EU council adopts new cybersecurity law for digital products

Brussels (Brussels Morning Newspaper) – The EU Council adopted a new law on security requirements for digital products.

The European Council adopted a new law on cybersecurity requirements for products with digital elements to assure that products, such as attached home cameras, fridges, TVs, and toys, are safe before they are set on the market (Cyber Resilience Act). The new regulation seeks to fill the gaps, explain the links, and make the existing cybersecurity legislative framework more coherent, ensuring that products with digital features, for example, ‘Internet of Things’ (IoT) products, are protected throughout the supply chain and their lifecycle.

What are the key elements of the new regulation?

The new law presents EU-wide cybersecurity requirements for the invention, development, production and making known on the market of hardware and software products, to bypass overlapping requirements arising from different pieces of legislation in EU member states. 

The regulation will involve all products that are linked either directly or indirectly to another device or a network. 

Finally, the new law will permit consumers to take cybersecurity into account when choosing and using products that contain digital elements, making it more comfortable for them to determine hardware and software products with the proper cybersecurity components.

When was the Cyber Resilience Act first proposed?

First reported by EU Commission President von der Leyen in her State of the Union address in September 2021, the Cyber Resilience Act was noted in the Council conclusions of 23 May 2022 on the development of the European Union’s cyber posture, which called upon the Commission to present its proposal by the end of 2022.

On 15 September 2022, the Commission presented the proposal for a cyber resilience act, which will complement the current EU cybersecurity framework: the directive on the security of network and information systems (NIS directive), the directive on standards for a high level of cybersecurity across the Union (NIS 2 directive) and the EU cybersecurity act. Following interinstitutional negotiations (‘trilogues’), a provisional arrangement was reached between the co-legislators on 30 November 2023.