 20, 21, 22 - this choice is not understandable. Relevant for what? Simple Pressure Vessels - Directive 2014/29/EU No amendments necessary, intervention to complement. no no no B+C-like, B+C1, B+C2 Simple Pressure Vessels yes 13 Non-automatic Weighing Instruments - Directive 2014/31/EU No amendments necessary, intervention to complement. Some of the general requirements refer to issues related to cybersecurity such as prevention of fraudulent use. yes yes no B+D, B+F, D1, F1, G Non-automatic weighing instruments yes 13 Lifts - Directive 2014/33/EU Interplay with the intervention depends on decided interplay with M achinery Directive /M achinery Regulation . Essential requirements (relating to health and safety) refer to Machinery Directive (Annex I of the MD; The essential health and safety requirements of point 1.1.2 of Annex I to Directive 2006/42/EC apply in any event.) yes yes [ to the extent of the scope of the Lifts Directive dealing with health and safety of lifts and safety components for lifts ] no B+C2, B+D, B+E, G, H, H1 Lifts, safety components for lifts Lifts intended for the transport of persons, goods and fitted with controls inside the carrier; Safety components for lifts components for lifts listed in Annex III, e.g. devices for locking landing doors, overspeed limitation devices, safety circuits containing electronic components yes 15, 16 1(3) in case of more specific Union law 6(1) as regards building interface including aspects related smart building systems if relevant 4, 5, 7, 8 Annex I: preliminary remarks 1 to 3, essential health and safety requirements 1.1 and all those related to regulating, controlling and monitoring of safety of lifts where interconnected programmable/smart functions can be used (analysis to be carried out on case-by-case) Marine Equipment - Directive 2014/90/EU No amendments necessary, intervention to complement. yes no no B+D, B+E, B+F, G Marine equipment yes 15 Cableway installations - Regulation (EU) 2016/424 No amendments necessary, intervention to complement. No specific cybersecurity requirements; essential requirement related to safety. yes no no B+D, B+F, G, H1 Subsystems of cableway installations; Safety components Drives and brakes, cable winding gear, cableway vehicles, monitor and safety devices; Components intended to be incorporated into a subsystem or cableway for the purpose of ensuring a safety function yes 18(2) Gas appliances - Regulation (EU) 2016/426 No amendments necessary, intervention to complement, depending on the interpretation of the scope of the mandatory risk assessment (see above). No specific cybersecurity requirements; general safety requirements and requirements linked to materials used, design and construction. yes not through specific requirements but products must be safe and correctly performing when normally used as regards risks due to use of gas as fuel no B+C2, B+D, B+E, B+F, G appliances burning gaseous fuels; Safety devices Gas cookers, ovens, space heaters, instantaneous and storage water heaters, camping lanterns, blow lamps, greenhouse heater, coffee machines gas fires, convector heaters, catalytic heater, air heaters, radiant heaters, boiler including district heating, boiler bodies, heat pumps, humidifiers, co-generation appliances, fuel cells, steam boiler units, refrigerators, deep freezers, air-conditioning units, washing machines, drying cabinets, tumble dryers, dish washing machines, ironing machines, appliance governors/appliance pressure regulators, multifunctional controls, burner control systems, etc. yes 14(2) Pressure equipment - Directive 2014/68/EU No amendments necessary, intervention to complement. No specific cybersecurity requirements; requirements linked to safety. yes no Only for products with limited pressure hazard (category I under PED) All except A1, C1, F1; A only for products classified under PED as category I In fact Essential Safety Requirements relate to the products, the category of the equipment determines the stringency of the conformity assessment procedure Stationary pressure equipment such as storage vessels, piping, heat exchangers, boilers, ... The applications include consumers products (fire extinguishers, pressure cookers) but the main applications are industrial process systems (chemical, pharmaceutical, power industry) yes 14 Why only Art. 14? ATEX (equipment and protective systems intended for use in potentially explosive atmospheres - Directive 2014/34/EU No amendments necessary, complementary and compatible with the horizontal initiative . ATEX Directive contains the provision of Annex II.1.5.8 on Risks arising from software. It states that: ‘In the design of software-controlled equipment, protective systems and safety devices, special account must be taken of the risks arising from faults in the programme’ . yes yes (limited only to some risks from software) for some A (only for some products), B+C1, B+D, B+E, B+F, G Equipment Group I; Equipment Group II; Protective systems, Components Equipment used in all premises where a potentially explosive atmospheres may appear, such as: coal an mining industry, petrochemical industry, agriculture, etc. yes 4, 13, Annex I - why this choice? Relevant to what? Personal protective equipment - Regulation (EU) 2016/425 No amendments necessary, intervention to complement; no cybersecurity (or even digital) element Yes, for smart garments only no for PPE category I only A (only for category I products), B+C, B+C2, B+D Equipment providing protection to the user against different types of risk: category I; category II; category III See Annex I of the PPE Regulation for PPE risk categories Category I PPE protect against low risks like superficial mechanical injury, atmospheric conditions that are not of an extreme nature, etc. Category II is all protective equipment (e.g. gloves, jackets, hats, glasses, masks, headphones) not covered under Category I or III Category III products are those who protect against at least one of the following risks: - substances and mixtures which are hazardous to health, - atmospheres with oxygen deficiency - harmful biological agent - ionizing radiation - high temperature environments (100°C) - low temperature environments (-50°C) - falling from a height; - electric shock and live working; - drowning; - cuts by hand-held chainsaws; - high-pressure jets; - bullet wounds or knife stabs; - harmful noise. yes 15(2), 19 Drones - Regulation 2018/1139, Implementing Regulation (EU) 2019/947 and Delegated Regulation (EU) 2019/945 intervention to complement or to consider Drones Regulation as lex specialis. yes yes (limited) for some A (only for some products and if harmonised standards applied), B+C, H Drones (unmanned aircraft systems) yes (Delegated Regulation ) Delegated Regulation (EU) 2019/945 – Art. 13 and Annex (parts 7, 8, 9) Restriction of Hazardous Substances in Electrical and Electronic Equipment - Directive 2011/65/EU No amendments necessary, intervention to complement; no cybersecurity (or even digital) element no N/A yes A Restriction of use of hazardous substances in electrical and electronic equipment (EEE) Lists restricted substances for EEE yes 7(b) Electromagnetic Compatibility - Directive 2014/30/EU No amendments necessary, angle; EMCD applies to all (non-radio) electrical equipment. It is more over true for computers wired connected (without Wi-Fi, bluetooth...) by for example "Ethernet cables RJ45". yes N/A yes A, B+C Any apparatus or fixed installation [radio equipment are excepted – as RED applicable] E.g. Apparatus: induction hobs, microwave ovens, washing machines, vacuum cleaners, power tools, LED lights, witching power supply, solar panels. E.g. fixed installations: TV screens and signage, wind turbines, air conditioning systems, etc. yes 14, 15(2), Annexes II, III, IV Low Voltage - Directive 2014/35/EU No amendments necessary, intervention to complement; Does not have a digital dimension. Furthermore, there is no empowerment for a delegated act to update the list of specific requirements in Annex I. yes N/A yes A Electronic and electrical equipment (non-radio) within certain voltage limits Household and similar electrical appliances, rotating electrical machines, cables, power supply units, laser equipment, circuit breakers, control gears, switchgears, capacitors, fuses, luminaires and lamps, etc. ==> not exclusively household application, several also have industrial application yes 15(2), Annex III, Annex IV Pyrotechnic Articles - Directive 2013/29/EU No amendments necessary, intervention to complement. Does not have a digital dimension. no N/A no B+C2, B+D, B+E, G, H Pyrotechnic articles Any article containing explosive substances or an explosive mixture of substances designed to produce heat, light, sound, gas or smoke or a combination of such effects through self-sustained exothermic chemical reactions; e.g. fireworks, theatrical pyrotechnic articles, ignition devices, etc yes 17, Annex I, Annex II Civil Explosives - Directive 2014/28/EU Intervention could complement. DA/IA empowerment to update list of essential or specific requirements, cyber elements could be potentially added on this legal basis for the safety angle); (Art 46, 48)-linked to safety no N/A no B+C2, B+D, B+E, B+F, G Explosives for civil uses (pyrotechnic articles covered by Directive 2013/29/EU excluded) Projectiles, grenades, smoke, certain types of fireworks, signals, etc. yes 20 Noise emission in the environment by equipment for use outdoors - Directive 2000/14/EC No amendments necessary, intervention to complement. There might be a digital dimension, but requirements under this Directive are limited only to noise emission requirements. no (some of the equipment covered could have a digital dimension, but the directive's requirements are limited to noise emission) N/A yes A-like, A2-like, G-like, H-like Equipment for use outdoors. 57 equipment categories covered. 22 subject to noise limits and different conformity assessment procedures. all machinery defined in Article 1(2) of Directive 98/37/EC of the European Parliament and of the Council of 22 June 1998 on the approximation of the laws of the Member States relating to machinery which is either self-propelled or can be moved and which, irrespective of the driving element(s), is intended to be used, according to its type, in the open air and which contributes to environmental noise exposure. E.g. tower cranes, motor hoes, hydraulic hammers, lawnmowers, piste caterpillars, etc. No 14 Fertilisers – Regulation (EU) 2019/1009 No amendments necessary, intervention to complement. no N/A for some A (only for some products - depending on composition), A1, B+C, D1 Fertilising products a substance, mixture, micro- organism or any other material, applied or intended to be applied on plants or their rhizosphere or on mushrooms or their mycosphere, or intended to constitute the rhizosphere or mycosphere, either on its own or mixed with another material, for the purpose of providing the plants or mushrooms with nutrient or improving their nutrition efficiency yes 13, 15, Annex IV, Part I Construction products - Regulation (EU) 305/2011 No amendments necessary, intervention to complement. no N/A only self-assessment Self-assessment as a rule (DoP). Production control and product testing; however, no correspondence with modules Construction products Any product or kit which is produced and placed on the market for incorporation in a permanent manner in construction works or parts thereof and the performance of which has an effect on the performance of the construction works with respect to the basic requirements for construction works yes 4, 6, 28(2), 60, Annex V Table SEQ Table \* ARABIC 29 : Table illustrating the potential interplay between a horizontal regulatory intervention with existing product-related legislation Annex 10: EU Funding programmes The table below provides a list of relevant headings in EU funding programmes. These headings show how EU funding programmes will support SMEs and public authorities in implementing the measures to be taken under a possible horizontal regulatory initiative. Digital Europe WP 2021-2022 Source: https://ec.europa.eu/newsroom/repository/document/2021-45/C_2021_7913_1_EN_annexe_acte_autonome_cp_part1_v3_zCcOBWbBRKve4LP5Q1N6CHOVU_80908.pdf Topic Indicative Budget in m EUR European Cyber Shield EU Cybersecurity Resilience, Coordination and Cybersecurity Ranges 15 Uptake of innovative cybersecurity solutions in SMEs 32 Support to the health sector cybersecurity 10 Support to Implementation of relevant EU Legislation Deploying The Network Of National Coordination Centres With Member States ( Support through the Network of National Coordination Centres ) 27 Supporting the NIS Directive implementation and national cybersecurity strategies 20 Testing and certification capabilities 5 Total 109 Horizon Europe WP 2021-2022 Source: https://ec.europa.eu/info/funding-tenders/opportunities/docs/2021-2027/horizon/wp-call/2021-2022/wp-6-civil-security-for-society_horizon-2021-2022_en.pdf Topic Indicative Budget in m EUR Dynamic business continuity and recovery methodologies based on models and prediction for multi-level Cybersecurity 21.5 Improved security in open-source and open-specification hardware for connected devices 18 AI for cybersecurity reinforcement 11 Scalable privacy-preserving technologies for cross-border federated computation in Europe involving personal data 17 Secure and resilient digital infrastructures and interconnected systems 21.5 Hardware, software and supply chain security 18 Cybersecurity and disruptive technologies 11 Smart and quantifiable security assurance and certification shared across Europe 18 Total 136 Table 30 : Relevant headings in EU funding programmes Annex 11: The New Legislative Framework (NLF) Many products placed on the EU market have CE marking ( ) affixed to them. This marking is the visible symbol showing that the manufacturer has taken all necessary measures to ensure that the product complies with the applicable safety legislation. It plays a crucial part in the New Legislative Framework for the EU internal market for goods, which entered into force at the beginning of 2010. The New Legislative Framework is a blueprint for designing product regulation at EU level. It provides for the appropriate control of testing laboratories and certification bodies, and more importantly sets out a Union policy on surveillance of products on the market and of effective controls of products from third countries. European product legislation was revolutionised by the “New Approach” introduced in 1985. The ‘o ld a pproach ’ reflected the traditional manner in which national authorities drew up technical legislation, going into great detail – usually motivated by a lack of confidence in the rigour of economic operators on issues of public health and safety. This New Approach departs from this traditional approach and has become a role model for Better Regulation. So-called New Approach legislation sets out the levels of protection that must be achieved and does not pre-judge the choice of technical solutions to achieve the levels. Today, the New Approach directives cover a large proportion of products marketed in the EU in more than 20 industrial sectors, including electro-technical products, machinery, radio/telecoms equipment, toys, medical devices, construction products and high-speed rail systems. Most products covered by this legislation have CE marking affixed to them, which is the visible symbol that indicates that a product complies with all the applicable safety legislation. A detailed description of the New Legislative Framework can be found in the Commission’s ‘Blue Guide’ on the implementation of EU products rules. About the CE marking The CE marking is required for the placing of the market of products falling under specific product categories and indicates that such products meet EU safety, health or environmental requirements. It guarantees the free movement of safe products within the European market and is a key indicator of a product's compliance with EU legislation. The CE marking is affixed by the manufacturer to its products. By placing CE marking on a product, the manufacturer declares the product's conformity with the applicable legal requirements valid in Europe. It is the sole responsibility of manufacturers to verify that the goods they are selling comply with all relevant legislations or – if necessary – have to have it examined by a notified conformity assessment body for that purpose. Not all products sold in the EU need to bear CE marking. CE marking applies to more than 20 different product categories, ranging from electrical equipment to toys and from explosives to medical devices. Each product falls under one or more Directives, which determine the specific requirements that the product must meet in order to be CE-marked. Only the product categories subject to specific directives are required to be CE marked. Wholesalers and retailers also bear some responsibility: they must verify that all the goods they distribute which require a CE marking are actually carrying one and that the necessary controls have been carried out. In order to avoid non-conformity abuses, legal measures and economic sanctions have been established to deter the vast majority from doing so. Six steps to obtain the CE marking To comply with legal requirements, manufacturers have to follow six necessary steps in order to make their products ready for the market: Identify the directive(s) and harmonised standards applicable to the product: The essential requirements products have to fulfil (e.g. safety) are harmonised at EU level and are set out in general terms in the Directives. Harmonised European standards are issued with reference to the applied directives and express in detailed technical terms the essential requirements. Verify the product-specific requirements: It is up the manufacturers to ensure that their products comply with the essential requirements of the relevant EU legislation. Full compliance of a product to the harmonised standards gives to the product the “presumption of conformity” with the relevant essential requirements. The use of harmonised standards remains voluntary as manufacturers may decide to choose other ways to fulfil the essential requirements. Identify whether an independent conformity assessment is required from a notified body: Each directive covering a particular product specifies whether an authorised third party (notified Body) must be involved in the conformity assessment procedure necessary for CE marking. Test the product and check its conformity to the EU legislation: One part of the procedure is a risk assessment. By applying the relevant harmonised European standards, the manufacturer will be able to fulfil the essential legislative requirements of the directives. Draw up and keep available the required technical documentation: The manufacturer has to establish the technical documentation required by the Directive(s) for the assessment of the product's conformity to the relevant requirements and a risk assessment. Together with the declaration of conformity, the technical documentation must be presented on request to the competent national authorities. Affixing the CE mark to your product and Declaration of Conformity: The CE marking must be affixed by the manufacturer, according to its legal format visibly, legibly and indelibly to the product or its data plate. If a Notified Body was involved in the production control phase, its identification number must also be displayed. C onformity assessment Conformity assessment is the process carried out by the manufacturer of demonstrating whether specified requirements relating to a product have been fulfilled. The legislator selects from the menu of conformity assessment procedures (laid down under Decision No 768/2008/EC) the most appropriate one(s) in order to address the specific needs of the concerned sector. The following procedures are considered for policy options 3 and 4: Internal production control (“self-assessment”): The manufacturer himself ensures the conformity of the products to the legislative requirements . Conformity assessment by a third party: These third parties are laboratories, inspection and certification bodies which are known generally as conformity assessment bodies, or more formally as “Notified Bodies”. Member States have the responsibility to decide which of their conformity assessment bodies fulfil the necessary criteria to become notified since not all do. Accreditation is a formal system which provides an independent attestation of the competence, impartiality and integrity of conformity assessment bodies. The minimum criteria include competence, impartiality, integrity, etc. Notified bodies are private companies and operate in a competitive market. Market surveillance The enforcement of product safety legislation is an important task; not only to protect consumers and other users from unsafe products but also to ensure a level playing field for reputable businesses. In the EU market surveillance is the responsibility of the Member States, which establish market surveillance authorities for the different products covered by the ‘New Legislative Framework. With the RAPEX system (see IP and Memo 10/130 on the 2009 Annual RAPEX Report) the European Union has an effective and efficient system in place to share information about dangerous products found on the European market. Policy options 3 and 4 and the New Legislative Framework Under policy options 3 and 4, the Commission would propose a regulation laying down cybersecurity requirements for products with digital elements . The intervention would be based on the New Legislative Framework’s (NLF) blueprint for product regulation. In line with the NLF, it would lay down objective oriented cybersecurity requirements, leaving the technical details to European harmonised standards. It would also require manufacturers to carry out a conformity assessment, with self-assessment for the vast majority of products and third-party assessment by notified bodies for a small number of critical products. Member States would be required to designate notified bodies to carry out the procedures for conformity when a third party is required. They would also need to establish market surveillance authorities to prevent the making available on the market and use of non-compliant products. Due to the nature of products with digital elements , policy options 3 and 4 will slightly adjust the “traditional” NLF approach in a number of ways : In the past, NLF legislation would lay down safety, health or environmental requirements. Policy options 3 and 4 will introduce cybersecurity requirements , which have so far not played any major role in NLF legislation (with the exception of the Radio Equipment Directive together with a recently adopted delegated regulation and a few safety-focused product regulation that partially take cybersecurity into account, such as the Toy Safety Directive). Most NLF legislation lays down requirements for tangible goods (such as toys or machinery). Policy options 3 and 4 would introduce requirements for software as a non-tangible good . While policy option 3 would only cover software embedded in hardware devices, policy option 4 would cover all software. The Radio Equipment Directive together with a recently adopted D elegated R egulation are also covering embedded software. In addition, the Medical Devices Regulation also covers software products. Unlike traditional NLF legislation, policy options 3 and 4 would not only lay down requirements for the placing on the market of products with digital elements but cover the entire life cycle of such products . Manufacturers will therefore be required to ensure that products are kept secure by issuing security updates for vulnerabilities discovered in their products. The whole life cycle approach is necessary, as it is nearly impossible to develop products with digital elements that do not have any vulnerabilities at all. Annex 12: Illustration of two-level risk approach to conformity assessment in policy option 4 Level of risk category Criteria of determining the risk level of the product T ype of product Conformity assessment European certification scheme on the basis of the Cybersecurity Act By default (for the vast majority of the products in the scope) By default All products with digital elements but those qualified as critical Self-assessment (flexible approach – businesses can still choose third party ) Presumption of compliance with the horizontal requirements for the relevant category of products * Mandatory certification based on an available EU cybersecurity certification scheme for products could be considered , based on an empowerment for delegated act . The EU certification scheme would follow the relevant procedures of the Cybersecurity Act. Critical (narrow market share ) Functionality / security-critical functions Critical software, e.g. o perating systems or firewalls Third-party assessment Intended or reasonably foreseeable use I ndustrial control and automation systems used by entities Table 31 : Illustration of a risk approach to conformity assessment in policy option 4 Annex 1 3 : Regulatory gap analysis Currently there are no specific cybersecurity requirements comprehensively and systematically applicable to all products with digital elements , hardware or software, accessing the internal market. Cybersecurity of software (embedded in hardware and upload-able or of generic use, i.e. standalone ) in particular, of key importance for cybersecurity policies, is the least regulated even at the level of sector- or product-specific legislation with limited scope. In order to effectively ensure the security of products as per the problems identified, comprehensive and systematic cybersecurity requirements applicable to all products with digital elements , should entail as key minimum elements, (see section 5.2 ) that: (i) cybersecurity is factored in the design and development of the products with digital elements and that due diligence is exercised by manufacturers on security aspects when designing and developing their products, (ii) transparency is ensured on cybersecurity aspects that need to be made known to customers and (iii) security support (updates and handling of vulnerabilities) are provided after the placement on the market . More specifically , such security requirements would include: aspects relating to the properties of the products such as: security by default; p rotection from unauthorised access; confidentiality and integrity of data , commands and programs; capability to perform or support integrity checks; availability of components against degradation and distributed denial of service attacks; p rotection of the exposed attack surfaces; enable adequate security updates . security support (i.e. vulnerability handling, security updates, patching ) for the whole life cycle (i.e. after the placement on the market) , such as requirements to: i dentify dependencies and vulnerabilities, including composition of software used and supply chain-related information; have no known-v ulnerabilities and address vulnerabilities without delay; t est the security of the product with digital elements ; have in place a process to quickly become aware of newly emerging vulnerabilities; ensure mechanisms allowing the secure updating; ensure that p atches are delivered with advisory messages; have coordinated vulnerability disclosure policies. provision of information and instructions such as those concerning: c ontact information for reporting vulnerabilities; i ntended use , including the security environment foreseen; end of life of the product; security properties of the product; type of support offered and for how long; instructions on secure use and secure removal of data. The following legislative gaps can be highlighted in both (A) general cybersecurity-related legislation and (B) product-related legislation: General cybersecurity-related legislation , (including product-related) which is applicable across-sectors and/or across-products The “NIS Directive” or Directive concerning measures for a high common level of security of network and information systems across the Union (‘) , recently reviewed through the NIS2 Directive imposes on entities operating in key sectors obligations of organisational and risk management nature, including due diligence supply chain security obligations . Limitations : These obligations do not entail requirements for the design or development or security support of products and can only have indirect effects in that regard. General Data Protection Regulation (GDPR) la ys down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data. Limitations: It does not regulate the cybersecurity of products . The Cybersecurity Act sets a framework for the development, at EU level, of voluntary certification schemes for specific ICT products, services and processes. Limitations: While covering a similarly broad scope when it comes to products with digital elements as policy option 4, the Cybersecurity Act does not establish any mandatory cybersecurity requirements or legal obligations for placing products with digital elements on the market. Even if an EU certification scheme exists (currently 3 schemes are being developed)-, manufacturers do not have a legal obligation to seek certification for those products. A separate appropriate legislative framework would be required for such an end. Product legislation General product legislation General Product Safety framework , i.e. the General Product Safety Directive (GPSD) , undergoing review through a General Product Safety Regulation (GPSR) currently in the co-decision process . It establishes requirements to ensure the safety of consumer products (both covered and not by harmonised legislation) . The GPSR proposal states that cybersecurity risks that have an impact on the safety of consumers are covered by the concept of safety. The GSPR proposal clarifies also that specific cybersecurity risks affecting the safety of consumers can be dealt with by sectorial [i.e. specific] legislation, GSPR acting as a safety net in case of gaps of such legislation. Limitations: The generic requirement to factor in cybersecurity risks from the safety angle does not ensure de jure or de facto cybersecurity by design and by default of all these products throughout the lifecycle or any security support . Even if some cybersecurity attacks could present a safety risk, this is far from comprehensive in terms of possible cybersecurity risks. Product Liability framework , i.e. the Product Liability Directive currently under review, with a proposal due in autumn 2022. The product liability framework intervenes ex post by setting out liability rules for defective products so that consumers can claim compensation when a damage has been caused by defective products. More specifically, it establishes the right of injured persons to be compensated for damages caused by the defectiveness of a product. It establishes the principle that the manufacturer of a product is liable for damages caused by a defect in their product irrespective of fault (‘strict liability’). The planned review of the product liability framework aims to update the definition of products, to also include software and to introduce, among others, liability for situations when damages are triggered by vulnerabilities after the placement of the product on the market , having regard to all circumstances . Limitations : It does not set product requirements , let alone cybersecurity requirements for products. If a defective product with digital elements was not compliant with established cybersecurity requirements, this would be relevant in the damages case and trigger the liability of the manufacturer in question. Manufacturers cannot be held liable for how the product will be used, but they would have to comply with requirements that ensure security of the product regarding its design and development, make available information to the users on security features and functions and make available security support and relevant information in relation to that. T he liability of an economic operator may be reduced or disallowed when, having regard to all the circumstances, the damage is caused both by a defect in the product and by the fault of the injured person [including, for example, rejecting a software security update] or any person for whom the injured person is responsible . The product liability legislation is therefore complementary and not substitutable to a legislation establishing product requirements . Sector or product-specific - New Legislative Framework (NLF) legislation and remaining ‘old approach’ legislation The NL F framework typically sets essential requirements as a condition for the placement of certain products on the internal market. These requirements are objective-oriented, followed at a later stage by harmonised standards . It also typically provides for conformity assessment , which is the process conducted by the manufacturer to demonstrate whether specified requirements relating to a product have been fulfilled and provides for EU market surveillance under the responsibility of the Member States. In the context of EU sector-specific safety legislation, so-called old and new approaches are traditionally distinguished. The ‘Old Approach’ refers to the very initial phase of EU regulation on products, whose main feature was the inclusion of detailed technical requirements in the body of the legislation. Certain sectors such as transport are still being regulated this way. Many of these sectors cover products that are not connected , and for which the cybersecurity angle is not applicable. For those products which are digital, the current product-related legislation covers only certain aspects linked to the cybersecurity, if any, and, where applicable, only embedded software . Duty of care for whole lifecycle after the placement on the market, a key aspect for cybersecurity of products, is typically not covered by this type of legislation. A regulation of security of all software, including non-embedded , is a crucial missing aspect of the existing product legislation. Vulnerabilities in software are omnipresent and have cascading effects cross-sectors and borders. The examples of cyberattacks affecting software and the whole supply chain are abundant. E xamples include the Pegasus spyware, which exploits vulnerabilities in mobile phones and has been used by governments to spy on critics and opponents, as well as against prominent political leaders in Europe; the Kaseya VSA supply chain attack , which used Kaseya’s network administration software to attack over 1 000 companies, forcing a supermarket chain to close all its 500 shops across Sweden. As regards the overall interplay between NLF and ‘old approach’ legislation and any envisaged horizontal legislation establishing cybersecurity requirements for all products with digital elements , mention should be made that these would be complementary . The only potential outright exclusions (or lex specialis derogations) from the scope of a cybersecurity horizontal regulation would concern products (medical devices, cars) for which cybersecurity is regulated comprehensively in specific legislation on all key aspects (i.e. security in the design and properties of the product, whole life cycle, transparency and information). Even for those, cybersecurity requirements established by the horizontal regulation for standalone software, also upload-able on such products, would be complementary. A horizontal cybersecurity regulation on products with digital elements would not change the way products are placed on the internal market as per settled NLF , nor would it change the overall NLF governance setting (e.g. aspects such as market surveillance governance). T he following product-specific pieces of legislation need particular attention because they are the only ones that cover cybersecurity aspects in a more detailed way : Radio Equipment Directive (RED) and notably its Delegated Regulation establishes three essential security-related requirements for inter-connected radio equipment (i.e. wireless products) : (i) ensure network protection; (ii) ensure safeguards for the protection of personal data and privacy, (iii) ensure protection from fraud. Limitations : cover only wireless products (hardware and their embedded software). It does not cover wired-only connect products, nor non-radio components (e.g. processors). It does not cover standalone (non-embedded) software . Furthermore, the requirements are very generic, not providing key specific cybersecurity requirements that would guarantee security by design and default (e.g. no requirements are provided addressing cybersecurity risks to availability, integrity, confidentiality; vulnerability handling; transparency and recording of composition of products an supply chain, obligations for specific security-related information to users, etc.) or obligations regarding security support for whole life cycle, i.e. after the placement on the market . See also Annex 7 for a detailed comparison between the RED delegated act scope and requirements and those envisaged for a comprehensive horizontal cybersecurity regulation. Machinery Directive and proposal for a Machinery Regulation proposed Regulation looks covers requirements and risks relating to and impacts on safety . It covers a certain category risks related to new digital technologies provoked by malicious third parties that have an impact on the safety of machinery products. It does not preclude the application to machinery products of other Union legislation specifically addressing cybersecurity aspects. Limitations: cybersecurity is only covered from a narrower angle, safety-related for a very specific category of machinery products/components . It does not cover non-embedded software in its scope, nor requirements of duty of care for whole life cycle . Medical Devices Regulation (MDR) as well as the In Vitro Diagnostic Medical Devices Regulation contain requirements regarding devices, including on software and general obligations on manufacturers, covering the whole life cycle of products, as well as conformity assessment procedures. Limitations: t he scope is very narrow limited to specific medical devices . In relation to such specific legislation and in particular the specificity of cybersecurity requirements that cover key aspects, a potential comprehensive horizontal regulation setting out cybersecurity requirements could consider out rightly excluding such category of products from application . Regulation on motor vehicles and Delegated Regulation requires vehicles to be protected against cyber-attacks. The Regulation empowers the Commission to develop detailed implementing rules. The Delegated Regulation introduces certain cybersecurity requirements, including on software updates and whole life cycle aspects, requiring compliance with specific UN regulations on technical specifications and cybersecurity and providing for specific conformity assessment procedures. Limitations: the scope is limited to vehicles . In relation to such specific legislation, given the specificity of cybersecurity requirements that cover key aspects, a potential comprehensive horizontal regulation setting out cybersecurity requirements could consider out rightly excluding such category of products from application. Artificial Intelligence (AI) Act proposal establishes, among others, requirements for high-risk AI systems . More specifically, the proposal requires high-risk AI systems to be designed and developed in such a way that they achieve, in the light of their intended purpose, an appropriate level of accuracy, robustness and cybersecurity , and perform consistently in those respects throughout their lifecycle. A risk management system is also required throughout their entire lifecycle , as well as regular systematic updating. Limitations: the scope is very limited , i.e. high-risk AI systems explicitly listed in the Act. The cybersecurity-related requirements are generic . Such legislation could be complementary to a comprehensive horizontal regulation introducing more specific cybersecurity requirements . C ompliance with the latter could imply compliance with the high-level cybersecurity requirements of the former. A specific legal act is currently in preparation at Commission level aiming to harmonise certain national non-contractual civil liability rules, so as to ensure that injured persons claiming compensation for harm caused by AI system enjoy the same level of protection as injured persons claiming compensation for harm caused without the involvement of an AI system. These would therefore strengthen the leverage of the AI Act requirements, and potentially also of any more specific horizontal cybersecurity requirements. EU legislation (in force, in adoption process or in preparation) How are cybersecurity-relevant aspects covered What is missing? Horizontal/general EU legislation not product-relevant NIS Directive (and upcoming NIS2) Covers measures for a high common cybersecurity level across the Union to increase the level of resilience of entities in a number of sectors or providing certain services considered key (‘critical’ aka ‘essential’ and/or ‘important’) across the Union. The NIS Directive does not impose cybersecurity requirements on products.. General Data Protection Regulation (GDPR) Its scope is limited to the general protection of personal data. It does not regulate cybersecurity of products and does not provide an adequate legal basis for this. Horizontal regulatory framework on products Cybersecurity Act Introduces a framework to set certification mechanism for specific ICT products, services and processes. There are currently not yet any EU cybersecurity certification scheme having been developed under the Cyber security Act (3 currently under development). Once in place, manufacturers will not have a legal obligation to seek certification for their products. This framework, while it establishes cybersecurity objectives that can be (and in fact are to be) integrated in horizontal cybersecurity requirements for products with digital elements , does not establish any cybersecurity requirements or legal obligations for placing products with digital elements on the market. A separate appropriate legislative framework would be required for such an end. General Products Safety Directive ( GPSD ) undergoing review through a General Product Safety Regulation (GPSR) currently in the co-decision process Its main purpose is to address product safety. In the GPSR proposal, cybersecurity risks that have an impact on the safety of consumers are covered by the concept of safety (i.e. appropriate cybersecurity features necessary to protect the product against external influences, including malicious third parties, when such an influence might have an impact on the safety of the product). GPSR does not establish specific cybersecurity requirements for products. Even if cybersecurity attacks could present a safety risk, the focus of the GPSR would remain the safety in a more narrow sense. Compliance with specific horizontal cybersecurity requirements would entail compliance with the cybersecurity risk angle required for safety under GSPR, but not vice-versa. GSPR requirements are far insufficient to ensure security by design and by default of products. Directive on liability for defective products (the Product Liability Directive) and upcoming review It governs the liability of the manufacturers for damage caused by the defectiveness of the product. The planned review of the product liability framework aims to update the definition of products in line with other general product legislation, such as the product safety framework, to also include software and to introduce, among others, liability for situations when damages are triggered by lack of security updates which occurs after the placement of the product on the market, derogating from the general rule on product liability that considers only defectiveness present at the time when the product was placed on the market. With the planned review, vulnerabilities in a product could be classified as a defect for which the manufacturer would have the obligation to take appropriate cybersecurity measures during the design, production. It does not set product requirements, let alone cybersecurity requirements for products. Instead, it sets out liability rules for defective products so that consumers can claim compensation for damage caused by defective products. These can indeed have effects on the manufacturers’ designing and development of products. Such a legislation is complementary and not substitutable to a legislation establishing product requirements. Union harmonisation legislation based on the New Legislative Framework (NLF) Radio Equipment Directive (RED) and relevant Delegated Regulation RED governs the safety aspects of wireless connected products, entails the possibility for the Commission to impose security requirements on the manufacturer linked to the protection of personal data and privacy by means of delegated acts . The relevant delegated act establishes the following three essential security-related requirements for inter-connected radio equipment (i.e. wireless products): (i) ensure network protection; (ii) ensure safeguards for the protection of personal data and privacy, (iii) ensure protection from fraud. The security requirements cover only wireless products (hardware and their embedded software). They do not cover standalone (non-embedded) software. Furthermore, they are very generic, not providing key specific cybersecurity requirements that would guarantee security by design and default (e.g. no requirements are provided addressing cybersecurity risks to availability, integrity, confidentiality; vulnerability handling; transparency and recording of composition of products an supply chain, obligations for specific security-related information to users, etc) or obligations regarding security support for whole life cycle, i.e. after the placement on the market. Machinery Directive and proposal for a Machinery Regulation The proposed Regulation provides that manufacturers shall be required to adopt proportionate measures which are limited to the protection of the safety of the machinery product. This does not preclude the application to machinery products of other Union legislation specifically addressing cybersecurity aspects. The proposed Regulation makes the link with the future cybersecurity schemes pursuant to the Cybersecurity Act for the purpose of demonstrating compliance with the future regulation on machinery products. In particular, in view of addressing the risks stemming from malicious third party actions that have an impact on the safety of machinery products, the proposed Regulation includes essential health and safety requirements for which a presumption of conformity may be given to the appropriate extent by a certificate or statement of conformity issued under a relevant cybersecurity scheme adopted pursuant to the Cybersecurity Act. The proposed Regulation only covers a certain category of risks related to new digital technologies provoked by malicious third parties that have an impact on the safety of machinery products. It does not cover duty of care for whole lifecycle, nor standalone software Medical Devices Regulation (MDR) and the In Vitro Diagnostic Medical Devices Regulation It provides that for devices that incorporate software or for software that are devices in themselves, the software shall be developed and manufactured in accordance with the state of the art taking into account the principles of development life cycle, risk management, including information security, verification and validation. Detailed guidelines on cybersecurity measures are in place, covering specific cybersecurity requirements, including duty of care throughout whole life cycle. The scope is limited to specific medical devices . It covers, supported by detailed guidelines, comprehensive cybersecurity requirements, including software (as well as some types of non-embedded software) and duty of care for whole life cycle. A potential horizontal regulation could consider exempting such category of products from application (similar to a lex specialis principle). Other product-specific NLF legislation (see also Annex 9 of the draft IA report) General safety-related requirements. Only certain generic safety requirements are applicable; no specific cybersecurity requirements. No provisions on duty of care for whole life cycle. Standalone software not covered. Other product-specific legislation or legislative initiatives Regulation on motor vehicles and Delegated Regulation supplementing Regulation 2019/2144 Cybersecurity is a precondition for consumer trust in automated/connected vehicles . Regulation (EU) 2144/2019 requires notably vehicles to be protected against cyber-attacks. The Regulation empowers the Commission to develop detailed implementing rules. The Delegated Regulation introduces certain cybersecurity requirements, including on software updates, requiring compliance with specific UN regulations on technical specifications and cybersecurity and providing for specific conformity assessment procedures. The car manufacturers are required to carry out a cybersecurity risk analysis and to put in place robust car design measures to avoid or to mitigate these risks. The Approval authority will verify the compliance of the vehicle by means of document checks and testing. Furthermore, in order to obtain a type approval, manufacturers will have to put in place a Cybersecurity Security Management System which will be certified by the vehicle approval authority. The Cybersecurity Security Management System is to ensure that the manufacturer has the effective internal processes in place to avoid cyberattacks during the whole lifetime of the vehicle (from the design to the end of life of a vehicle) to ensure monitoring of vulnerabilities of and cyber-attacks against its vehicles and to keep its risk assessment up to date. The scope is limited to a category of products (connected vehicles), but the cybersecurity requirements are comprehensive. It does not cover cybersecurity requirements for standalone (non-embedded) software. A potential horizontal regulation could consider exempting vehicles as regulated by this framework from application (similar to a lex specialis principle). Proposal for an Artificial Intelligence (AI) Act and upcoming AI liability rules High-risk AI systems are required to be designed and developed in such a way that they achieve, in the light of their intended purpose, an appropriate level of accuracy, robustness and cybersecurity, and perform consistently in those respects throughout their lifecycle. They are also required to establish, implement, document and maintain a risk management system throughout the entire lifecycle of a high-risk AI system, requiring regular systematic updating A risk-based approach is ensured in this regard (i.e. technical solutions aimed at ensuring cybersecurity must be appropriate to the relevant circumstances and the risks). A specific piece of legislation is currently in preparation regarding specific liability aspects for AI systems. In particular, it aims to lay down rules on the burden of proof in the case of non-contractual fault-based civil law claims brought before national courts for damages caused by the output of an AI system or the failure of such a system to produce an output and on the disclosure of information to be documented or logged pursuant to [the AI Act], to enable a claimant to substantiate a claim for damages. This would concern all relevant provisions of the AI Act, including the cybersecurity obligations. The scope is limited only to a certain type of products (high risk AI system). The cybersecurity requirements for the high-risk AI systems are generic and not comprehensive. Table 32 : Overview of EU legislation relevant for cybersecurity Annex 1 4 : Standards related to products with digital elements Standards are technical means or specifications that are adopted by a recognised standardisation body. The key benefit of a standard is to build a common language and hence to ensure interoperability of products and services. In the EU, s tandards are voluntary and are developed by the industry and/or experts in the relevant field, either at their own initiative or at the request of a legislator. In the case of European standardisation (EU Regulation 1025/2012) , a harmonised European standard is a European standard developed at the request of the Commission by one of the European standardisation organisations (ESOs), in view of applying Union harmonisation legislation. Harmonised standards can be specific on how to implement the legislation, unlike essential requirements included in Union harmonisation legislation that are objective-oriented and technology-neutral. While there is a variety of international standards concerning several aspects of product cybersecurity (consumer IoT, assurance of security throughout lifecycle or vulnerability handling, access control, etc.), no piece of EU legislation requires currently comprehensive cybersecurity requirements for all products with digital elements , and hence no harmonised European standards for products with digital elements across sectors. As in all product-specific legislation of the NLF type, a horizontal regulation setting out cybersecurity requirements for products with digital elements marketed in the Union would also be followed by a standardisation request. The Commission typically sends a request to European standardisation bodies to set out harmonised standards laying down the technical means through which the requirements set may be met. Typically the standards start being developed in the transition period provided for by the regulation in question, which could be 2 years for application to start after the entry into force. This ensures that by the time of the application of the new rules, harmonised European standards are already in place (see also section 5.2 . and notably the presentation of options 3 an d 4 ). The harmonised standards can be developed taking account and building on existing European and international standards. The adoption of harmonised European standards provides a key incentive for manufacturers to follow these standards and provides legal certainty to manufacturers, especially for SMEs. Even if European and international standards exist, it can be costly for businesses to identify relevant standards to meet adequate security requirements. Contractual or public procurement obligations or indirect effects stemming from supply chain security obligations can provide certain incentives for compliance with existing standards. However, without a common European understanding on which standards meet adequate security requirements, there is a risk of market fragmentation. A common understanding on standards can be defined through voluntary measures, such as public procurement guidelines or European certification. However, such voluntary measures would not provide sufficent leverage to systematically integrate security in all products with digital elements . Considering the level of connectivity and inter-dependence of products with digital elements , a scattered approach relying on voluntary application of standards and indirect effects of other obligations or self-regulation would not effectively address the identified problems of low level of cybersecurity of products with digital elements in the internal market, nor the insufficient understanding among users of the security of products. The table below presents an overview of existing standards and guidelines that touch upon cybersecurity of products with digital elements. Standard Scope BSA Framework for Secure Software ETSI EN 303 645 Cyber Security for Consumer IoT: Baseline Requirements ETSI TR 103 621 Guide to Cyber Security for Consumer Internet of Things ETSI TS 103 701 Technical specification: Cyber Security Assessment for Consumer IoT GSMA GSMA IoT Security Guidelines GSMA IoT Security Guidelines for Endpoint Systems ISA/IEC 62443 series Series of standards for I ndustrial A utomation and C ontrol S ystem (IACS) IEC 62443 4-1 Secure Product Development Lifecycle Requirements IEC 62443 4-2 Technical security requirements for IACS components Common Criteria ISO /IEC 5055 Automated Source Code Quality Measures ISO/IEC 27400:2022 Cybersecurity - IoT Security and Privacy Guidelines ISO/IEC 27034 series Information technology – Security techniques – Application Security ISO/IEC 29147 Information technology – Security techniques – Vulnerability disclosure ISO/IEC 30111 Information technology – Security techniques – Vulnerability handling processes NIST Recommended Criteria for Cybersecurity Labelling for Consumer Internet of Things (IoT) Products NIST SP 800-213 IoT Device Cybersecurity Guidance for the Federal Government: Establishing IoT Device Cybersecurity Requirements NIST SP 800-218 Secure Software Development Framework (SSDF) NISTIR 8259 Foundational Cybersecurity Activities for IoT Device Manufacturers NISTIR 8259A IoT Device Cybersecurity Capability Core Baseline OWASP ISVS IoT Security Verification Standard OWASP ASVS Application Security Verification Standard OWASP SCVS Software Component Verification Standard SAFECode Fundamental Practices for Secure Software Development Table 33 : Notable examples of relevant international standards, widely used industry best practices and guidelines Subsidiarity Grid Proposal for a Regulation of the European Parliament and of the Council on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act) and amending Regulation (EU) 2019/1020 Can the Union act? What is the legal basis and competence of the Unions’ intended action? 1.1 Which article(s) of the Treaty are used to support the legislative proposal or policy initiative? The legal basis for this proposal is Article 114 of the Treaty of the Functioning of the European Union, which provides for the adoption of measures to ensure the establishing and functioning of the internal market. The purpose of the proposal is to harmonise cybersecurity requirements for products with digital elements in all Member States and to remove obstacles to the free movement of goods. Article 114 TFEU may be used as a legal basis to prevent the occurrence of these obstacles resulting from diverging national laws and approaches on how to address the legal uncertainties and gaps in the existing legal frameworks. Furthermore, the Court of Justice has recognised that applying heterogeneous technical requirements could be valid grounds to trigger Article 114 TFEU. The current EU legislative framework applicable to digital products is based on Article 114, and comprises several pieces of legislation, including on specific products and safety-related aspects or general legislation on product liability. However, it covers only certain aspects linked to the cybersecurity of tangible digital products and, as applicable, software embedded in these products. At national level, Member States are starting to take national measures requiring vendors of digital products to enhance their cybersecurity. At the same time, the cybersecurity of digital products has a particularly strong cross-border dimension, as products manufactured in one country are often used by organisations and consumers across the entire internal market. Incidents that initially concern a single entity or Member State often spread within minutes across organisations, sectors and several Member States. The various acts and initiatives taken so far at EU and national levels only partially address the problems identified and risk creating a legislative patchwork within the internal market, increasing legal uncertainty for both vendors and users of these products and adding unnecessary burden on companies to comply with a number of requirements for similar types of products. The proposed Regulation would harmonise and streamline the EU regulatory landscape by introducing cybersecurity requirements for products with digital elements and avoid overlapping requirements stemming from different pieces of legislation. This would create greater legal certainty for operators and users across the Union, as well as a better harmonisation of the European single market, creating more viable conditions for operators aiming at entering the EU market. 1.2 Is the Union competence represented by this Treaty article exclusive, shared or supporting in nature? Shared competence Subsidiarity does not apply for policy areas where the Union has exclusive competence as defined in Article 3 TFEU . It is the specific legal basis which determines whether the proposal falls under the subsidiarity control mechanism. Article 4 TFEU sets out the areas where competence is shared between the Union and th e Member States. A rticle 6 TFEU sets out the areas for which the Unions has competence only to support the actions of the Member States. Subsidiarity Principle: Why should the EU act? Does the proposal fulfil the procedural requirements of Protocol No. 2 : Has there been a wide consultation before proposing the act? Is there a detailed statement with qualitative and, where possible, quantitative indicators allowing an appraisal of whether the action can best be achieved at Union level? The Commission carried out an extensive consultation in preparation of th e Impact Assessment report. It benefit ed from consultation activities already carried out in 2021 for the exploratory study contracted by the Commission and implemented by a consortium made of Wavestone, CEPS and ICF to assess the need for horizontal cybersecurity requirements for digital products. To ensure a high level of coherence and comparability of analysis for all potential policy approaches, a second study led by the same consortium was contracted to collect evidence and conduct analyses in the first half of 2022. In addition to the Commission open public consultation and feedback on the Call for Evidence, the external contractors collected evidence from a variety of stakeholders through targeted interviews with experts covering different domains, focus groups, two workshops and a targeted online consultation. Moreover, to further support evidence based analysis, the Commission has conducted extensive desk research, covering a wide spectrum of policy studies and reports. They have been quoted in the main body of the Impact Assessment. Both the explanatory memorandum (section 2) and the impact assessment (chapter 3) contain respectively sections on the principles of subsidiarity, for more details see question 2.2. below. Does the explanatory memorandum (and any impact assessment) accompanying the Commission’s proposal contain an adequate justification regarding the conformity with the principle of subsidiarity? The strong cross-border nature of cybersecurity in general and the growing number of risks and incidents, which have spill-over effects across borders, sectors and products, mean that the objectives of the present intervention cannot effectively be achieved by Member States alone. National approaches in addressing the problems, and in particular approaches introducing ma ndatory requirements, will create additional legal uncertainty and legal barriers. Companies could be prevented from seamlessly expanding into other Member States, depriving users of the benefits of their products. Joint action at EU level is therefore necessary to establish a high level of trust among users, increasing the attractiveness of EU products with digital elements. It would also benefit the digital single market and internal market in general by providing legal certainty and achieving a level playing field for manufacturers of products with digital elements. Ultimately, the Council Conclusions of 23 May 2022 on the development of the European Union’s cyber posture call upon the Commission to propose, by the end of 2022, common cybersecurity requirements for connected devices. Based on the answers to the questions below, can the objectives of the proposed action be achieved sufficiently b y the Member States acting alone (necessity for EU action)? The strong cross-border nature of cybersecurity in general and the growing number of risks and incidents, which have spill-over effects across borders, sectors and products, mean that the objectives of the present intervention cannot effectively be achieved by Member States alone. National approaches in addressing the problems, and in particular approaches introducing mandatory requirements, will only create additional legal uncertainty and legal barriers. Companies could be prevented from seamlessly expanding into other Member States, depriving users of the benefits of their products. Joint action at EU level is therefore necessary to establish a high level of trust among users, increasing the attractiveness of EU products with digital elements. It would also benefit the digital single market and internal market in general by providing legal certainty and achieving a level playing field for manufacturers of products with digital elements. Ultimately, the Council Conclusions of 23 May 2022 on the development of the European Union’s cyber posture call upon the Commission to propose, by the end of 2022, common cybersecurity requirements for connected devices. Are there significant/appreciable transnational/cross-border aspects to the problems being tackled? Have these been quantified? The strong cross-border nature of cybersecurity in general and the growing risks and incidents, which have spill-over effects across borders, sectors and products, mean that the objectives of the present intervention cannot effectively be achieved by Member States alone. Taking into account the global nature of digital product markets, Member States face the same risks with respect to the same digital product on their territory. For example, a recent study on infected IoT products across the internal market has revealed that it is the same nine manufacturers in each country that are responsible for placing the highest number of IoT devices on the market that have been infected as a result of vulnerabilities, concluding that “international collaboration among regulators in various countries is a feasible path. This would not only bundle scarce resources on the side of governments, but is also more likely to influence manufacturer behaviour through collective action. An obvious starting point would be coordination at the level of the European Union.” Would national action or the absence of the EU level action conflict with core objectives of the Treaty or significantly damage the interests of other Member States? An emerging patchy framework of potentially diverging national rules also risks hampering an open and competitive single market for digital products. Some Member States, such as Germany and Finland have already taken first (non-binding) measures to improve the security of digital products. National approaches in addressing the problems, and in particular approaches introducing mandatory requirements, will only create additional legal uncertainty and legal barriers. Companies could be prevented from seamlessly expanding into other Member States, depriving users of the benefits of their products. To what extent do Member States have the ability or possibility to enact appropriate measures? Given the lack of negotiation power of individual users on a global p roducts market with large multi national manufacturers (see section 2.2.5 ), regulation at national level wou ld not be effective. In a 2021 report, the Dutch Safety Board concluded that the digital products market “can hardly be influenced by users in the Netherlands alone. Influencing such a global market requires a larger power block, for example at EU or UN level, or based on joint actions by end users.” How does the problem and its causes (e.g. negative externalities, spill-over effects) vary across the national, regional and local levels of the EU? Hardware and software products are increasingly subject to successful cyberattacks, leading to an estimated global annual cost of cybercrime of EUR 5.5 trillion by 2021. Such products suffer from two major problems adding costs for users and the society: (1) a low level of cybersecurity, reflected by widespread vulnerabilities and the insufficient and inconsistent provision of security updates to address them, and (2) an insufficient understanding and access to information by users, preventing them from choosing products with proper cybersecurity features or using them in a secure manner. The cybersecurity of products with digital elements has a strong cross-border dimension, as products manufactured in one country are often used across the internal market. In addition, incidents initially affecting a single entity or a single Member State often spread within minutes across the entire internal market. Is the problem widespread across the EU or limited to a few Member States? The identified problems cumulatively affect s the Union as a whole. Are Member States overstretched in achieving the objectives of the planned measure? Member States have very different levels of capabilities to address the current cybersecurity challenges, some being more mature and better resourced than others. Also, the adoption of different and potentially contradictory rules for product, which are mostly sold across the whole EU, would risk creating a very fragmented regulatory landscape. How do the views/preferred courses of action of national, regional and local authorities differ across the EU? In order to ensure legal certainty and avoid any further fragmentation of product-related requirements on cybersecurity on the internal market, the open public consultation and the targeted consultation have shown a wide overall support of various stakeholders , both industry and national authorities for a horizontal intervention setting out cybersecurity requirements for digital products. Based on the answer to the questions below, can the objectives of the proposed action be better achieved at Union level by reason of scale or effects of that action (EU added value)? Are there clear benefits from EU level action? Yes, EU level action could lead to a higher level of cybersecurity for all digital products across the Union , legal certainty for economic operators and more informed decision making for use by the customers of products with digital elements. Are there economies of scale? Can the objectives be met more efficiently at EU level (larger benefits per unit cost)? Will the functioning of the internal market be improved? The objectives of the initiative can be better achieved at Union level so as to avoid a further fragmentation of the single market into potentially contradictory national frameworks. A single framework regarding cybersecurity requi rements for products with digital elements would provide legal certainty and avoid overlapping or contradictory requirements stemming from different pieces of legislation. Harmonised EU requir ements would facilitate c ompliance for vendors of products with digital elements and create more viable conditions for operators aiming at entering t he EU market . What are the benefits in replacing different national policies and rules with a more homogenous policy approach? Users’ trust that produc ts with digital elements acquired in any Member State comply with a harmonised set of requirements would increase their trust in and demand for these products. Given the global and cross-border nature of the digital market and the internet, the intervention would reduce negative cross-border spill-overs and costs to society linked to mitigating risks of non-secure products. Do the benefits of EU-level action outweigh the loss of competence of the Member States and the local and regional authorities (beyond the costs and benefits of acting at national, regional and local levels)? The EU initiative would raise the level of cybersecurity for the whole EU by introducing horizontal cyberse curity requirements for products with digital elements . At the same time, the EU initiative will remain for the Member States to carry out the market surveillance and enforcement activities and thus the implementation of the requirements. Will there be improved legal clarity for those having to implement the legislation? The proposed Regulation would harmonise the EU regulatory landscape by introducing cybersecurity requirements for products with digital elements and avoid overlapping requirements stemming from different pieces of legislation. This would create greater legal certainty for operators and users across the Union, as well as a better harmonisation of the European single market, creating more viable conditions for operators aiming at entering the EU market. 3. Proportionality: How the EU should act Does the explanatory memorandum (and any impact assessment) accompanying the Commission’s proposal contain an adequate justification regarding the proportionality of the proposal and a statement allowing appraisal of the compliance of the proposal with the principle of proportionality? As regards the proportionality of the proposed Regulation, the measures in the policy options considered would not go beyond what is needed to achieve the general and specific objectives and would not impose disproportionate costs. More specifically, the intervention considered would ensure that products with digital elements would be secured throughout their whole life cycle and proportionally to the risks faced through objective-oriented and technology neutral requirements that remain reasonable and generally corresponding to the interest of the entities involved. The essential cybersecurity requirements in the p roposal are bui lding on widely used standards , and the standardisation process that will follow would take into account the technical specificities of the products. This means that where needed for a given risk level, security controls would be adapted. Furthermore, the envisaged horizontal rules would only foresee third-party assessment for critical products. This would only include a narrow share of the market for products with digital elements. The impact on SMEs would depend on their presence in the market of the se specific product categories. Regarding the proportionality of the costs for conformity assessment, notified bodies conducting the third party assessments would take the size of the undertaking into account when setting their fees. A reasonable transition period of 2 4 months to prepare the implementation would also be provided , giving time to the relevant markets to prepare, while providing a clear direction for R&D investments. Any compliance costs for businesses would be outweighed by the benefits brought by a higher level of security of products with digital elements and ultimately an increase of trust of users in these products. Based on the answers to the questions below and information available from any impact assessment, the explanatory memorandum or other sources, is the proposed action an appropriate way to achieve the intended objectives? Yes, as mentioned in the Impact Assessment and the Explanatory M emorandum, the preferred option would ensure the setting out of specific horizontal cybersecurity requirements for all products with digital elements being placed or made available in the internal market, and would be the only option covering the entire digital supply chain . Non-embedded software, often exposed to vulnerabilities, would also be covered by such regulatory intervention, thus ensuring a coherent approach towards all products with digital elements, with a clear share of responsibilities of various economic operators. This policy option also brings added value by covering duty of care and whole life cycle aspects after the placement of the products with digital elements on the market, to ensure, among others, appropriate information on security support and provision of security updates. This policy option would also come to most effectively complement the recent review of the NIS framework, by ensuring the prerequisites for a strengthened supply chain security. The preferred option would bring significant benefits to the various stakeholders. Is the initiative limited to those aspects that Member States cannot achieve satisfactorily on their own, and where the Union can do better? T he requirements in the EU initiative would not go beyond what is needed to achieve the general and specific objectives and would not impose disproportionate costs. Member States have very different levels of capabilities to address the current cybersecurity challenges, some being more mature and better resourced and t echnically prepared than others, risking to create a very fragmented regulatory landscape, given the strong cross border nature of the problems the initiative aim s to tackle. Is the form of Union action (choice of instrument) justified, as simple as possible, and coherent with the satisfactory achievement of, and ensuring compliance with the objectives pursued (e.g. choice between regulation, (framework) directive, recommendation, or alternative regulatory methods such as co-legislation, etc.)? A regulatory intervention would entail the adoption of a regulation and not a directive. This is because, for this particular type of product legislation, a regulation would more effectively address the problems identified and meet the objectives formulated, since it is an intervention that is conditioning the placing on the internal market of a very wide category of products. The transposition process in the case of a directive for such intervention could leave too much room for discretion at national level, potentially leading to lack of uniformity of certain essential cybersecurity requirements, legal uncertainty, further fragmentation or even discriminatory situations cross-border, even more taking account of the fact that the products covered could be of multiple purpose or use and that manufacturers can produce multiple categories of such products. Does the Union action leave as much scope for national decision as possible while achieving satisfactorily the objectives set? (e.g. is it possible to limit the European action to minimum standards or use a less stringent policy instrument o g approach?) T he proposal sets out requirements for national authorities responsible for conformity assessment bodies (notified bodies). It leaves the ultimate responsibility for designating and monitoring notified bodies with the Member State. Member States shall designate a notifying authority that shall be responsible for setting up and carrying out the necessary procedures for the assessment and notification of conformity assessment bodies and the monitoring of notified bodies. In accordance with Regulation (EU) 2019/1020, national market surveillance authorities will carry out market surveillance in the territory of that Member State. Member States may choose to designate any existing or new authority to act as market surveillance authority . Moreover, the proposal establishes maximum levels for administrative fines that should be provided in national laws for non-compliance with the obligations laid down in this Regulation. Does the initiative create financial or administrative cost for the Union, national governments, regional or local authorities, economic operators or citizens? Are these costs commensurate with the objective to be achieved? According to the I mpact A ssessment, t he preferred option (which has been chosen for the present EU initiative) would add compliance and enforcement costs for businesses, notified bodies and public authorities, including accreditation and market surveillance authorities. For software developers and hardware manufacturers, it will increase the direct compliance costs for new security requirements, documentation and reporting obligations, leading to aggregated costs amounting to up to EUR 29 billion. End users, including business end users, consumers and citizens may face higher prices of digital products. However, they should be seen against the background of the significant benefits as described above. While respecting the Union law, have special circumstances applying in individual Member States been taken into account? T he proposal sets out requirements for national authorities responsible for conformity assessment bodies (notified bodies). It leaves the ultimate responsibility for designating and monitoring notified bodies with the Member State. Member States shall designate a notifying authority that shall be responsible for setting up and carrying out the necessary procedures for the assessment and notification of conformity assessment bodies and the monitoring of notified bodies. Member States will also designate the competent market surveillance authority to carry out supervision and enforcement on the territory of each Member State. Moreover, the proposal establishes maximum levels for administrative fines that should be provided in national laws for non-compliance . Executive Summary Sheet (Max 2 pages) Impact assessment on the Cyber Resilience Act (CRA) A. Need for action What is the problem and why is it a problem at EU level? H ardware and software products often face successful cyberattacks , leading to an estimated global annual cost of cybercrime of EUR 5.5 trillion by 2021. The se products suffer from two major problems adding costs for users and the society : (1) a low level of cybersecurity, reflected by widespread vulnerabilities and the insufficient and inconsistent provision of security updates to address them , and (2) an insufficient understanding and access to information by users, preventing them from choos ing products with proper cybersecurity features or us ing them in a secure manner . The cybersecurity of product s with digital element s has a strong cross-border dimension, as products manufactured in one country are often used across the internal market. In addition, incidents initially affecting a single entity or a single Member State often spread within minutes across the entire internal market. While existing internal market legislation applies to certain product s with digital element s , most of the hardware and software products are currently not covered by any EU legislation tackling their cybersecurity . In particular, the current EU legal framework does not address the cybersecurity of non-embedded software, even if cybersecurity attacks increasingly target vulnerabilities in these products, causing significant societal and economic costs. Recent examples are the Pegasus spyware, which exploit ed vulnerabilities in mobile phones, or the WannaCry ransomware worm, which exploited a Windows vulnerability , affect ing com puters worldwide . What should be achieved? T wo main objectives were identified aiming to ensure the proper functioning of the internal market : (1) creat e conditions for the development of secure product s with digital element s by ensur ing that hardware and software products are placed on the market with fewer vulnerabilities and that manufactures take security seriously throughout a product’s life cycle ; and (2) creat e conditions allowing users to take cybersecurity into account when selecting and using product s with digital element s . Four specific objectives were set out : (i) ensure that manufacturers improve the security of product s with digital element s since the design and development phase and throughout the whole life cycle ; (ii) e nsure a coherent cybersecurity framework, facilitating compliance for hardware and software manufacturers ; ( i ii ) enhance the transparency o f security properties of product s with digital element s, and ( i v ) enable businesses and consumers to use product s with digital element s securely. What is the value added of action at the EU level (subsidiarity)? The strong cross-border nature of cybersecurity and the growing incidents with spill-over effects across borders, sectors and products, mean that the objectives cannot effectively be achieved by Member States alone. Given the global nature of markets of product s with digital elements , Member States face the same risks for the same product with digital elements on their territory . A n emerging patchy framework of potentially diverging national rules also risks hampering an open and competitive single market for product s with digital element s. Joint action at EU level is th us necessary to increase the level of trust among users and the attractiveness of product s with digital element s place on the EU market . It would also benefit the internal market by providing legal certainty and achieving a level playing field for manufacturers of product s with digital element s. B. Solutions What are the various options to achieve the objectives? Is there a preferred option or not? If not, why? F our policy options and related sub-options were analysed going beyond the status quo : (1) s oft law approach and voluntary measures ; (2) product-specific a d-hoc regulatory intervention for cybersecurity of tangible product s with digital element s and respective embedded software ; (3) m ixed approach, including horizontal mandatory rules for cybersecurity of tangible product s with digital element s and respective embedded software and a staggered approach for non-embedded software , with two sub-op tions for conformity assessment ; and (4) a horizontal regulatory intervention introducing cybersecurity requirements for a broad scope of product s with digital element s, including non-embedded software , with sub-options on the scope , and on conformity assessment . The Impact Assessment conclude d that the preferred option is option 4 covering all products with digital elements and foreseeing mandatory third-party assessment for critical products , based on the assessment of effectiveness against the specific objectives , efficiency of costs versus benefi ts, and conherence. What are different stakeholders' views? Who supports which option? When asked to rate the effectiveness of the policy interventions, the public consultation respondents agreed that option 4 would be the most effective measure (4.08 on a scale from 1 to 5) . This includes consumer organisations (5.00), respondents identifying themselves as users (4.22), notified bodies (4.17), market surveillance authorities (5.00) and manufacturers of product s with digital element s (3.85), including those of small and medium size (4.05). C. Impacts of the preferred option What are the benefits of the preferred option (if any, otherwise of main ones)? The preferred option would bring significant benefits to the various stakeholders. For businesses, it would prevent divergent security rules for product s with digital element s and decrease compliance costs for related cybersecurity legislation . It would reduce the number of cyber incidents , incident handling costs and reputational damage. For the whole E U , it is estimated that the initiative could lead to a cost reduction from incidents affecting businesses by roughly EUR 180 to 290 billion annually. Furthermore, the initiative would lead to an increase d turnover due to a growing uptake of product s with digital element s . It would also improve the companies’ global reputation leading to a demand uptake from outside the EU. For end users, the preferred option would enhance the transparency of the security properties and facilitate the use of product s with digital element s. Consumers and citizens would also benefit from better protection of their fundamental rights, such as privacy and data protection. What are the costs of the preferred option (if any, otherwise of main ones)? The preferred option would add compliance and enforcement costs for businesses, notified bodies and public authorities , including notifying, accreditation and market surveillance authorities . For software developers and hardware manufacturers, i t will increa se the direct compliance costs f or new cyber security requirements, conformity assessment , documentation and reporting obligations , leading to a ggregated compliance costs amou nt ing to up to roughly EUR 29 billion for an estimated market value of products with digital elements of up to EUR 1 485 billion in turnover . End users, including business end users , consumers and citizens may face higher prices of product s with digital element s . However, the se should be seen against the background of the significant benefits as described above. For notified bodies, the additional costs are expected to be compensated by an increase in turnover. What are the impacts on SMEs and competitiveness? SMEs will be impacted by the new requirements both as manufacturers and end-users . I n terms of compliance costs, SMEs would in principle be more affected than large companies which typically have better economies of scale and a grea ter cybersecurity awareness. However , SMEs would strongly benefit from the initiative , as cyber security embedded in product s with digital element s would present a significant cost saving for SMEs as users. As manufacturers , SMEs would benefit from larger end-user trust and new customers. A seamless access to the internal market and a reduction of market fragmentation can be even more beneficial for SMEs, being less equipped to handle different regulatory requirements. While stressing the need for a proportionate approach and supporting measures, SMEs generally supported a level playing field between all companies and did not believe that they would be disadvantaged compared to larger companies in a scenario of horizontal mandatory requirements . Will there be significant impacts on national budgets and administrations? The initiative will impact national authorities , such as national notifying authorities, accreditation authorities and market surveillance authorities having responsibilities to monitor and enforce the proposed measures. The se authorities will bear additional adjustment (e.g. training and human resources) and enforcement costs to take into account the new requirements. The resources spent by accreditation bodies are however offset and borne largely by conformity assessment bodies through the purchase of accreditation services. Will there be other significant impacts? No other significant negative impacts are expected. The preferred policy option would help reduce the number and severity of incidents, including personal data breaches and w ould have positive social impacts such as reduc ing cybercrime. T he demand for security professionals is likely to grow and cybersecurity information asymmetries would be reduced . Proportionality? The preferred option does not go beyond what is necessary to meet the specific objectives satisfactorily . The intervention would ensure that product s with digital element s are secured throughout their whole lifecycle and proportionally to the risks faced. D. Follow up When will the policy be reviewed? By [36 months] after the date of application of the initiative and every four years thereafter, the Commission shall submit a report on the evaluation and review of the initiative to the European Parliament and to the Council. Resolutsiooni liik: Riigikantselei resolutsioon Viide: Majandus- ja Kommunikatsiooniministeerium / / ; Riigikantselei / / 2-5/22-01867 Resolutsiooni teema: EL küberkerksuse määruse eelnõu Adressaat: Majandus- ja Kommunikatsiooniministeerium Ülesanne: Tulenevalt Riigikogu kodu- ja töökorra seaduse § 152` lg 1 p 2 ning Vabariigi Valitsuse reglemendi § 3 lg 4 palun valmistada ette Vabariigi Valitsuse seisukoha ja otsuse eelnõu järgneva algatuse kohta, kaasates seejuures olulisi huvigruppe ja osapooli: - Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on horizontal cybersecurity requirements for products with digital elements and amending Regulation (EU) 2019/1020, COM(2022) 454. EISi toimiku nr: 22-0544 Tähtaeg: 17.10.2022 Adressaat: Haridus- ja Teadusministeerium, Justiitsministeerium, Kaitseministeerium, Siseministeerium, Välisministeerium Ülesanne: Palun esitada oma sisend Majandus- ja Kommunikatsiooniministeeriumile seisukohtade kujundamiseks antud eelnõu kohta (eelnõude infosüsteemi (EIS) kaudu). Tähtaeg: 06.10.2022 Lisainfo: Eelnõu on kavas arutada valitsuse 27.10.2022 istungil ja Vabariigi Valitsuse reglemendi § 6 lg 6 kohaselt sellele eelneval nädalal (19.10.2022) EL koordinatsioonikogus. Esialgsed materjalid EL koordinatsioonikoguks palume esitada hiljemalt 17.10.2022. Kinnitaja: Katrin Juhandi, Euroopa Liidu asjade direktori asetäitja Kinnitamise kuupäev: 20.09.2022 Resolutsiooni koostaja: Elen Nurme [email protected], 693 5201  Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE ANDMED Nimetus COUNCIL on horizontal cybersecurity requirements for products with digital elements and ALGATUSE KOHTA amending Regulation (EU) 2019/1020 Eelnõu nr COM(2022) 454 Esitamise kuupäev: 15.09.2022 Menetluskord EL-is: tavamenetlus RKKTS § 1521 lg 1 1. p1 - algatuse/teatise reguleerimisala nõuab seaduse või Riigikogu otsuse vastuvõtmist, muutmist või kehtetuks tunnistamist SEISUKOHA 2. RKKTS § 1521 lg 1 - algatuse/ vastuvõtmisega või teatises toodud meetmete rakendamisega kaasneb oluline majanduslik , sotsiaalne või muu mõju VALITSUSSE p2 TOOMISE ALUS 3. RKKTS § 1521 lg 2 - Euroopa Liidu asjade komisjoni või väliskomisjoni nõue 4. VVS § 201 lg 1 - algatuse/teatise reguleerimisala nõuab VV pädevusse kuuluva otsuse vastuvõtmist (määruse vastuvõtmine, muutmine, tühistamine) 5. VVS § 201 lg 2 - seisukoha võtmist algatuse/teatise osas peab oluliseks peaminister või minister (on poliitiliselt oluline või tundlik (Eestis või EL-is)) VALITSUSELE Kuupäev 19.10 KOK, 27.10 EL menetluse ESITAMINE VV ajakava SIM, KAM, JM, SISERIIKLIK Vastutav Kaasatud HM, VÄM (sisendi Sotsiaalpartnerid, Kaasata kõik asjasse puutuvad MENETLUS min MKM ministeeriumid andmise tähtaeg huvigrupid partnerid ja huvigrupid 06.10) EELNÕU ÜLEVAADE KOKKUV 15.09 avaldas Euroopa Komisjon nn küberkerksuse määruse eelnõu, mille eesmärgiks on tagada ÕTE digitoodete ja kõrvalteenuste (nii riist- kui tarkvaratooted, sh asjade interneti seadmed nagu EELÕU sensorid, kiipkaardid, ruuterid jne) küberturvalisuse ühtlaselt kõrge tase. Küberintsidentide SISUST hüppeline kasv viitab sellele, et senistest, kriitilisele taristule suunatud meetmetest ja nõuetest (nn JA NIS2 direktiiv) ei piisa. EESMÄR Määrusega antakse kasutajatele suurem kontroll toodete küberturvalisuse sätete üle ja parandatakse KIDEST küberturvalisuse elementide läbipaistvust, samuti kehtestatakse harmoniseeritud standardid ja vastavushindamise süsteem. Täpsemalt loob eelnõu: - eeskirjad digitaalsete elementidega toodete turule laskmise kohta, et tagada nende küberturvalisus; - olulised nõuded digitaalsete elementidega toodete kavandamiseks, arendamiseks ja tootmiseks ning ettevõtjate kohustused seoses nende toodetega; - tootjate poolt kohaldatavate haavatavuse käsitlemise protsesside nõuded, et tagada digitaalsete elementidega toodete küberturvalisus kogu toote olelusringi jooksul; - tootjate kohustus teavitada turvaaukudest ja -juhtumitest ja - turujärelevalvet ja jõustamist käsitlevad eeskirjad. Kavandatavat määrust kohaldatakse kõikidele toodetele, mis on kas otse või kaudselt ühendatud mõne teise seadme või võrguga. Mõned erandid kehtivad toodetele, mille küberjulgeoleku nõuded on juba kehtivates ELi eeskirjades sätestatud, näiteks meditsiiniseadmete, lennunduse või autode kohta. ONVÕIMALIKUD SOTS-MAJ. MÕJUD VÕIMALIKUD ÕIGUSLIKUD MUUDATUSED MÕJU EELARVELE KOMMENTAARID SEISUKOHAD EESTI SEISUKOHT TEISTE RIIKIDE SEISUKOHAD KOMMENTAARID 1/1 Alustatud: 09/19/2022 Muudetud: 20.09.2022 Eelnõude infosüsteemis (EIS) on antud täitmiseks ülesanne. Eelnõu toimik: 17.1.1/22-0544 - COM(2022) 454 Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on horizontal cybersecurity requirements for products with digital elements and amending Regulation (EU) 2019/1020 Arvamuse andmine eelnõu kohta Majandus- ja Kommunikatsiooniministeeriumile vastavalt Riigikantselei 20.09.2022 resolutsioonile. Osapooled: Haridus- ja Teadusministeerium; Justiitsministeerium; Kaitseministeerium; Siseministeerium; Välisministeerium Tähtaeg: 06.10.2022 00:00 Link eelnõu toimiku vaatele: https://eelnoud.valitsus.ee/main/mount/docList/0ddaa901-ddab-4ed4-9916-c62eae7ef6b0 Link menetlusetapile: https://eelnoud.valitsus.ee/main/mount/docList/0ddaa901-ddab-4ed4-9916-c62eae7ef6b0?activity=2 Eelnõude infosüsteem (EIS) https://eelnoud.valitsus.ee/main