G/TBT/N/EU/936  
29 November 2022  
(22-8890) Page: 1/3 
Committee on Technical Barriers to Trade  Original:  English  
 
  
NOTIFICATION  
The following notification is being circulated in accordance with Article 10.6  
 
1. Notifying Member:  EUROPEAN UNION  
If applicable, name of local government involved (Article 3.2 and 7.2):   
2. Agency responsible:   
European Commission  
Name and address (including telephone and fax numbers , email and website 
addresses, if available) of agency or authority designated to handle comments 
regarding the notification shall be indicated if different from above:   
European Comm ission,  
EU-TBT Enquiry Point,  
Fax: +(32) 2 299 80 43,  
E-mail: grow-eu-tbt@ec.europa.eu  
Website: http://ec.europa.eu/growth/tools -databases/tbt/en/  
3. Notified under Article 2.9.2 [X], 2.10.1 [  ], 5.6.2 [  ], 5.7.1 [  ], 3.2 [  ], 7.2 [  ], 
other :  
4. Products covered (HS or CC CN where applicable, otherwise national tariff 
heading. ICS numbers may be provided in addition, where applicable):  Products 
with digital elements (i.e. software, including standalone software, and hardware and its 
remote data processing, including hardwar e and software components) whose intended 
or reasonably foreseeable use includes a direct or indirect logical or physical data 
connection to a device or network.  
5. Title, number of pages and language(s) of the notified document:  Proposal for a 
Regulation  of the European Parliament and of the Council on horizontal cybersecurity 
requirements for products with digital elements and amending Regulation (EU) 
2019/1020 (COM(2022) 454 final); (16 page(s), in English), (87 page(s), in English)  
6. Description of c ontent:  Legislative proposal published by the European Commission on 
15 September 2022, setting out a Cyber Resilience Act (CRA) aimed at setting horizontal 
cybersecurity requirements for products with digital elements.  
The measures proposed are based on the New Legisl ative Framework  for EU product 
legislation, and would apply to different economic operators operating on the EU internal 
market, including manufacturers, importers and distributors of products with digital 
elements. The rules would apply equally to EU and non-EU economic operators for the 
products with digital elements intended to be placed on the EU market. The draft rules 
lay down:  
1. rules for the placing on the market of products with digital elements to ensure 
their cybersecurity;  G/TBT/N/EU/936  
 
- 2 - 
 
  2. essential requirements f or the design, development and production of products 
with digital elements, and obligations for economic operators in relation to these 
products;  
3. essential requirements for the vulnerability handling processes put in place by 
manufacturers to ensure the c ybersecurity of products with digital elements 
during the whole life cycle, and obligations for economic operators in relation to 
these processes. Manufacturers will also have to report actively exploited 
vulnerabilities and cybersecurity incidents.  
4. rules related to conformity assessment and applicable procedures to verify the 
essential requirements (based either on self -assessment or third -party 
assessment depending on the criticality of products) as well as a list of "critical 
products" which require a st ricter conformity assessment procedure. The proposal 
distinguishes between critical products of class I and class II, reflecting the level 
of cybersecurity risk related to these products.  
5. rules on market surveillance and enforcement.  
Where compliance of th e product with the applicable requirements has been 
demonstrated (through conformity assessment), manufacturers shall draw up an EU 
declaration of conformity and will be able to affix the CE marking. The CE marking will 
indicate the conformity of products with digital elements so that those products can move 
freely within the EU internal market.  
In order facilitate conformity with the essential requirements for manufacturers of 
products with digital elements, the adoption of the Cyber Resilience Act may lea d to 
standardisation, i.e. the development of "harmonised standards" as per Article 3(34) and 
Article 18 of the proposal. Such standardisation work will be developed in accordance with 
the EU Regulation on Standardisation (Regulation (EU) 1025/2012) (see R ecital 38 and 
Article 3 (34) of the proposal) and will take into account existing European and 
international standards. Therefore, in the preparation process that could lead to the 
development of "harmonized standards" that would support the implementation  of the 
CRA, the European Commission will support studies carrying out mapping and gap 
analysis of existing cybersecurity standards for products with digital elements.  
Bilateral (inter -governmental) Mutual Recognition Agreements (MRAs) for conformity 
assessment and marking of regulated products can also be considered in the CRA context 
(see Recital 67 of the proposal).  
7. Objective and rationale, including the nature of urgent problems where 
applicable:  Cyber -attacks spread across borders o f the internal market within minutes, 
and a majority of such attacks stem from the exploitation of vulnerabilities in products. 
The regulation therefore tackles on the one hand, the current low level of cybersecurity 
of many of products with digital elemen ts placed on the EU internal market and on the 
other hand, the fact that manufacturers tend not to provide updates to address 
vulnerabilities throughout the lifecycle of those products. The draft rules propose to 
address these two aspects by introducing ma ndatory horizontal cybersecurity 
requirements for manufacturers and an obligation to provide up to date information and 
instructions to customers.  
The draft rules place responsibility on manufacturers, who must ensure conformity with 
security requirements of products with digital elements that are made available on the 
EU internal market. As a result, the draft rules aim to prevent deceptive practices and 
enhance consumer protection. They will also support business users and consumers by 
enhanc ing the transparency of the security properties and by ensuring better protection 
of fundamental rights, such as the right to privacy and data protection. By preventing 
cybersecurity incidents stemming from unsecure products with digital elements, the 
proposal will enhance the protection of human health and safety.  
The draft rules also aim to harmonise and streamline cybersecurity requirements for 
products with digital elements and avoid overlapping requirements stemming from 
different pieces of EU sectoral  and national legislation. This would create greater legal 
certainty for operators and users across the Union, including non -EU operators aiming at 
entering the EU market.; Not specified  G/TBT/N/EU/936  
 
- 3 - 
 
  8. Relevant documents:   
The New Legislative Framework comprises the following legislations:  
• Regulation (EU) 2019/1020 of the European Parliament and of the Council of 20 
June 2019 on market surveillance and compliance of products : https: //eur-
lex.europa.eu/legal -content/EN/TXT/?uri=celex:32019R1020  
• Regulation (EC) No 765/2008 of the European Parliament and of the Council of 9 
July 2008 setting out the requirements for accreditation and market surveillance 
relating to the marketing of prod ucts: https://eur -lex.europa.eu/legal -
content/EN/TXT/?uri=CELEX%3A32008R0765  
• Decision (EC) 768/2008 of the European Parliament and of the Council of 9 July 
2008 on a com mon framework for the marketing of products: https://eur -
lex.europa.eu/legal -content/EN/ALL/?uri=CELEX%3A32008D0768  (this Decision 
provides a basis of common principles and reference provisions for future 
legislation)  
Regulation Regulation (EU) 1025/2012 of the European Parliament and of the Council of 
25 October 2012 on European standardisation: https://eur -lex.europa.eu/legal -
content/EN/TXT/?uri=CELEX%3A32012R1025  
9. Proposed date of adoption:  Following adoption by the European Parliament and the 
Council, the proposal will enter into force, possibly in 2024.  
Proposed date of entry into force:  It is proposed that the Regulation should be fully 
applicable 24 months after its entry into force (transition period)  
10. Final date for comments:  90 days from notification  
11. Texts available from:  National enquiry point [ ] or address, telephone and fax 
numbers and email and website addresses, if available , of other body:   
European Commission,  
EU-TBT Enquiry Point,  
Fax: + (32) 2 299 80 43,  
E-mail: grow-eu-tbt@ec.europa.eu  
The te xt is available on the EU -TBT Website : http://ec.europa.eu/growth/tools -
databases/tbt/en/  
https://members.wto.org/crnattachments/2022/TBT/EEC/22_8139_00_e.pdf  
https://members.wto.org/crnattachments/2022/TBT/EEC/22_8139_01_e.pdf