Council of theEuropean Union
Brussels, 13 July 2023
(OR. en)
11726/23
Interinstitutional File:2022/0272(COD)

LIMITECYBER 182
JAI 1003
DATAPROTECT 197
TELECOM 230
MI 614
CSC 363
CSCI 131
CODEC 1367

NOTE
From:
To:

General Secretariat of the Council
Permanent Representatives Committee

Subject:

Proposal for a Regulation of the European Parliament and of the Council
on horizontal cybersecurity requirements for products with digital elements
and amending Regulation (EU) 2019/102- Mandate for negotiations with the European ParliamentI.

INTRODUCTION

1.

On 15 September 2022, the Commission adopted the proposal for a Regulation of theEuropean Parliament and of the Council on horizontal cybersecurity requirements for
products with digital elements and amending Regulation (EU) 2019/1020 (‘Cyber ResilienceAct’). First announced by President von der Leyen in her State of the Union Address in
September 2021, the idea was reflected in the Council conclusions of 23 May 2022 on thedevelopment of the European Union’s cyber posture, which called upon the Commission to
propose common cybersecurity requirements for connected devices by the end of 2022. Prior
to the announcement, the Council conclusions on the cybersecurity of connected devices of 2
December 2020 underlined the importance of assessing the need for horizontal legislation in
the long term to address all relevant aspects of the cybersecurity of connected devices, such asavailability, integrity and confidentiality, including specifying the necessary conditions forplacement on the market.

11726/23
JAI.2

EB/es

1

LIMITEEN2.

The purpose of the proposal, which is based on Article 114 TFEU, is to harmonise essential
cybersecurity requirements for products with digital elements in all Member States and avoid
overlapping requirements stemming from different pieces of legislation. The proposal aims tofill the gaps in the existing cybersecurity legislation by ensuring that products with digitalelements – for example Internet of Things (IoT) products, such as connected home cameras,
refrigerators, TVs, toys and non-embedded software – become secure throughout the whole
supply chain and throughout their whole life cycle. The proposal also aims to clarify links
with existing legislation and to contribute to making it more coherent. Lastly, the proposal
also allows users to take cybersecurity into account when selecting and using products withdigital elements.

3.

In particular, the proposal lays down: rules for the placing on the market of products with digital elements to ensure thecybersecurity of such products;
 essential requirements for the design, development and production of products withdigital elements, and obligations for economic operators in relation to these productswith respect to cybersecurity;
 essential requirements for the vulnerability handling processes put in place bymanufacturers to ensure the cybersecurity of products with digital elements during thewhole life cycle, and obligations for economic operators in relation to these processes;
 rules on market surveillance and enforcement of the above-mentioned rules andrequirements.

11726/23
JAI.2

EB/es

2

LIMITEENII.

STATE OF PLAY OF WORK WITHIN THE COUNCIL PREPARATORY BODIES

4.

Discussions on the proposal started in the Horizontal Working Party on Cyber Issues(HWPCI) on 21 September 2022 and a full read-through was completed on 26 October 2022.
As a consequence of this read-though, Member States broadly welcomed the proposed
Regulation and generally supported its overall objectives, albeit with some scrutiny
reservations. Various topics such as the scope of the proposal, the product lifetime inconjunction with vulnerability handling requirements, the free movement clause, theinteraction with other relevant legislation, the consequences for SMEs and start-ups and thereporting provisions needed further clarification and discussion. On 6 December 2022, theCouncil took note of the progress made under the Czech Presidency (14477/22).

5.

The Swedish Presidency’s priority was to advance the discussions as much as possible
towards a general approach. In order to structure these discussions and allow delegations
enough time for scrutiny, the Presidency circulated a detailed work schedule dividing the text
into four major blocks of articles with a concrete timeline for their discussion. By the end ofJune 2023, the Swedish Presidency organised a total of eleven dedicated HWPCI meetings
which resulted in four compromise proposals covering the whole text of the Regulation.

6.

The Spanish Presidency issued a revised compromise proposal on 3 July 2023 which was
discussed at the Horizontal Working Party on Cyber Issues on 10 July 2023. In generaldelegations welcomed this compromise and agreed to submit this proposal, with some further
amendments, to the Permanent Representatives Committee in order to receive a mandate tostart the negotiations with the European Parliament. The revised Presidency compromise text
appears in the Annex to this note. All changes compared to the Commission proposal are
indicated in bold or strikethrough.

7.

During the discussions in the Council, several important amendments were introduced in the
proposed Regulation, notably regarding its scope and the related categories of products(Articles 6 and 6a, Annexes III and IIIa). Amendments were also introduced in the reporting
obligations (Article 11) with the establishment of a single reporting platform managed andmaintained by ENISA and an increased role for the Computer Security Incident Response
Team (CSIRT) and CSIRTs network.

11726/23
JAI.2

EB/es

3

LIMITEEN

Furthermore, the provisions on dual-use products and software including the status of opensource components and Software-as-a-Service were clarified. Due consideration was also
given to alleviate the impact of the proposed Regulation for micro, small and medium
enterprises (SMEs) (Article 24a). Other amendments concern the obligations of the
manufacturer (Article 10), especially regarding the determination of the expected productlifetime. The handling of spare parts (Article 2 (4a)) as well as the conformity assessment
provisions (Article 24) were further clarified.
8.

In the European Parliament, the file was assigned to the Committee on Industry, Research andEnergy (ITRE) and MEP Nicola Danti (Renew, Italy) has been appointed as rapporteur. The
Committees on Internal Market and Consumer Protection (IMCO) and on Civil Liberties,
Justice and Home Affairs (LIBE) have been asked for their opinions. IMCO has exclusivecompetences on Articles 7 and 9 and shared competences on Articles 4, 8, 21, 22 and 25-40.
LIBE has shared competence on Article 41(5) and decided not to give an opinion. The vote in
ITRE is expected on 19 July 2023.

9.

The European Economic and Social Committee (EESC) adopted its opinion on the Cyber
Resilience Act on 14 December 20221.

III. CONCLUSION
10.

The Presidency’s compromise text, as set out in the Annex, reflects efforts of the Presidency
and Member States to strike a proper balance in the text.

11.

The Permanent Representatives Committee is therefore invited to:–

examine and confirm the Presidency’s compromise text set out in the Annex to this
note;

–

approve the mandate for the Presidency to enter into negotiations with therepresentatives of the European Parliament and the European Commission on this file.
_____________________

1 16178/22

11726/23
JAI.2

EB/es

4

LIMITEEN

ANNEX
2022/0272 (COD)
Proposal for a
REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL
on horizontal cybersecurity requirements for products with digital elements, and amending
Regulation (EU) 2019/1020 and Directive (EU) 2020/1828(Text with EEA relevance)

THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,
Having regard to the Treaty on the Functioning of the European Union, and in particular Article 114
thereof,
Having regard to the proposal from the European Commission,
After transmission of the draft legislative act to the national parliaments,
Having regard to the opinion of the European Economic and Social Committee2,
Having regard to the opinion of the Committee of the Regions3,
Acting in accordance with the ordinary legislative procedure,

2
3

OJ C , , p. .
OJ C , , p. .

11726/23
ANNEX

JAI.2

EB/es

5

LIMITEEN

Whereas:(1)

It is necessary to improve the functioning of the internal market by laying down a uniform
legal framework for essential cybersecurity requirements for placing products with digitalelements on the Union market. Two major problems adding costs for users and society
should be addressed: a low level of cybersecurity of products with digital elements, reflectedby widespread vulnerabilities and the insufficient and inconsistent provision of security
updates to address them, and an insufficient understanding and access to information byusers, preventing them from choosing products with adequate cybersecurity properties orusing them in a secure manner.

(2)This Regulation aims to set the boundary conditions for the development of secure productswith digital elements by ensuring that hardware and software products are placed on themarket with fewer vulnerabilities and that manufactures take security seriously throughout aproduct’s life cycle. It also aims to create conditions allowing users to take cybersecurity
into account when selecting and using products with digital elements.

(3)

The relevant Union legislation that is currently in force comprises several sets of horizontal
rules that address certain aspects linked to cybersecurity from different angles, including
measures to improve the security of the digital supply chain. However, the existing Union
legislation related to cybersecurity, including [Directive (EU) 2022/2555XXX/XXXX(NIS2)] of the European Parliament and of the Council4 and Regulation (EU) 2019/881
of the European Parliament and of the Council5 does not directly cover mandatory
requirements for the security of products with digital elements.

4

5

Directive (EU) 2022/2555 of the European Parliament and of the Council of
14 December 2022 on measures for a high common level of cybersecurity across theUnion, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, andrepealing Directive (EU) 2016/1148 (NIS 2 Directive) (OJ L 333, 27.12.2022, p. 80).
Regulation (EU) 2019/881 of the European Parliament and of the Council of 17 April 2019
on ENISA (the European Union Agency for Cybersecurity) and on information andcommunications technology cybersecurity certification and repealing Regulation (EU) No
526/2013 (Cybersecurity Act) (OJ L 151, 7.6.2019, p. 15).

11726/23
ANNEX

JAI.2

EB/es

6

LIMITEEN

(4)While the existing Union legislation applies to certain products with digital elements, there
is no horizontal Union regulatory framework establishing comprehensive cybersecurity
requirements for all products with digital elements. The various acts and initiatives taken
thus far at Union and national levels only partially address the identified cybersecurityrelated problems and risks, creating a legislative patchwork within the internal market,
increasing legal uncertainty for both manufacturers and users of those products and adding
an unnecessary burden on companies to comply with a number of requirements for similartypes of products. The cybersecurity of these products has a particularly strong cross-borderdimension, as products manufactured in one country are often used by organisations andconsumers across the entire internal market. This makes it necessary to regulate the field at
Union level. The Union regulatory landscape should be harmonised by introducing
cybersecurity requirements for products with digital elements. In addition, certainty foreconomic operators and users should be ensured across the Union, as well as a better
harmonisation of the single market, creating more viable conditions for economic operators
aiming at entering the Union market.

(5)

At Union level, various programmatic and political documents, such as the EU’s
Cybersecurity Strategy for the Digital Decade6, the Council Conclusions of 2 December
2020 and of 23 May 2022 or the Resolution of the European Parliament of 10 June 2021,7
have called for specific Union cybersecurity requirements for digital or connected products,
with several countries around the world introducing measures to address this issue on theirown initiative. In the final report of the Conference on the Future of Europe,8 citizens called
for “a stronger role for the EU in countering cybersecurity threats”.

67
8

JOIN(2020) 18 final, https://eur-lex.europa.eu/legalcontent/EN/ALL/?uri=JOIN:2020:18:FIN.
2021/2568(RSP), https://www.europarl.europa.eu/doceo/document/TA-9-20210286_EN.html.
Conference on the Future of Europe – Report on the Final Outcome, May 2022, Proposal
28(2). The Conference was held Between April 2021 and May 2022. It was a unique,citizen-led exercise of deliberative democracy at the pan-European level, involving
thousands of European citizens as well as political actors, social partners, civil society
representatives and key stakeholders.

11726/23
ANNEX

JAI.2

EB/es

7

LIMITEEN(6)To increase the overall level of cybersecurity of all products with digital elements placed on
the internal market, it is necessary to introduce objective-oriented and technology-neutral
essential cybersecurity requirements for these products that apply horizontally.

(7)

Under certain conditions, all products with digital elements integrated in or connected to alarger electronic information system can serve as an attack vector for malicious actors. As aresult, even hardware and software considered as less critical can facilitate the initial
compromise of a device or network, enabling malicious actors to gain privileged access to asystem or move laterally across systems. Manufacturers should therefore ensure that allconnectable products with digital elements are designed and developed in accordance withessential requirements laid down in this Regulation. This includes both products that can beconnected physically via hardware interfaces and products that are connected logically, suchas via network sockets, pipes, files, application programming interfaces or any other types ofsoftware interface. As cybersecurity threats can propagate through various products withdigital elements before reaching a certain target, for example by chaining together multiple
vulnerability exploits, manufacturers should also ensure the cybersecurity of those productsthat are only indirectly connected to other devices or networks.

(8)

By setting cybersecurity requirements for placing on the market products with digitalelements, the cybersecurity of these products for consumers and for businesses alike will beenhanced. This also includes requirements for placing on the market consumer products withdigital elements intended for vulnerable consumers, such as toys and baby monitors.
Similarly the products with digital elements listed in Annex III and Annex IIIa to thisRegulation are also relevant for consumer products. The stricter conformity
assessment procedure that these products are required to comply with will contributeto prevent negative impacts of the exploitation of potential cybersecurity
vulnerabilities on consumers. For instance, products with digital elements listed in
Annex III and Annex IIIa, such as microprocessors, microcontrollers and general
purpose operating systems, will typically be components that play an essential role forthe cybersecurity of consumer products, including smart home products with safetyfunctionalities, such as door locks and alarm systems, connected products for children,
including toys and baby monitors, and wearable technology and other connected
health devices.

11726/23
ANNEX

JAI.2

EB/es

8

LIMITEEN

(9)This Regulation ensures a high level of cybersecurity of products with digital elements. It
does not regulate services, such as Software-as-a-Service (SaaS), except for applies toremote data processing solutions relating to a product with digital elements, understooddefined as any data processing at a distance for which the software or hardware is designed
and developed by the manufacturer of the product concerned or under the responsibility ofthat manufacturer, and the absence of which would prevent such a product with digitalelements from performing one of its functions. Software-as-a-Service (SaaS) solutions
constitute remote data processing solutions within the meaning of this Regulation only
if they meet that definition. For example, websites that do not support the functionalityof a product with digital elements, or cloud services designed and developed outside theresponsibility of a manufacturer of a product with digital elements are not in the scopeof this Regulation.[Directive (EU) 2022/2555XXX/XXXX (NIS2)] puts in placecybersecurity and incident reporting requirements for essential and important entities, suchas critical infrastructure, with a view to increasing the resilience of the services they provide.
[Directive (EU) 2022/2555XXX/XXXX (NIS2)] applies to cloud computing services andcloud service models, such as SaaS. All entities providing cloud computing services in theUnion that meet or exceed the threshold for which qualify as medium-sized enterprises
under Article 2 of the Annex to Commission Recommendation 2003/361/EC9, or exceed
the ceilings for medium-sized enterprises provided for in paragraph 1 of that Article,
fall in the scope of that Directive.

9

Commission Recommendation 2003/361/EC of 6 May 2003 concerning the definition of
micro, small and medium-sized enterprises (OJ L 124, 20.5.2003, p. 36).

11726/23
ANNEX

JAI.2

EB/es

9

LIMITEEN(9a)The definition of products with digital elements also includes remote data processing
solutions to ensure that such products are adequately secured in their entirety by their
manufacturers, irrespective of whether data is processed or stored locally on the user’s
device or remotely by the manufacturer. The processing or storage at a distance iscovered only in so far as necessary for a product with digital elements to perform its
functions. This could for instance be the case where a hardware device requires accessto an application programming interface or a database developed by the
manufacturer. For example, many smart home devices are designed to communicate
with a cloud service provided by the manufacturer, which enables users to control andmonitor the devices at a distance using a mobile application. In such case, the cloudservice is therefore in the scope of this Regulation as a remote data processing solution.
The requirements concerning the remote data processing solutions under the scope of
this Regulation do not therefore entail technical, operational and organisational
measures aimed at managing the risks posed to the security of their network andinformation systems as a whole.

11726/23
ANNEX

JAI.2

EB/es

10

LIMITEEN

(9b)In line with the objective of this Regulation to remove obstacles to the free movementof products with digital elements, Member States should not impede, for the matters
covered by this Regulation, the making available on the market of products withdigital elements which comply with this Regulation. Therefore, for matters harmonisedby this Regulation, Member States cannot impose further cybersecurity requirements
for the making available on the market of products with digital elements. Any entity
can however establish additional requirements to those laid down by this Regulation
for the procurement or use of those products for their specific purposes and cantherefore choose to use products with digital elements that meet stricter or more
specific cybersecurity requirements than those applicable for the making available on
the market under this Regulation. Furthermore, Directive (EU) 2022/2555 sets out
cybersecurity risk-management measures for essential and important entities that
could entail supply chain security measures that require the use of products withdigital elements meeting stricter cybersecurity requirements than those laid down by
this Regulation. In line with Directive (EU) 2022/2555 and its minimum harmonisation
principle, Member States may therefore impose additional or stricter cybersecurity
requirements for the use of ICT products by essential or important entities under thescope of that Directive in order to ensure a higher level of cybersecurity, provided thatsuch requirements are consistent with Member States’ obligations laid down in Union
law. Matters not covered by this Regulation can include non-technical factors relating
to products with digital elements and the manufacturers thereof. Member States may
therefore lay down national measures, including restrictions on products with digitalelements or suppliers of such products, that take account of non-technical factors.
National measures relating to such factors must comply with Union law.

11726/23
ANNEX

JAI.2

EB/es

11

LIMITEEN(9c)This Regulation should be without prejudice to the Member States’ prerogatives totake measures safeguarding national security, in compliance with Union law. Member
States should be able to subject products with digital elements that will be used formilitary, defence or national security purposes, to additional measures.

(10)

In order not to hamper innovation or research, free and open-source software developed or
supplied outside the course of a commercial activity should not be covered by thisRegulation. This is in particular the case for software, including its source code andmodified versions, that is openly shared and freely accessible, usable, modifiable andredistributable. In the context of software,a commercial activity might be characterized not
only by charging a price for a product, but also by charging a price for technical support
services, by providing a software platform through which the manufacturer monetises otherservices, or by the use of personal data for reasons other than exclusively for improving thesecurity, compatibility or interoperability of the software.
This Regulation applies only to products with digital elements made available on themarket, hence supplied for distribution or use on the Union market in the course of acommercial activity. The supply in the course of a commercial activity might becharacterized not only by charging a price for a product, but also by charging a pricefor technical support services when this does not serve only the recuperation of actual
costs or pursues a profit or the intention to monetise, by providing a software platform
through which the manufacturer monetises other services, or by requiring as acondition for use, the processing of personal data for reasons other than exclusively for
improving the security, compatibility or interoperability of the software. The
circumstances under which the product has been developed, or how the development
has been financed should not be taken into account when determining the commercial
or non-commercial nature of that activity. Free and open-source software isunderstood as free software that is openly shared and freely accessible, usable,
modified versions and redistributable, and which includes its source code and modified
versions. Free and open-source software is developed, maintained, and distributed
openly, including via online platforms.

11726/23
ANNEX

JAI.2

EB/es

12

LIMITEENA package manager, code host or collaboration platform that facilitates the development
and supply of software is only considered to be a distributor if they make this software
available on the market and hence supply it for distribution or use on the Union market
in the course of a commercial activity. Taking account of the above-mentioned elements
determining the commercial nature of an activity, this Regulation should only apply tofree and open-source software that is supplied in the course of a commercial activity.
Products provided as part of the delivery of a service for which a fee is charged solely torecover the actual costs directly related to the operation of that service such as may be
the case with certain products provided by public administration entities, should not be
considered on those grounds alone a commercial activity for the purposes of thisRegulation. Furthermore, products with digital elements which are developed or
modified by a public administration entity exclusively for its own use should not be
considered as made available on the market as defined by this Regulation.
(11)

A secure Internet is indispensable for the functioning of critical infrastructures and forsociety as a whole. [Directive (EU) 2022/2555XXX/XXXX (NIS2)] aims at ensuring a highlevel of cybersecurity of services provided by essential and important entities, including
digital infrastructure providers that support core functions of the open Internet, ensure
Internet access and Internet services. It is therefore important that the products with digitalelements necessary for digital infrastructure providers to ensure the functioning of theInternet are developed in a secure manner and that they comply with well-establishedInternet security standards. This Regulation, which applies to all connectable hardware andsoftware products, also aims at facilitating the compliance of digital infrastructure providers
with the supply chain requirements under the [Directive (EU) 2022/2555XXX/XXXX(NIS2)] by ensuring that the products with digital elements that they use for the provision of
their services are developed in a secure manner and that they have access to timely security
updates for such products.

11726/23
ANNEX

JAI.2

EB/es

13

LIMITEEN

(11a) One of the most important measures for users to take in order to protect their productswith digital elements from cyberattacks is to install the latest available security updates
as soon as possible. Manufacturers should therefore design their products and create
processes to ensure that products with digital elements include functions that enable
the notification, distribution, download and installation of security updates
automatically. They should also provide the possibility to approve the download andinstallation of the security updates as a final step, as well as clear instructions on how
users can opt out of automatic updates. The requirements relating to automatic
updates laid down in Annex I of this Regulation are not applicable to products
primarily intended to be integrated as components into other products. They also do
not apply to products with digital elements for which users would not reasonably
expect automatic updates, including products with digital elements intended to be usedin professional ICT-networks, and especially in critical and industrial environments
where an automatic update could cause interference with operations. Irrespective ofwhether a product with digital elements is designed to receive automatic updates ornot, its manufacturer should inform users about vulnerabilities and make security
updates available without delay.

11726/23
ANNEX

JAI.2

EB/es

14

LIMITEEN

(12)Regulation (EU) 2017/745 of the European Parliament and of the Council10 lays down rules
on medical devices and Regulation (EU) 2017/746 of the European Parliament and of theCouncil11 lays down rules on in vitro diagnostic medical devices. Both Regulations address
cybersecurity risks and follow particular approaches that are also addressed in thisRegulation. More specifically, Regulations (EU) 2017/745 and (EU) 2017/746 lay down
essential requirements for medical devices that function through an electronic system or thatare software themselves. Certain non-embedded software and the whole life cycle approach
are also covered by those Regulations. These requirements mandate manufacturers todevelop and build their products by applying risk management principles and by setting out
requirements concerning IT security measures, as well as corresponding conformity
assessment procedures. Furthermore, specific guidance on cybersecurity for medical devices
is in place since December 2019, providing manufacturers of medical devices, including invitro diagnostic devices, with guidance on how to fulfil all the relevant essential
requirements of Annex I to those Regulations with regard to cybersecurity.12 Products withdigital elements to which either of those Regulations apply should therefore not be subject tothis Regulation.

10

11

12

Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017
on medical devices, amending Directive 2001/83/EC, Regulation (EC) No 178/2002 andRegulation (EC) No 1223/2009 and repealing Council Directives 90/385/EEC and93/42/EEC (OJ L 117, 5.5.2017, p. 1).
Regulation (EU) 2017/746 of the European Parliament and of the Council of 5 April 2017
on in vitro diagnostic medical devices and repealing Directive 98/79/EC and Commission
Decision 2010/227/EU (OJ L 117, 5.5.2017, p. 176).
MDCG 2019-16, endorsed by the Medical Device Coordination Group (MDCG) establishedby Article 103 of Regulation (EU) 2017/745.

11726/23
ANNEX

JAI.2

EB/es

15

LIMITEEN

(13)Regulation (EU) 2019/2144 of the European Parliament and of the Council13 establishes
requirements for the type-approval of vehicles, and of their systems and components,
introducing certain cybersecurity requirements, including on the operation of a certified
cybersecurity management system, on software updates, covering organisations policies andprocesses for cyber risks related to the entire life cycle of vehicles, equipment and services
in compliance with the applicable United Nations regulations on technical specifications andcybersecurity14, and providing for specific conformity assessment procedures. In the area ofaviation, the principal objective of Regulation (EU) 2018/1139 of the European Parliamentand of the Council15 is to establish and maintain a high uniform level of civil aviation safety
in the Union. It creates a framework for essential requirements for airworthiness foraeronautical products, parts, equipment, including software that take into accountobligations to protect against information security threats. Products with digital elements towhich Regulation (EU) 2019/2144 applies and those products certified in accordance with
Regulation (EU) 2018/1139 are therefore not subject to the essential requirements andconformity assessment procedures set out in this Regulation., The certification process under
Regulation (EU) 2018/1139 ensures the level of assurance aimed for by this Regulation.

13

14
15

Regulation (EU) 2019/2144 of the European Parliament and of the Council of 27 November
2019 on type-approval requirements for motor vehicles and their trailers, and systems,
components and separate technical units intended for such vehicles, as regards their generalsafety and the protection of vehicle occupants and vulnerable road users, amending
Regulation (EU) 2018/858 of the European Parliament and of the Council and repealing
Regulations (EC) No 78/2009, (EC) No 79/2009 and (EC) No 661/2009 of the European
Parliament and of the Council and Commission Regulations (EC) No 631/2009, (EU) No
406/2010, (EU) No 672/2010, (EU) No 1003/2010, (EU) No 1005/2010, (EU) No
1008/2010, (EU) No 1009/2010, (EU) No 19/2011, (EU) No 109/2011, (EU) No 458/2011,(EU) No 65/2012, (EU) No 130/2012, (EU) No 347/2012, (EU) No 351/2012, (EU) No
1230/2012 and (EU) 2015/166 (OJ L 325, 16.12.2019, p. 1).
UN Regulation No 155 – Uniform provisions concerning the approval of vehicles withregard to cybersecurity and cybersecurity management system [2021/387].
Regulation (EU) 2018/1139 of the European Parliament and of the Council of 4 July 2018
on common rules in the field of civil aviation and establishing a European Union Aviation
Safety Agency, and amending Regulations (EC) No 2111/2005, (EC) No 1008/2008, (EU)No 996/2010, (EU) No 376/2014 and Directives 2014/30/EU and 2014/53/EU of theEuropean Parliament and of the Council, and repealing Regulations (EC) No 552/2004 and(EC) No 216/2008 of the European Parliament and of the Council and Council Regulation(EEC) No 3922/91 (OJ L 212, 22.8.2018, p. 1).

11726/23
ANNEX

JAI.2

EB/es

16

LIMITEEN

(14)This Regulation lays down horizontal cybersecurity rules which are not specific to sectors or
certain products with digital elements. Nevertheless, sectoral or product-specific Union rules
could be introduced, laying down requirements that address all or some of the risks coveredby the essential requirements laid down by this Regulation. In such cases, the application ofthis Regulation to products with digital elements covered by other Union rules laying down
requirements that address all or some of the risks covered by the essential requirements set
out in Annex I of this Regulation may be limited or excluded where such limitation or
exclusion is consistent with the overall regulatory framework applying to those products andwhere the sectoral rules achieve at least the same level of protection as the one provided forby this Regulation. The Commission is empowered to adopt delegated acts to amend thisRegulation by identifying such products and rules. For existing Union legislation where such
limitations or exclusions should apply, this Regulation contains specific provisions to clarify
its relation with that Union legislation.

(15)

Delegated Regulation (EU) 2022/30 specifies that the essential requirements set out in
Article 3(3), point (d) (network harm and misuse of network resources), point (e) (personal
data and privacy) and point (f) (fraud) of Directive 2014/53/EU apply to certain radio
equipment. [Commission implementation decision XXX/2022 on a standardisation request
to the European Standardisation Organisations] lays down requirements for the developmentof specific standards further specifying how these three essential requirements should be
addressed. The essential requirements laid down by this Regulation include all the elementsof the essential requirements referred to in Article 3(3), points (d), (e) and (f) of Directive
2014/53/EU. Further, the essential requirements laid down in this Regulation are alignedwith the objectives of the requirements for specific standards included in that standardisation
request. Therefore, if the Commission repeals or amends Delegated Regulation (EU)2022/30 with the consequence that it ceases to apply to certain products subject to thisRegulation, the Commission and the European Standardisation Organisations should take
into account the standardisation work carried out in the context of Commission
Implementing Decision C(2022)5637 on a standardisation request for the RED DelegatedRegulation 2022/30 in the preparation and development of harmonised standards to facilitate
the implementation of this Regulation.

11726/23
ANNEX

JAI.2

EB/es

17

LIMITEEN

(16)Directive 85/374/EEC16 is complementary to this Regulation. That Directive sets out
liability rules for defective products so that injured persons can claim compensation when adamage has been caused by defective products. It establishes the principle that the
manufacturer of a product is liable for damages caused by a lack of safety in their productirrespective of fault (‘strict liability’). Where such a lack of safety consists in a lack of
security updates after placing the product on the market, and this causes damage, theliability of the manufacturer could be triggered. Obligations for manufacturers that concern
the provision of such security updates should be laid down in this Regulation.

(17)

This Regulation should be without prejudice to Regulation (EU) 2016/679 of the European
Parliament and of the Council17, including to provisions for the establishment of dataprotection certification mechanisms and of data protection seals and marks, for the purposeof demonstrating compliance of processing operations by controllers and processors withthat Regulation. Such operations could be embedded in a product with digital elements. Data
protection by design and by default, and cybersecurity in general, are key elements ofRegulation (EU) 2016/679. By protecting consumers and organisations from cybersecurity
risks, the essential cybersecurity requirements laid down in this Regulation, are also tocontribute to enhancing the protection of personal data and privacy of individuals. Synergies
on both standardisation and certification on cybersecurity aspects should be consideredthrough the cooperation between the Commission, the European Standardisation
Organisations, the European Union Agency for Cybersecurity (ENISA), the European Data
Protection Board (EDPB) established by Regulation (EU) 2016/679, and the national dataprotection supervisory authorities. Synergies between this Regulation and the Union dataprotection law should also be created in the area of market surveillance and enforcement. To
this end, national market surveillance authorities appointed under this Regulation should
cooperate with authorities supervising Union data protection law. The latter should also haveaccess to information relevant for accomplishing their tasks.

16

17

Council Directive 85/374/EEC of 25 July 1985 on the approximation of the laws,
regulations and administrative provisions of the Member States concerning liability fordefective products (OJ L 210, 7.8.85).
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016
on the protection of natural persons with regard to the processing of personal data and on thefree movement of such data, and repealing Directive 95/46/EC (General Data Protection
Regulation)( OJ L 119, 4.5.2016, p. 1).

11726/23
ANNEX

JAI.2

EB/es

18

LIMITEEN

(18)To the extent that their products with digital elements fall within the scope of thisRegulation, issuers of European Digital Identity Wallets as referred to in Article [Article
6a(2) of this Regulation and Regulation (EU) No 910/2014, as amended by Proposal for a
Regulation amending Regulation (EU) No 910/2014 as regards establishing a framework fora European Digital Identity], these products should comply with both the horizontal
essential requirements established by this Regulation and the specific security requirements
established by Article [Article 6a of Regulation (EU) No 910/2014, as amended by Proposal
for a Regulation amending Regulation (EU) No 910/2014 as regards establishing aframework for a European Digital Identity]. In order to facilitate compliance, wallet issuers
should be able to demonstrate the compliance of European Digital Identity Wallets with therequirements set out respectively in both acts by certifying their products under a European
cybersecurity certification scheme established under Regulation (EU) 2019/881 and forwhich the Commission specified via implementing act a presumption of conformity for thisRegulation, in so far as the certificate, or parts thereof, covers those requirements.

(18a) When integrating components sourced from third parties in products with digitalelements during the design and development phase, manufacturers should exercise due
diligence. The appropriate level of due diligence measures should be informed by thenature and level of the cybersecurity risk associated with the component and, for thispurpose, take into account specific factors, such as the way in which the component
contributes to the functionality of the product and the extent to which it has access todata processed by the product with digital elements. Depending on the risk, due
diligence measures could include verifying that the manufacturer of a component has
demonstrated conformity with this Regulation, verifying that a component is free fromvulnerabilities registered in publicly accessible vulnerability databases, or verifyingthat a component receives regular security updates. The vulnerability handlingobligations in this Regulation, which the manufacturers have to comply with whenplacing a product with digital elements on the market and for the expected productlifetime, apply to products with digital elements in their entirety, including to all
integrated components.

11726/23
ANNEX

JAI.2

EB/es

19

LIMITEEN

(19)Certain tasks provided for in this Regulation should be carried out by ENISA, in accordancewith Article 3(2) of Regulation (EU) 2019/881. In particular, ENISA should receive
notifications from manufacturers of actively exploited vulnerabilities contained in productswith digital elements, as well as incidents having an impact on the security of those
products. ENISA should also forward these notifications to the relevant Computer Security
Incident Response Teams (CSIRTs) or, respectively, to the relevant single points of contactof the Member States designated in accordance with Article [Article X] of Directive[Directive XXX / XXXX (NIS2)], and inform the relevant market surveillance authorities
about the notified vulnerability. On the basis of the information it gathers, ENISA should
prepare a biennial technical report on emerging trends regarding cybersecurity risks in
products with digital elements and submit it to the Cooperation Group referred to inestablished under Directive (EU) 2022/2555 [Directive XXX / XXXX (NIS2)].
Furthermore, considering its expertise and mandate, ENISA should be able to support theprocess for implementation of this Regulation. In particular, it should be able to propose
joint activities to be conducted by market surveillance authorities based on indications orinformation regarding potential non-compliance with this Regulation of products withdigital elements across several Member States or identify categories of products for which
simultaneous coordinated control actions should be organised. In exceptional circumstances,at the request of the Commission, ENISA should be able to conduct provide an analysis tosupport an evaluations in respect of specific products with digital elements that present asignificant cybersecurity risk, where an immediate intervention is required to preserve thegood functioning of the internal market.

11726/23
ANNEX

JAI.2

EB/es

20

LIMITEEN

(19a) Actively exploited vulnerabilities concern instances where a manufacturer establishes
that an attempted or successful security breach affecting its users or any other naturalof legal persons has resulted from a malicious actor making use of a flaw in one of the
products with digital elements placed on the market by the manufacturer. An example
of such a vulnerability could be the insufficient protection of a product against brute
force attacks. Risks of reporting unpatched vulnerabilities should be minimized bytechnical measures and procedural agreements. Incidents having an impact on the
security of the product with digital elements, on the other hand, refer to situations
where a cybersecurity incident affects the development, production or maintenanceprocesses of the manufacturer in such a way that it could result in an increased
cybersecurity risk for users or other persons. An example of such incident is a security
breach on the manufacturer’s network allowing unauthorised persons to introduce
malicious code into a product in development or into a release channel that provides
users with automatic updates.
(20)

Products with digital elements should bear the CE marking to indicate their conformity withthis Regulation so that they can move freely within the internal market. Member Statesshould not create unjustified obstacles to the placing on the market of products with digitalelements that comply with the requirements laid down in this Regulation and bear the CE
marking.

11726/23
ANNEX

JAI.2

EB/es

21

LIMITEEN

(21)In order to ensure that manufacturers can release software for testing purposes before
subjecting their products to conformity assessment, Member States should not prevent themaking available of unfinished software, such as alpha versions, beta versions or releasecandidates, as long as the version is only made available for the time necessary to test it andgather feedback. Manufacturers should ensure that software made available under these
conditions is only released following a risk assessment and that it complies to the extent
possible with the security requirements relating to the properties of products with digitalelements imposed by this Regulation. Manufacturers should also implement thevulnerability handling requirements to the extent possible. Manufacturers should not force
users to upgrade to versions only released for testing purposes.

(22)

In order to ensure that products with digital elements, when placed on the market, do notpose cybersecurity risks to persons and organisations, essential requirements should be set
out for such products. These essential requirements, including vulnerability
management handling requirements, apply to each individual product with digitalelements when placed on the market, irrespective of whether the product with digitalelements is manufactured as an individual unit or in series. For example, for a producttype, each individual product with digital elements should have received all security
patches or updates available to address relevant security issues at the time when it isplaced on the market. When the products are subsequently modified, by physical or digitalmeans, in a way that is not foreseen by the manufacturer and that may imply that they nolonger meet the relevant essential requirements, the modification should be considered as
substantial. For example, software updates or repairs could be assimilated to maintenance
operations provided that they do not modify a product already placed on the market in sucha way that compliance with the applicable requirements may be affected, or that the intended
use purpose for which the product has been assessed may be changed. As is the case forphysical repairs or modifications, a product with digital elements should be considered as
substantially modified by a software change where the software update modifies theoriginal intended purpose functions, type or performance of the that product and thesechanges were not foreseen in the initial risk assessment, or where the nature of the hazard
has changed or the level of risk has increased because of the software update, and the
product is made available on the market.

11726/23
ANNEX

JAI.2

EB/es

22

LIMITEEN

(22a) Where security updates, which are designed to decrease the level of risk of a productwith digital elements, do not modify the intended purpose of a product, they are notconsidered a substantial modification. For example, this could be the case where asecurity update addresses a known vulnerability, including by modifying functions or
the performance of a product with digital elements for the sole purpose of decreasing
the level of cybersecurity risk. Conversely, where feature updates modify the original
intended functions or the type or performance of a product for purposes other thanmerely decreasing the level of cybersecurity risk, they should be considered a
substantial modification, as the addition of new features typically leads to a broader
attack surface, thereby increasing the risk. For example, this could be the case where a
new input element is added to an application, requiring the manufacturer to ensure
adequate input validation. In assessing whether a feature update is considered a
substantial modification it is not relevant whether it is provided as a separate update
or in combination with a security update.
(23)

In line with the commonly established notion of substantial modification for products
regulated by Union harmonisation legislation, whenever a substantial modification occursthat may affect the compliance of a product with this Regulation or when the intended
purpose of that product changes, it is appropriate that the compliance of the product withdigital elements is verified and that, where applicable, it undergoes a new conformity
assessment. Where applicable, if the manufacturer undertakes a conformity assessment
involving a third party, changes that might lead to substantial modifications should be
notified to the third party.

11726/23
ANNEX

JAI.2

EB/es

23

LIMITEEN

(24)Refurbishing, maintaining and repairing of a product with digital elements, as defined in theRegulation [Eco-design Regulation], does not necessarily lead to a substantial modificationof the product, for instance if the intended use purpose and functionalities are not changed
and the level of risk remains unaffected. However, upgrading a product by the manufacturer
might lead to changes in the design and development of the product and therefore might
affect the intended use purpose and the compliance of the product with the requirements set
out in this Regulation.

(25)

Products

withdigitalelementsshouldbeincluded

in

Annex

III

of

this

Regulationconsidered critical if the negative impact of the exploitation of potential
cybersecurity vulnerabilities in the product can be severe due to, amongst others, thecybersecurity-related functionality or a function having a significant risk of adverse
effects in terms of its intensity and ability to disrupt, control or cause damage to a large
number of other products with digital elements through direct manipulation, such as acentral system function., or the intended use. In particular, vulnerabilities in products withdigital elements that have a cybersecurity-related functionality, such as secure elements, canlead to a propagation of security issues throughout the supply chain. The severity of the
impact of a cybersecurity incident may also increase when taking into account the intended
use of the product, such as in an industrial control setting or in the context of an essential
entity of the type referred to in Annex [Annex I] to Directive [Directive XXX/ XXXX(NIS2)], or for the performance of critical or sensitive functions, such as processing of
personal data the product primarily performs a central system function, including
network management, configuration control, virtualisation or processing of personaldata.

11726/23
ANNEX

JAI.2

EB/es

24

LIMITEEN

(26)Critical Certain categories of products with digital elements should be subject to stricter
conformity assessment procedures, while keeping a proportionate approach. For thispurpose, critical those categories of products with digital elements should be divided into
two classes, reflecting the level of cybersecurity risk linked to these categories of products.
The categories of products with digital elements listed in class I of Annex III to thisRegulation either have a cybersecurity-related functionality or a function which
carries a significant risk of adverse effects in terms of its intensity and ability to
disrupt, control or cause damage to a large number of other products with digitalelements through direct manipulation, such as a central system function. The
categories of products with digital elements listed in class II of Annex III meet boththese criteria. Cumulating these criteria indicates that a potential cyber incident
involving products in class II might lead to greater negative impacts than an incident
involving products in class I, for instance due to the nature of their cybersecurity-related
function and the performance of a function which carries a significant risk of adverse
effects, such as a central system function or intended use in sensitive environments, andtherefore should undergo a stricter conformity assessment procedure.

(27)

The categories of critical products with digital elements referred to in Annex III of thisRegulation should be understood as the products which have the core functionality of thetype that is listed in Annex III to this Regulation. For example, Annex III to this Regulation
lists products which are defined by their core functionality as general purpose
microprocessors firewalls, intrusion detection or prevention systems in class II. As aresult, general purpose microprocessors firewalls, intrusion detection or prevention
systems are subject to mandatory third-party conformity assessment. This is not the case forother products not explicitly referred to in Annex III to this Regulation which may integratea firewalls, intrusion detection or prevention systems a general purpose microprocessor.
The Commission should adopt delegated an implementing acts [by 12 months since theentry into force of this Regulation] to specify the definitions of the product categories
covered under class I and class II as set out in Annex III.

11726/23
ANNEX

JAI.2

EB/es

25

LIMITEEN

(27a) The categories of products with digital elements listed in Annex IIIa to this Regulation
have a cybersecurity-related functionality and primarily perform a central system
function or a function having the potential to disrupt, control or damage a large
number of other products with digital elements through direct manipulation.
Furthermore, those product categories are considered to be critical dependencies forentities of a type referred to in Annex I to Directive (EU) 2022/2555. The categories of
products with digital elements listed in Annex IIIa to this Regulation, due to theircriticality, already widely use various forms of certification, and are also covered by
the European Common Criteria-based cybersecurity certification scheme set out in the[Commission Implementing Regulation (EU) No …/... of XXX on the European
Common Criteria-based cybersecurity certification scheme] (EUCC). Therefore, inorder to ensure a common adequate cybersecurity protection of these products withdigital elements in the Union, it could be adequate and proportionate to subject theseproducts, by means of a delegated act, to mandatory European cybersecurity
certification where a relevant certification scheme covering those products is already inplace and an impact assessment has been carried out by the Commission. The
assessment of the potential market impact of the envisaged mandatory certification
should consider both the supply and demand side, including whether there is sufficientdemand for the products with digital elements concerned from both Member States
and users, for European cybersecurity certification to be required, as well as the
purposes for which the products are intended to be used, such as critical dependencies
by entities of a type referred to in Annex I to Directive (EU) 2022/2555. The impact
assessment should also analyse the potential effects of the mandatory certification on
the availability of those products on the internal market, as well as the supply anddemand side and the capabilities and the readiness of the Member States for the
implementation of the relevant European cybersecurity certification schemes.

11726/23
ANNEX

JAI.2

EB/es

26

LIMITEEN

(27aa) Delegated acts requiring mandatory European cybersecurity certification should
specify the products with digital elements that have the core functionality of a productcategory listed in Annex IIIa that are to be subject to mandatory certification, as wellas the assurance level required. The required assurance level should be proportionate
to the level of cybersecurity risk associated with the product with digital elements. For
instance, where the product has the core functionality of a product category listed in
Annex IIIa and is intended for the use in a sensitive or critical environment, such as
products intended for the use of entities of a type referred to in Annex I to Directive(EU) 2022/2555, it may require the highest assurance level.
(27ab) In order to ensure a common adequate cybersecurity protection in the Union of
products with digital elements that have the core functionality of a product category
listed in Annex IIIa, the Commission should also be empowered to adopt delegated acts
to amend Annex IIIa by adding further or removing categories of products with digitalelements for which the manufacturers could be required to obtain a European
cybersecurity certificate under a European cybersecurity certification scheme
pursuant to Regulation (EU) 2019/881 to demonstrate conformity with this Regulation.
A new category of products with digital elements can be added to those categories if
there is a critical dependency on it of entities of a type referred to in Annex I to
Directive (EU) 2022/2555 or, if affected by cybersecurity incidents or when containing
exploited vulnerabilities, this can lead to disruptions for critical supply chains. Whenassessing the need for adding or removing categories of products with digital elements
by means of a delegated act, the Commission may take into account whether theMember States identified at national level products with digital elements that have a
critical role for the resilience of entities of a type referred to in Annex I to Directive(EU) 2022/2555 and which increasingly face supply chain cyber attacks, with potential
serious disruptive effects. Furthermore, the Commission may take into account theoutcome of the Union level coordinated security risk assessment of critical supply
chains as per Article 22 of Directive (EU) 2022/2555.

11726/23
ANNEX

JAI.2

EB/es

27

LIMITEEN

(28)This Regulation addresses cybersecurity risks in a targeted manner. Products with digitalelements might, however, pose other safety risks, that are not related to cybersecurity. Thoserisks should continue to be regulated by other relevant Union product harmonisation
legislation. If no other Union harmonisation legislation is applicable, they should be subject
to Regulation (EU) 2023/988 of the European Parliament and of the Council18 [General
Product Safety Regulation]. Therefore, in light of the targeted nature of this Regulation, as aderogation from Article 2(1), third subparagraph, point (b), of Regulation (EU) 2023/988[General Product Safety Regulation], Chapter III, Section 1, Chapters V and VII, andChapters IX to XI of Regulation [General Product Safety Regulation] should apply to
products with digital elements with respect to safety risks not covered by this Regulation, if
those products are not subject to specific requirements imposed by other Union
harmonisation legislation as defined in within the meaning of Article 3, point (275) ofRegulation (EU) 2023/988 the General Product Safety Regulation].

18

Regulation (EU) 2023/988 of the European Parliament and of the Council of 10 May
2023 on general product safety, amending Regulation (EU) No 1025/2012 of theEuropean Parliament and of the Council and Directive (EU) 2020/1828 of theEuropean Parliament and the Council, and repealing Directive 2001/95/EC of theEuropean Parliament and of the Council and Council Directive 87/357/EEC (OJ L 135,
23.5.2023, p. 1).

11726/23
ANNEX

JAI.2

EB/es

28

LIMITEEN

(29)Products with digital elements classified as high-risk AI systems according to Article 6 ofRegulation19 [the AI Regulation] which fall within the scope of this Regulation should
comply with the essential requirements set out in this Regulation. When those high-risk AI
systems fulfil the essential requirements of this Regulation, they should be deemedcompliant with the cybersecurity requirements set out in Article [Article 15] of Regulation[the AI Regulation] in so far as those requirements are covered by the EU declaration ofconformity or parts thereof issued under this Regulation. As regards the conformity
assessment procedures relating to the essential cybersecurity requirements of a product withdigital elements covered by this Regulation and classified as a high-risk AI system, therelevant provisions of Article 43 of Regulation [the AI Regulation] should apply as a ruleinstead of the respective provisions of this Regulation. However, this rule should not result
in reducing the necessary level of assurance for critical products with digital elements
covered by this Regulation as referred to in Annex III. Therefore, by way of derogationfrom this rule, high-risk AI systems that fall within the scope of the Regulation [the AI
Regulation] and are also qualified as critical products with digital elements as referred to in
Annex III, pursuant to this Regulation and to which the conformity assessment procedure
based on internal control referred to in Annex VI of the Regulation [the AI Regulation]
applies, should be subject to the conformity assessment provisions of this Regulation in so
far as the essential requirements of this Regulation are concerned. In this case, for all theother aspects covered by Regulation [the AI Regulation] the respective provisions on
conformity assessment based on internal control set out in Annex VI to Regulation [the AI
Regulation] should apply.

19

Regulation [the AI Regulation].

11726/23
ANNEX

JAI.2

EB/es

29

LIMITEEN(30)To the extent that The machinery products falling within the scope of Regulation (EU)2023/1230 of the European Parliament and of the Council20[Machinery Regulation
proposal] are products with digital elements within the meaning of this Regulation,
manufacturers of these products should comply with both the essential requirements
established by this Regulation and which are products with digital elements within themeaning of this Regulation and for which a declaration of conformity has been issued on thebasis of this Regulation should be deemed to be in conformity with the essential health andsafety requirements set out in Regulation (EU) 2023/1230[Machinery Regulation proposal].
The essential requirements under this Regulation and certain essential requirements ofRegulation (EU) 2023/1230 the [Machinery Regulation proposal] might address similar
aspects. For instance, compliance with the essential requirements under thisRegulation could facilitate the compliance with the essential requirements related tocybersecurity regarding the protection against corruption and safety and reliability ofcontrol systems set out in sections 1.1.9 and 1.2.1 of [Annex III, of the to Regulation (EU)2023/1230 [Machinery Regulation proposal], as regards protection against corruption andsafety and reliability of control systems in so far as the compliance with those requirements
is demonstrated by the EU declaration of conformity issued under this Regulation. A
manufacturer may identify such synergies during the risk assessment process asforeseen under the [Machinery Regulation (EU) 2023/1230proposal]. Furthermore, theCommission and the European Standardisation Organisations should take into account
this Regulation in the preparation and development of harmonised standards tofacilitate the implementation of Regulation (EU) 2023/1230 the [Machinery Regulation
proposal] as regards in particular the cybersecurity aspects related to the protection
against corruption and safety and reliability of control systems set out in Sections 1.1.9
and 1.2.1 of Annex III to that Regulation [Machinery Regulation proposal].

20

Regulation (EU) 2023/1230 of the European Parliament and of the Council of 14 June
2023 on machinery and repealing Directive 2006/42/EC of the European Parliamentand of the Council and Council Directive 73/361/EEC (OJ L 165, 29.6.2023, p. 1).

11726/23
ANNEX

JAI.2

EB/es

30

LIMITEEN

(31)Regulation [European Health Data Space Regulation proposal] complements the essential
requirements laid down in this Regulation. The electronic health record systems (‘EHRsystems’) falling under the scope of Regulation [European Health Data Space Regulation
proposal] which are products with digital elements within the meaning of this Regulation
should therefore also comply with the essential requirements set out in this Regulation.
Their manufacturers should demonstrate conformity as required by Regulation [European
Health Data Space Regulation proposal]. To facilitate compliance, manufacturers may draw
up a single technical documentation containing the elements required by both legal acts. As
this Regulation does not cover SaaS as such, EHR systems offered through the SaaS
licensing and delivery model are not within the scope of this Regulation. Similarly, EHR
systems that are developed and used in-house are not within the scope of this Regulation, as
they are not placed on the market.

(32)

In order to ensure that products with digital elements are secure both at the time of theirplacing on the market as well as throughout their life-cycle, it is necessary to lay down
essential requirements for vulnerability handling and essential cybersecurity requirements
relating to the properties of products with digital elements. While manufacturers should
comply with all essential requirements related to vulnerability handling and ensure that all
their products are delivered without any known exploitable vulnerabilities, they should
determine which other essential requirements related to the product properties are relevant
for the concerned type of product. For this purpose, manufacturers should undertake anassessment of the cybersecurity risks associated with a product with digital elements to
identify relevant risks and relevant essential requirements and in order to appropriately
apply suitable harmonised standards or common specifications.

11726/23
ANNEX

JAI.2

EB/es

31

LIMITEEN

(32a) When assessing the risks associated with a product with digital elements,
manufacturers should take into account the potential systemic impact of avulnerability on consumers and organisations. Where a product with digital elements
is used only by a limited number of users or in less critical or sensitive environments,
as it is often the case with products with digital elements placed on the market by
micro and small enterprises, manufacturers should be able to consider the risk of sucha systemic impact as low.
(32aa) Where certain essential requirements are not applicable to a product with digitalelements, the manufacturer should include a clear justification in the cybersecurity
risk assessment included in the technical documentation. This could be the case wherean essential requirement would be incompatible with the nature of a product withdigital elements. For example, the intended purpose of a product may require the
manufacturer to follow widely recognised interoperability standards even if theirsecurity features are no longer considered state of the art. Similarly, other Union
legislation may require manufacturers to apply specific interoperability requirements.
This is for example the case of Commission Implementing Regulation (EU) 2019/838 on
technical specifications for vessel tracking and tracing systems and repealing
Regulation (EC) No 415/2007, which specifies how AIS transponders should
communicate with one another. Where an essential requirement is not applicable to a
product with digital elements, but the manufacturer has identified cybersecurity risks
in relation to this essential requirement, it should take measures to address those risks
by other means, for instance by limiting the intended purpose of the product to trusted
environments or by informing the users about those risks.

11726/23
ANNEX

JAI.2

EB/es

32

LIMITEEN

(33)In order to improve the security of products with digital elements placed on the internalmarket it is necessary to lay down essential requirements. These essential requirements
should be without prejudice to the EU Union level coordinated security risk assessments ofcritical supply chains established pursuant toby [Article 22X] of Directive (EU) 2022/2555[Directive XXX/XXXX(NIS2)]21, which take into account both technical and, where
relevant, non-technical risk factors, such as undue influence by a third country on suppliers.
Furthermore, it should be without prejudice to the Member States’ prerogatives to lay down
additional requirements that take account of non-technical factors for the purpose of
ensuring a high level of resilience, including those defined in Recommendation (EU)2019/534, in the Union-wide EU coordinated risk assessment of the cybersecurity of 5G
networks security and in the EU Toolbox on 5G cybersecurity agreed by the NIS
Cooperation

Group

as

referred

to

in

[

establishedunderDirective(EU) 2022/2555XXX/XXXX (NIS2)].
(33-a) For the purpose of ensuring the security of products with digital elements after theirplacing on the market, manufacturers should determine the expected product lifetime.
To that end, manufacturers should take into account the time users reasonably expect
to be able to use the product with digital elements given its functionality and intended
purpose and therefore can expect to receive security updates. In addition,
manufacturers should also be able to take into account other elements, such as relevant
Union law determining the lifetime of products with digital elements; the nature of the
product with digital elements, including the licensing terms under which it is madeavailable; the expected availability of the operating environment the product withdigital elements is intended for; the lifetime of products with digital elements offering asimilar functionality placed on the market by other manufacturers, including, whereavailable, relevant guidance provided by market surveillance authorities; as well as the
lifetime of integrated components that provide core functions and are sourced fromthird parties.

21

Directive XXX of the European Parliament and of the Council of [date] [on measures for ahigh common level of cybersecurity across the Union, repealing Directive (EU) 2016/1148(OJ L xx, date, p.x)].

11726/23
ANNEX

JAI.2

EB/es

33

LIMITEEN

(33a) To ensure that the expected product lifetime specified by manufacturers are issufficiently aligned within each category of products with digital elements, market
surveillance authorities, through the dedicated administrative cooperation group(ADCO) established by this Regulation, should consider publishing, with the support of
the Commission, statistics about the average expected product lifetime, as specified bymanufacturers, per category of products with digital elements.
(34)

To ensure that the national CSIRTs and the single point of contacts designated ascoordinators pursuant toin accordance with Article 12(1) [Article X] of Directive (EU)2022/2555 [Directive XX/XXXX (NIS2)] have an adequate overview of thevulnerabilities exploited by malitious actors in products with digital elements and areprovided with the information necessary to fulfil their tasks as set out in Directive (EU)2022/2555 and raise the overall level of cybersecurity of essential and important entities,
and to ensure the effective functioning of market surveillance authorities, manufacturers of
products with digital elements should notify to ENISA vulnerabilities that are being actively
exploited. As most products with digital elements are marketed across the entire internalmarket, any exploited vulnerability in a product with digital elements should be considered athreat to the functioning of the internal market. Manufacturers should also consider
disclosing fixed vulnerabilities to the European vulnerability database established underDirective (EU) 2022/2555 [Directive XX/XXXX (NIS2)] and managed by ENISA or under
any other publicly accessible vulnerability database, as well as machine-readable
advisories.

11726/23
ANNEX

JAI.2

EB/es

34

LIMITEEN

(35)Manufacturers should also report any incident having an impact on the security of the
product with digital elements.. Notwithstanding the incident reporting obligations in
Directive [Directive XXX/XXXX (NIS2)] for essential and important entities, it is crucial
for ENISA, the single points of contact designated by the Member States in accordance with
Article [Article X] of Directive [Directive XXX/XXXX (NIS2)] and the market surveillanceauthorities to receive information from the manufacturers of products with digital elementsallowing them to assess the security of these products. In order to ensure that users can react
quickly to incidents having an impact on the security of their products with digital elements,
manufacturers should also inform their users about any such incident and, where applicable,
about any corrective measures that the users can deploy to mitigate the impact of theincident, for example by publishing relevant information on their websites or, where the
manufacturer is able to contact the users and where justified by the risks, by reaching out tothe users directly.

(35a) In exceptional circumstances, the initial recipient of a notification should be able todecide to delay its dissemination via the single reporting platform where this can bejustified on cybersecurity related grounds and for a period of time that is strictly
necessary, in particular where manufacturers demonstrate that such a delay isjustified. The CSIRTs network should develop specifications on the terms andconditions for when cybersecurity related grounds could be applied. Examples ofcybersecurity related grounds include an ongoing coordinated vulnerability disclosure
procedure or situations in which a manufacturer is expected to provide a mitigating
measure shortly and the cybersecurity risks of an immediate dissemination via theplatform outweigh its benefits.

11726/23
ANNEX

JAI.2

EB/es

35

LIMITEEN

(35b) In order to simplify the reporting of information required under this Regulation, in
consideration of other complementary reporting requirements laid down in other
Union law, such as Directive (EU) 2022/2555, Regulation (EU) 2016/679 and Directive
2002/58/EC, as well as in order to decrease the administrative burden for entities,
Member States are encouraged to consider providing at national level single entry
points for such reporting requirements. The use of such national single entry points forthe reporting of security incidents under Regulation (EU) 2016/679 and Directive
2002/58/EC should not affect the application of the provisions of Regulation (EU)2016/679 and Directive 2002/58/EC, in particular those relating to the independence of
the authorities referred to therein. When establishing the single reporting platformreferred in this Regulation, ENISA, following the specifications of the CSIRTs
network, should also take into account the possibility for the national electronic
notification end-points referred to in this Regulation to be integrated into national
single entry points that may also integrate other notifications required by other Unionlaw.
(35c) When establishing the single reporting platform referred in this Regulation, ENISA,
following the specifications of the CSIRTs network, should analyse potential
complementarities with the European vulnerability database established in accordancewith Article 12(2) of Directive (EU) 2022/2555.

11726/23
ANNEX

JAI.2

EB/es

36

LIMITEEN

(36)Manufacturers of products with digital elements should put in place coordinatedvulnerability disclosure policies to facilitate the reporting of vulnerabilities by individuals or
entities. A coordinated vulnerability disclosure policy should specify a structured process
through which vulnerabilities are reported to a manufacturer in a manner allowing the
manufacturer to diagnose and remedy such vulnerabilities before detailed vulnerability
information is disclosed to third parties or to the public. Moreover, manufacturers should
also consider publishing their security policies in machine-readable format. Given thefact that information about exploitable vulnerabilities in widely used products with digitalelements can be sold at high prices on the black market, manufacturers of such products
should be able to use programmes, as part of their coordinated vulnerability disclosure
policies, to incentivise the reporting of vulnerabilities by ensuring that individuals or entities
receive recognition and compensation for their efforts (so-called ‘bug bounty programmes’).

(37)

In order to facilitate vulnerability analysis, manufacturers should identify and documentcomponents contained in the products with digital elements, including by drawing up asoftware bill of materials. A software bill of materials can provide those who manufacture,purchase, and operate software with information that enhances their understanding of the
supply chain, which has multiple benefits, most notably it helps manufacturers and users to
track known newly emerged vulnerabilities and risks. It is of particular importance for
manufacturers to ensure that their products do not contain vulnerable components developedby third parties.

11726/23
ANNEX

JAI.2

EB/es

37

LIMITEEN

(37a) Under the new complex business models linked to online sales, the same entity canprovide a variety of services. Depending on the nature of the services provided inrelation to a given product with digital elements, the same entity may fall withindifferent categories of business models. Where an entity provides only online
intermediation services for a given product with digital elements and is merely aprovider of an online marketplace, as defined by Article 3, point (14),[XXX]22 ofRegulation (EU) 2023/988, it would not qualify as one of the types of economic operator
defined in this Regulation. A provider of an online marketplace means a provider of anintermediary service using an online interface, which allows consumers to conclude
distance contracts with traders for the sale of products, while online interface means
any software, including a website, part of a website or an application, including mobile
applications. In case the same entity is a provider of an online marketplace and also
acts as an economic operator as defined in this Regulation for the sale of particular
products with digital elements, it would qualify also as the relevant type of economic
operator for the purposes of this Regulation. In such a case, the entity in question
would therefore have to comply with the obligations laid down in this Regulation for
the relevant type of economic operator. For instance, if the provider of the online
marketplace also distributes a product with digital elements, then, with respect to thesale of that product, it would be considered to be a distributor. Similarly, if the entity
in question sells its own branded products with digital elements, it would qualify as amanufacturer and would thus have to comply with the applicable requirements for
manufacturers. Also some entities can qualify as fulfilment service providers as definedby Article 3(11) of Regulation (EU) 2019/1020 if they offer such services. Such cases
would need to be assessed on a case-by-case basis.

11726/23
ANNEX

JAI.2

EB/es

38

LIMITEEN

(38)In order to facilitate assessment of conformity with the requirements laid down by thisRegulation, there should be a presumption of conformity for products with digital elements
which are in conformity with harmonised standards, which translate the essential
requirements of this Regulation into detailed technical specifications, and which are adopted
in accordance with Regulation (EU) No 1025/2012 of the European Parliament and of theCouncil23. Regulation (EU) No 1025/2012 provides for a procedure for objections toharmonised standards where those standards do not entirely satisfy the requirements of thisRegulation.

(39)

Regulation (EU) 2019/881 establishes a voluntary European cybersecurity certification
framework for ICT products, processes and services. European cybersecurity certification
schemes can cover products with digital elements covered by this Regulation. This
Regulation should create synergies with Regulation (EU) 2019/881. In order to facilitate theassessment of conformity with the requirements laid down in this Regulation, products withdigital elements that are certified or for which a statement of conformity has been issued
under a cybersecurity scheme pursuant to Regulation (EU) 2019/881 and which has been
identified by the Commission in an implementing act, shall be presumed to be in compliancewith the essential requirements of this Regulation in so far as the cybersecurity certificate orstatement of conformity or parts thereof cover those requirements. The need for new
European cybersecurity certification schemes for products with digital elements should beassessed in the light of this Regulation. Such future European cybersecurity certification
schemes covering products with digital elements should take into account the essential
requirements and conformity assessment procedures as set out in this Regulation andfacilitate compliance with this Regulation. For European cybersecurity certification
schemes that enter into force before the entry into force of this Regulation, further
specifications by means of implementing acts may be needed on detailed aspects of how
a presumption of conformity can apply.

23

Regulation (EU) No 1025/2012 of the European Parliament and of the Council of 25
October 2012 on European standardisation, amending Council Directives 89/686/EEC and93/15/EEC and Directives 94/9/EC, 94/25/EC, 95/16/EC, 97/23/EC, 98/34/EC, 2004/22/EC,
2007/23/EC, 2009/23/EC and 2009/105/EC of the European Parliament and of the Council
and repealing Council Decision 87/95/EEC and Decision No 1673/2006/EC of the European
Parliament and of the Council (OJ L 316, 14.11.2012, p. 12).

11726/23
ANNEX

JAI.2

EB/es

39

LIMITEENThe Commission should be empowered to specify, by means of implementing acts, underwhich conditions the European cybersecurity certification schemes that can be used todemonstrate conformity with the essential requirements set out in this Regulation.
Furthermore, in order to avoid undue administrative burden for manufacturers, whereapplicable, the Commission should specify if a cybersecurity certificate issued under such
European cybersecurity certification schemes eliminates the obligation for manufacturers tocarry out a third-party conformity assessment as provided by this Regulation forcorresponding requirements.
(40)

Upon entry into force of the implementing act setting out the [Commission Implementing
Regulation (EU) No …/... of XXX on the European Common Criteria-based cybersecurity
certification scheme] (EUCC) which concerns hardware products covered by thisRegulation, such as hardware security modules and microprocessors, the Commission may
specify, by means of an implementing act, how the EUCC provides a presumption ofconformity with the essential requirements as referred to in Annex I of this Regulation orparts thereof. Furthermore, such implementing act may specify how a certificate issued
under the EUCC eliminates the obligation for manufacturers to carry out a third-party
assessment as requested by this Regulation for corresponding requirements.

11726/23
ANNEX

JAI.2

EB/es

40

LIMITEEN(41)The current EU standardisation framework which is based on the New Approach
principles set out in Council Resolution of 7 May 1985 on a new approach to technicalharmonization and standards and on Regulation (EU) No 1025/2012 represents theframework by default to elaborate standards that provide for a presumption ofconformity with the relevant essential requirements of this Regulation. European
standards should be market-driven, take into account the public interest, as well as thepolicy objectives clearly stated in the Commission’s request to one or more European
standardisation organisations to draft harmonised standards, within a set deadline andbe based on consensus. However, Where no in the absence of relevant references toharmonised standards, are adopted or where the harmonised standards do not sufficiently
address the essential requirements of this Regulation, the Commission should be able toadopt common specifications by means of implementing acts. establishing Reasons fordeveloping such common specifications, instead of relying on harmonised standards, might
include a refusal of the standardisation request by any of the European standardisation
organisations, undue delays in the establishment of appropriate harmonised standards, or alack of compliance of developed standards with the requirements of this Regulation or witha request of the Commission. for the essential cybersecurity requirements of thisRegulation, provided that in doing so it duly respects the role and functions ofstandardisation organisations, as an exceptional fall back solution to facilitate the
manufacturer’s obligation to comply with those cybersecurity requirements, when thestandardisation process is blocked or when there are delays in the establishment ofappropriate harmonised standards. If such delay is due to the technical complexity ofthe standard in question, this should be considered by the Commission before
contemplating the establishment of common specifications.

11726/23
ANNEX

JAI.2

EB/es

41

LIMITEEN

(41a) With a view to establishing, in the most efficient way, common specifications that cover
the essential requirements of this Regulation, the Commission should involve relevant
stakeholders in the process.
(41b) Reasonable period should mean, in relation to the publication of reference toharmonised standards in the Official Journal of the European Union in accordancewith Regulation (EU) No 1025/2012, a period during which the publication in the
Official Journal of the European Union of the reference to the standard, its
corrigendum or its amendment is expected and which should not exceed one year after
the deadline for drafting a European standard set in accordance with Regulation (EU)No 1025/2012.
(41c) In order to facilitate assessment of conformity with the essential requirements laid down by
this Regulation, there should be a presumption of conformity for products with digitalelements that are in conformity with the common specifications adopted by the Commission
according to this Regulation for the purpose of expressing detailed technical specificationsof those requirements.
(41d) The application of harmonised standards or of other available means providing
presumption of conformity in relation to the essential requirements applicable to the
products with digital elements will facilitate the assessment of conformity by the
manufacturer. If the manufacturers chooses not to apply such means for certain
requirements, they have to indicate in their technical documentation how thecompliance is reached otherwise. Furthermore, the application of harmonised
standards or of other available means providing presumption of conformity by
manufacturers would facilitate the check of compliance of products with digitalelements by market surveillance authorities. Therefore, manufacturers of productswith digital elements are encouraged to apply harmonised standards or other available
means providing presumption of conformity to demonstrate conformity with theessential requirements of this Regulation.

11726/23
ANNEX

JAI.2

EB/es

42

LIMITEEN

(42)Manufacturers should draw up an EU declaration of conformity to provide information
required under this Regulation on the conformity of products with digital elements with theessential requirements of this Regulation and, where applicable, of the other relevant Union
harmonisation legislation by which the product is covered. Manufacturers may also be
required to draw up an EU declaration of conformity by other Union legislation. To ensure
effective access to information for market surveillance purposes, a single EU declaration ofconformity should be drawn up in respect of compliance with all relevant Union acts. In
order to reduce the administrative burden on economic operators, it should be possible forthat single EU declaration of conformity to be a dossier made up of relevant individual
declarations of conformity.

(43)

The CE marking, indicating the conformity of a product, is the visible consequence of awhole process comprising conformity assessment in a broad sense. The general principles
governing the CE marking are set out in Regulation (EC) No 765/2008 of the European
Parliament and of the Council24. Rules governing the affixing of the CE marking on
products with digital elements should be laid down in this Regulation. The CE marking
should be the only marking which guarantees that products with digital elements comply
with the requirements of this Regulation.

24

Regulation (EC) No 765/2008 of the European Parliament and of the Council of 9 July 2008
setting out the requirements for accreditation and repealing Regulation (EEC) No 339/93(OJ L 218, 13.8.2008, p. 30).

11726/23
ANNEX

JAI.2

EB/es

43

LIMITEEN(44)In order to allow economic operators to demonstrate conformity with the essential
requirements laid down in this Regulation and to allow market surveillance authorities toensure that products with digital elements made available on the market comply with theserequirements, it is necessary to provide for conformity assessment procedures. Decision No
768/2008/EC of the European Parliament and of the Council 25 establishes modules forconformity assessment procedures in proportion to the level of risk involved and the level of
security required. In order to ensure inter-sectoral coherence and to avoid ad-hoc variants,
conformity assessment procedures adequate for verifying the conformity of products withdigital elements with the essential requirements set out in this Regulation have been basedon those modules. The conformity assessment procedures should examine and verify bothproduct and process-related requirements covering the whole life cycle of products withdigital elements, including planning, design, development or production, testing andmaintenance of the product.

25

Decision No 768/2008/EC of the European Parliament and of the Council of 9 July 2008 on
a common framework for the marketing of products, and repealing Council Decision
93/465/EEC (OJ L 218, 13.8.2008, p. 82).

11726/23
ANNEX

JAI.2

EB/es

44

LIMITEEN

(45)As a general rule the cConformity assessment of products with digital elements that are notcovered by Annex III or IIIa of this Regulation should can be carried out by the
manufacturer under its own responsibility following the internal control procedure basedon Module A of Decision 768/2008/EC as set out in Annex VI of this Regulation. This
also applies to cases where a manufacturer chooses to not apply in whole or in part anapplicable harmonised standard, common specification or European cybersecurity
certification. The manufacturer should retains flexibility to choose a stricter conformity
assessment procedure involving a third-party. Under the internal control conformity
assessment procedure, the manufacturer ensures and declares on its sole responsibility
that the product with digital elements meets all the essential requirements set out in
Section 1 of Annex I of this Regulation and that the processes of the manufacturer
meet the essential requirements set out in Section 2 of Annex I of this Regulation. If the
product is classified as a critical product belongs to of class I, additional assurance isrequired to demonstrate conformity with the essential requirements set out in thisRegulation. The manufacturer should apply harmonised standards, common specifications or
cybersecurity certification schemes under Regulation (EU) 2019/881 which have been
identified by the Commission in an implementing act, if it wants to carry out the conformity
assessment under its own responsibility (module A). If the manufacturer does not apply suchharmonised standards, common specifications or European cybersecurity certification
schemes, the manufacturer should undergo conformity assessment involving a third party(based on Modules B and C or H). Taking into account the administrative burden on
manufacturers and the fact that cybersecurity plays an important role in the design anddevelopment phase of tangible and intangible products with digital elements, conformity
assessment procedures respectively based on modules B+C or module H of Decision
768/2008/EC have been chosen as most appropriate for assessing the compliance of criticalproducts with digital elements belonging to a category referred to in Annex III, in a
proportionate and effective manner. The manufacturer that carries out the third-party
conformity assessment can choose the procedure that suits best its design and production
process. Given the even greater cybersecurity risk linked with the use of products classified
as critical class II products, the conformity assessment should always involve a third party,
even where the product complies fully or partly with harmonised standards, common
specifications or European cybersecurity certification.

11726/23
ANNEX

JAI.2

EB/es

45

LIMITEEN

(46)While the creation of tangible products with digital elements usually requires manufacturers
to make substantial efforts throughout the design, development and production phases, thecreation of products with digital elements in the form of software almost exclusively focuses
on design and development, while the production phase plays a minor role. Nonetheless, inmany cases software products still need to be compiled, built, packaged, made available fordownload or copied onto physical media before being placed on the market. These activities
should be considered as activities amounting to production when applying the relevant
conformity assessment modules to verify the compliance of the product with the essential
requirements of this Regulation across the design, development and production phases.

(46a) In relation to small and micro enterprises, in order to ensure proportionality, it isappropriate to alleviate administrative costs without affecting the level of cybersecurity
protection of products with digital elements under the scope of this Regulation or thelevel playing field among manufacturers. Therefore, it is appropriate for theCommission to establish a simplified technical documentation form targeted at theneeds of small and micro enterprises.
(46b) In order to promote and protect innovation, it is important that the interests of SME
manufactures, in particular small and micro enterprises, including start-ups, are taken
into particular account. To this objective, Member States could develop initiatives
which are targeted at small and micro manufacturers, including on training, awarenessraising, information communication and on testing and third-party conformity
assessment activities. Translation costs related to mandatory documentation, such as
the technical documentation and the information and instructions for the user as
required by this Regulation, and communication with authorities may constitute asignificant cost for manufacturers, notably those of a smaller scale. Therefore, Member
States may consider that one of the languages determined and accepted by them for
relevant manufacturers’ documentation and for communication with manufacturer is
one which is broadly understood by the largest possible number of users.

11726/23
ANNEX

JAI.2

EB/es

46

LIMITEEN

(46c) In order to minimise the risks to implementation resulting from lack of knowledge andexpertise in the market, as well as in order to facilitate compliance of manufacturers,
notably small and micro enterprises, with their obligations laid down in thisRegulation, relevant EU funding programmes, as well as the European Cybersecurity
Competence Center and National Coordination Centres and the European Digital
Innovation Hubs established by the Commission and the Member States at national or
EU level may contribute to the implementation of this Regulation. Within theirrespective mission and fields of competence, they may provide technical and scientificsupport to small and micro manufacturers, such as for testing activities and thirdparty conformity assessment. They can also foster the deployment of tools to facilitate
the implementation of this Regulation.
(46d) Considering the costs that third-party conformity assessment may entail, funding
initiatives at Union level that seek to allievate such costs for micro and small
enterprises should be considered.
(46e) The Commission should actively support the Member States and economic operatorsin the implementation and enforcement of this Regulation. Guidance and standardised
templates can reduce costs related to familiarisation with this Regulation and related
to legal uncertainty especially for smaller companies. Such documents should be
developed on particular topics aiming at facilitating the application of this Regulation,
while paying particular attention to the needs of small and micro enterprises. The
Commission should facilitate the development of such documents and ensure theconsultation of relevant stakeholders. Similarly, market surveillance authorities may
also consider providing guidance and advice to economic operators on theimplementation of the Regulation, paying particular attention to micro and small
enterprises. In doing so, they should coordinate as appropriate through the ADCO toensure a consistent implementation of this Regulation.

11726/23
ANNEX

JAI.2

EB/es

47

LIMITEEN

(46f) Micro, small and medium-sized enterprises or ‘SMEs’ referred to in this Regulation
mean micro, small and medium-sized enterprises as defined in the Annex toRecommendation 2003/361/EC. When determining the category an enterprise falls
into, the provisions of that Annex should be applied in their entirety. Therefore, whencalculating the staff headcount and financial ceilings determining the enterprise
categories, the provisions of Article 6 of the Annex to Recommendation 2003/361/EC
on establishing the data of an enterprise in consideration of specific types ofenterprises, such as partner enterprises or linked enterprises, should also apply.
(47)

In order to carry out third-party conformity assessment for products with digital elements,
conformity assessment bodies should be notified by the national notifying authorities to theCommission and the other Member States, provided they are compliant with a set of
requirements, notably on independence, competence and absence of conflicts of interests.

(48)

In order to ensure a consistent level of quality in the performance of conformity assessmentof products with digital elements, it is also necessary to lay down requirements for notifying
authorities and other bodies involved in the assessment, notification and monitoring of
notified bodies. The system set out in this Regulation should be complemented by theaccreditation system provided for in Regulation (EC) No 765/2008. Since accreditation is an
essential means of verifying the competence of conformity assessment bodies, it should also
be used for the purposes of notification.

(48a) Conformity assessment bodies that have been accredited and notified under Union
legislation laying down similar requirements, such as a conformity assessment bodythat has been notified for a European cybersecurity certification scheme adopted as
per Regulation (EU) 2019/881 or notified under the Delegated Regulation (EU)2022/30, should be newly assessed and notified under this Regulation. However,synergies can be defined by relevant authorities regarding any overlapping
requirements in order to prevent an unnecessary financial and administrative burden
and ensure a smooth and timely notification process.

11726/23
ANNEX

JAI.2

EB/es

48

LIMITEEN

(49)Transparent accreditation as provided for in Regulation (EC) No 765/2008, ensuring thenecessary level of confidence in certificates of conformity, should be considered by thenational public authorities throughout the Union as the preferred means of demonstrating thetechnical competence of conformity assessment bodies. However, national authorities may
consider that they possess the appropriate means of carrying out that evaluation themselves.
In such cases, in order to ensure the appropriate level of credibility of evaluations carried out
by other national authorities, they should provide the Commission and the other Member
States with the necessary documentary evidence demonstrating the compliance of theconformity assessment bodies evaluated with the relevant regulatory requirements.

(50)

Conformity assessment bodies frequently subcontract parts of their activities linked to theassessment of conformity or have recourse to a subsidiary. In order to safeguard the level ofprotection required for the product with digital elements to be placed on the market, it isessential that conformity assessment subcontractors and subsidiaries fulfil the samerequirements as notified bodies in relation to the performance of conformity assessment
tasks.

(51)

The notification of a conformity assessment body should be sent by the notifying authority
to the Commission and the other Member States via the New Approach Notified and
Designated Organisations (NANDO) information system. NANDO is the electronic
notification tool developed and managed by the Commission where a list of all notified
bodies can be found.

(52)

Since notified bodies may offer their services throughout the Union, it is appropriate to givethe other Member States and the Commission the opportunity to raise objections concerninga notified body. It is therefore important to provide for a period during which any doubts orconcerns as to the competence of conformity assessment bodies can be clarified before they
start operating as notified bodies.

11726/23
ANNEX

JAI.2

EB/es

49

LIMITEEN

(53)In the interests of competitiveness, it is crucial that notified bodies apply the conformity
assessment procedures without creating unnecessary burden for economic operators. For thesame reason, and to ensure equal treatment of economic operators, consistency in thetechnical application of the conformity assessment procedures needs to be ensured. Thatshould be best achieved through appropriate coordination and cooperation between notified
bodies.

(54)

Market surveillance is an essential instrument in ensuring the proper and uniform
application of Union legislation. It is therefore appropriate to put in place a legal framework
within which market surveillance can be carried out in an appropriate manner. Rules on
Union market surveillance and control of products entering the Union market provided for in
Regulation (EU) 2019/1020 of the European Parliament and of the Council26 apply to
products with digital elements covered by this Regulation.

(55)

In accordance with Regulation (EU) 2019/1020, market surveillance authorities carry out
market surveillance in the territory of that Member State. This Regulation should notprevent Member States from choosing the competent authorities to carry out those tasks.
Each Member State should designate one or more market surveillance authorities in its
territory. Member States may choose to designate any existing or new authority to act as
market surveillance authority, including national competent authorities referred to inestablishedpursuantto

Article8[Article

X]ofDirective[Directive(EU) 2022/2555XXX/XXXX (NIS2)] or designated national cybersecurity certification
authorities referred to in Article 58 of Regulation (EU) 2019/881 or market surveillanceauthorities designated for the purpose of Directive 2014/53/EU. Economic operators
should fully cooperate with market surveillance authorities and other competent authorities.
Each Member State should inform the Commission and the other Member States of its
market surveillance authorities and the areas of competence of each of those authorities andshould ensure the necessary resources and skills to carry out the surveillance tasks relating
to this Regulation. As per Article 10(2) and (3) of Regulation (EU) 2019/1020, each
Member State should appoint a single liaison office that should be responsible, among
others, for representing the coordinated position of the market surveillance authorities and26

Regulation (EU) 2019/1020 of the European Parliament and of the Council of 20 June 2019
on market surveillance and compliance of products and amending Directive 2004/42/EC andRegulations (EC) No 765/2008 and (EU) No 305/2011 (OJ L 169, 25.6.2019, p. 1).

11726/23
ANNEX

JAI.2

EB/es

50

LIMITEEN

assisting in the cooperation between market surveillance authorities in different Member
States.
(56)

A dedicated administrative cooperation group (ADCO) should be established for theuniform application of this Regulation, pursuant to Article 30(2) of Regulation (EU)2019/1020. This ADCO should be composed of representatives of the designated market
surveillance authorities and, if appropriate, representatives of the single liaison offices. The
Commission should support and encourage cooperation between market surveillanceauthorities through the Union Product Compliance Network, established on the basis of
Article 29 of Regulation (EU) 2019/1020 and comprising representatives from each Member
State, including a representative of each single liaison office referred to in Article 10 ofRegulation (EU) 2019/1020 and an optional national expert, the chairs of ADCOs, andrepresentatives from the Commission. The Commission should participate in the meetings of
the Network, its sub-groups and this respective ADCO. It should also assist this ADCO bymeans of an executive secretariat that provides technical and logistic support. ADCO may
also invite independent experts to participate, and liaise with other ADCOs, such as theone established under Directive 2014/53/EU.

(56a) Market surveillance authorities, through the ADCO established under this Regulation,
should cooperate closely and should be able to develop guidance documents to facilitate
market surveillance activities at national level, such as by developing best practices andindicators to effectively check the compliance of products with digital elements.
(57)

In order to ensure timely, proportionate and effective measures in relation to products withdigital elements presenting a significant cybersecurity risk, a Union safeguard procedure
should be foreseen under which interested parties are informed of measures intended to betaken with regard to such products. This should also allow market surveillance authorities, incooperation with the relevant economic operators, to act at an earlier stage where necessary.
Where the Member States and the Commission agree as to the justification of a measuretaken by a Member State, no further involvement of the Commission should be required,except where non-compliance can be attributed to shortcomings of a harmonised standard.

11726/23
ANNEX

JAI.2

EB/es

51

LIMITEEN

(58)In certain cases, a product with digital elements which complies with this Regulation, may
nonetheless present a significant cybersecurity risk or pose a risk to the health or safety of
persons, to compliance with obligations under Union or national law intended to protect
fundamental rights, the availability, authenticity, integrity or confidentiality of services
offered using an electronic information system by essential entities of a the type referred toin [Annex I to Directive (EU) 2022/2555XXX/XXXX (NIS2)] or to other aspects of public
interest protection. Therefore it is necessary to establish rules which ensure mitigation of
those risks. As a result, market surveillance authorities should take measures to require theeconomic operator to ensure that the product no longer presents that risk, to recall it or towithdraw it, depending on the risk. As soon as a market surveillance authority restricts orforbids the free movement of a product in such way, the Member State should notify without
delay the Commission and the other Member States of the provisional measures, indicating
the reasons and justification for the decision. Where a market surveillance authority adopts
such measures against products presenting a risk, the Commission should enter into
consultation with the Member States and the relevant economic operator or operators
without delay and should evaluate the national measure. On the basis of the results of thisevaluation, the Commission should decide whether the national measure is justified or not.
The Commission should address its decision to all Member States and immediately
communicate it to them and the relevant economic operator or operators. If the measure isconsidered justified, the Commission may also consider adopting proposals to revise therespective Union legislation.

11726/23
ANNEX

JAI.2

EB/es

52

LIMITEEN

(59)For products with digital elements presenting a significant cybersecurity risk, and where
there is reason to believe that these are not compliant with this Regulation, or for productsthat are compliant with this Regulation, but that present other important risks, such as risks
to the health or safety of persons, fundamental rights or the provision of the services by
essential entities of athe type referred to in [Annex I toof Directive (EU) 2022/2555XXX /XXXX (NIS2)], the Commission may request ENISA to carry out an evaluation. Based onthat evaluation, the Commission may adopt, through implementing acts, corrective or
restrictive measures at Union level, including ordering withdrawal from the market, or
recalling of the respective products, within a reasonable period, commensurate with thenature of the risk. The Commission may have recourse to such intervention only in
exceptional circumstances that justify an immediate intervention to preserve the goodfunctioning of the internal market, and only where no effective measures have been taken by
surveillance authorities to remedy the situation. Such exceptional circumstances may be
emergency situations where, for example, a non-compliant product is widely made available
by the manufacturer throughout several Member States, used also in key sectors by entities
under the scope of [Directive (EU) 2022/2555XXX / XXXX (NIS2)], while containing
known vulnerabilities that are being exploited by malicious actors and for which the
manufacturer does not provide available patches. The Commission may intervene in such
emergency situations only for the duration of the exceptional circumstances and if the noncompliance with this Regulation or the important risks presented persist.

11726/23
ANNEX

JAI.2

EB/es

53

LIMITEEN

(60)In cases where there are indications of non-compliance with this Regulation in several
Member States, market surveillance authorities should be able to carry out joint activities
with other authorities, with a view to verifying compliance and identifying cybersecurity
risks of products with digital elements.

(61)

Simultaneous coordinated control actions (‘sweeps’) are specific enforcement actions bymarket surveillance authorities that can further enhance product security. Sweeps should, inparticular, be conducted where market trends, consumer complaints or other indications
suggest that certain product categories are often found to present cybersecurity risks. ENISA
should submit proposals for categories of products for which sweeps could be organised tothe market surveillance authorities, based, among others, on the information it receives ofin relation to product vulnerabilities and incidents it receives.

(62)

In order to ensure that the regulatory framework can be adapted where necessary, the power
to adopt acts in accordance with Article 290 of the Treaty on the Functioning of theEuropean Union should be delegated to the Commission in respect of updates to the lists ofcritical categories of products with digital elements in Annexes III and IIIa specifying thedefinitions of the these product categories. Power to adopt acts in accordance with that
Article should be delegated to the Commission to identify products with digital elements
covered by other Union rules which achieve the same level of protection as this Regulation,
specifying whether a limitation or exclusion from the scope of this Regulation would benecessary as well as the scope of that limitation, if applicable. Power to adopt acts inaccordance with that Article should also be delegated to the Commission in respect of thepotential mandating of certification of certain highly critical products with digital elements
based on criticality crieria set out in this Regulation and an impact assessment, as well as
for specifying the minimum content of the EU declaration of conformity and supplementing
the elements to be included in the technical documentation. It is of particular importance that
the Commission carry out appropriate consultations during its preparatory work, including at
expert level, and that those consultations be conducted in accordance with the principles laid
down in the Inter-institutional Agreement of 13 April 2016 on Better Law-Making27. In
particular, to ensure equal participation in the preparation of delegated acts, the European
Parliament and the Council receive all documents at the same time as Member States’27

OJ L 123, 12.5.2016, p. 1.

11726/23
ANNEX

JAI.2

EB/es

54

LIMITEEN

experts, and their experts systematically have access to meetings of Commission expert
groups dealing with the preparation of delegated acts.
(63)

In order to ensure uniform conditions for the implementation of this Regulation,
implementing powers should be conferred on the Commission to: specify the definitions of
the categories of products with digital elements listed in Annexes III and IIIa, specify
the format and elements of the software bill of materials and the format of the informationand instructions referred to in Annex II, specify further the type of information, format
and procedure of the notifications on actively exploited vulnerabilities and incidents having
an impact on the security of products with digital elements submitted to ENISA by the
manufacturers, establish common specifications covering technical requirements thatprovide a means to comply with the essential requirements set out in Annex I, specify
the European cybersecurity certification schemes adopted pursuant to Regulation (EU)2019/881 that can be used to demonstrate conformity with the essential requirements orparts thereof fore as set out in Annex I of to this Regulation and related conformity
assessment procedures, adopt common specifications in respect of the essential
requirements set out in Annex I, lay down technical specifications for pictograms or any
other marks related to the security of the products with digital elements, and mechanisms topromote their use, decide on corrective or restrictive measures at Union level in exceptional
circumstances which justify an immediate intervention to preserve the good functioning of
the internal market. Those powers should be exercised in accordance with Regulation (EU)No 182/2011 of the European Parliament and of the Council28.

(64)

In order to ensure trustful and constructive cooperation of market surveillance authorities atUnion and national level, all parties involved in the application of this Regulation should
respect the confidentiality of information and data obtained in carrying out their tasks.

28

Regulation (EU) No 182/2011 of the European Parliament and of the Council of 16
February 2011 laying down the rules and general principles concerning mechanisms forcontrol by the Member States of the Commission's exercise of implementing powers (OJ L
55, 28.2.2011, p.13).

11726/23
ANNEX

JAI.2

EB/es

55

LIMITEEN

(65)In order to ensure effective enforcement of the obligations laid down in this Regulation,
each market surveillance authority should have the power to impose or request theimposition of administrative fines. Maximum levels for administrative fines to be provided
for in national laws for non-compliance with the obligations laid down in this Regulation
should therefore be established. When deciding on the amount of the administrative fine ineach individual case, all relevant circumstances of the specific situation should be taken into
account and as a minimum those explicitly established in this Regulation, including whether
administrative fines have been already applied by other market surveillance authorities tothe same operator for similar infringements. Such circumstances can be either aggravating,in situations where the infringement by the same operator persists on the territory of otherMember States than the one where an administrative fine has already been applied, or
mitigating, in ensuring that any other administrative fine considered by another market
surveillance authority for the same economic operator or the same type of breach should
already take account, along with other relevant specific circumstances, of a penalty and thequantum thereof imposed in other Member States. In all such cases, the cumulative
administrative fine that could be applied by market surveillance authorities of several
Member States to the same economic operator for the same type of infringement should
ensure the respect of the principle of proportionality.

(66)

Where administrative fines are imposed on persons that are not an undertaking, thecompetent authority should take account of the general level of income in the Member Stateas well as the economic situation of the person when considering the appropriate amount of
the fine. It should be for the Member States to determine whether and to what extent publicauthorities should be subject to administrative fines.

11726/23
ANNEX

JAI.2

EB/es

56

LIMITEEN

(67)

In its relationships with third countries, the EU endeavours to promote international trade in
regulated products. A broad variety of measures can be applied in order to facilitate trade,including several legal instruments such as bilateral (inter-governmental) Mutual
Recognition Agreements (MRAs) for conformity assessment and marking of regulated
products. MRAs are established between the Union and third countries, which are on acomparable level of technical development and have a compatible approach concerning
conformity assessment. These agreements are based on the mutual acceptance of certificates,
marks of conformity and test reports issued by the conformity assessment bodies of either
party in conformity with the legislation of the other party. Currently MRAs are in place forseveral countries. The agreements are concluded in a number of specific sectors, whichmight vary from one country to another. In order to further facilitate trade, and recognisingthat supply chains of products with digital elements are global, MRAs concerning
conformity assessment may be concluded for products regulated under this Regulation by
the Union in accordance with Article 218 TFEU. Cooperation with partner countries is also
important, in order to strengthen cyber resilience globally, as in the long term this willcontribute to a strengthened cybersecurity framework both within and outside of the EU.

(67a) Consumers should be entitled to enforce their rights in relation to the obligations
imposed on economic operators under this Regulation through representative actionsin accordance with Directive (EU) 2020/1828 of the European Parliament and of theCouncil29. For that purpose, this Regulation should provide that Directive (EU)2020/1828 is applicable to the representative actions concerning infringements of thisRegulation that harm or can harm the collective interests of consumers. Annex I tothat Directive should therefore be amended accordingly. It is for the Member States toensure that that amendment is reflected in their transposition measures adopted inaccordance with that Directive, although the adoption of national transposition
measures in that regard is not a condition for the applicability of that Directive to those
representative actions. The applicability of that Directive to the representative actions
brought against infringements by economic operators of provisions of this Regulationthat harm or can harm the collective interests of consumers should start from the dateof application of this Regulation.
29

Directive (EU) 2020/1828 of the European Parliament and of the Council of 25
November 2020 on representative actions for the protection of the collective interests ofconsumers and repealing Directive 2009/22/EC (OJ L 409, 4.12.2020, p. 1).

11726/23
ANNEX

JAI.2

EB/es

57

LIMITEEN(68)The Commission should periodically review this Regulation, in consultation with interested
parties, in particular with a view to determining the need for modification in the light ofchanges to societal, political, technological or market conditions.

(69)

Economic operators should be provided with a sufficient time to adapt to the requirementsof this Regulation. This Regulation should apply [24 36 months] from its entry into force,with the exception of the reporting obligations concerning actively exploited vulnerabilities
and incidents having an impact on the security of products with digital elements, whichshould apply [12 24 months] from the entry into force of this Regulation.

(70)

Since the objective of this Regulation cannot be sufficiently achieved by the Member States
but can rather, by reason of the effects of the action, be better achieved at Union level, theUnion may adopt measures, in accordance with the principle of subsidiarity as set out in
Article 5 of the Treaty on European Union. In accordance with the principle ofproportionality as set out in that Article, this Regulation does not go beyond what isnecessary in order to achieve that objective.

(71)

The European Data Protection Supervisor was consulted in accordance with Article 42(1) ofRegulation (EU) 2018/1725 of the European Parliament and of the Council30 and delivered
itsan opinion on 9 November 202231,

30

31Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October
2018 on the protection of natural persons with regard to the processing of personal data by
the Union institutions, bodies, offices and agencies and on the free movement of such data,
and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295,
21.11.2018, p. 39).
OJ C 452, 29.11.2022, p. 23.

11726/23
ANNEX

JAI.2

EB/es

58

LIMITEENHAVE ADOPTED THIS REGULATION:

CHAPTER I
GENERAL PROVISIONS
Article 1
Subject matter
This Regulation lays down:(a)rules for the placing on making available on the market of products with digital elements toensure the cybersecurity of such products;(b)essential requirements for the design, development and production of products with digitalelements, and obligations for economic operators in relation to these products with respect tocybersecurity;(c )essential requirements for the vulnerability handling processes put in place by manufacturers toensure the cybersecurity of products with digital elements during the whole life cycle, andobligations for economic operators in relation to these processes;(d)rules on market surveillance and enforcement of the above-mentioned rules andrequirements.
Article 2
Scope

1.

This Regulation applies to products with digital elements whose intended or reasonably
foreseeable use includes a direct or indirect logical or physical data connection to a device or
network.

11726/23
ANNEX

JAI.2

EB/es

59

LIMITEEN2.

This Regulation does not apply to products with digital elements to which the following
Union acts apply:

3.

(a)

Regulation (EU) 2017/745;(b)Regulation (EU) 2017/746;(c )Regulation (EU) 2019/2144.

This Regulation does not apply to products with digital elements that have been certified inaccordance with Regulation (EU) 2018/1139.

3a.

This Regulation does not apply to equipment that falls within the scope of Directive
2014/90/EU of the European Parliament and of the Council32.

4.

The application of this Regulation to products with digital elements covered by other Union
rules laying down requirements that address all or some of the risks covered by the essential
requirements set out in Annex I may be limited or excluded, where:(a)such limitation or exclusion is consistent with the overall regulatory framework
applying to those products; and(b)the sectoral rules achieve the same or a higher level of protection as the one
provided for by this Regulation.

The Commission is empowered to adopt delegated acts in accordance with Article 50 toamend this Regulation specifying whether such limitation or exclusion is necessary, theconcerned products and rules, as well as the scope of the limitation, if relevant.

32

Directive 2014/90/EU of the European Parliament and of the Council of 23 July 2014
on marine equipment and repealing Council Directive 96/98/EC (OJ L 257, 28.8.2014,
p. 146).

11726/23
ANNEX

JAI.2

EB/es

60

LIMITEEN

4a.

This Regulation does not apply to components that are exclusively manufactured asspare parts to replace identical components and are supplied by the manufacturer of theoriginal product with digital elements following the same development and production
processes as the original product.

5.

This Regulation does not apply to products with digital elements developed or modified
exclusively for national security, public security, defence or military purposes or to products
specifically designed to process classified information.
Article 3
Definitions

For the purposes of this Regulation, the following definitions apply:(1)‘product with digital elements’ means any software or hardware product and including its
remote data processing solutions, including and software or hardware components to be placedon the market separately;(2)‘remote data processing’ means any data processing at a distance for which the software or
hardware is designed and developed by the manufacturer or under the responsibility of the
manufacturer, and the absence of which would prevent the product with digital elementsfrom performing one of its functions;(3)‘critical product with digital elements’ means a product with digital elements that presents acybersecurity risk in accordance with the criteria laid down in Article 6(2) and whose corefunctionality is set out in Annex III;

(4)‘highly critical product with digital elements’ means a product with digital elements that
presents a cybersecurity risk in accordance with the criteria laid down in Article 6(5);(5)‘operational technology’ means programmable digital systems or devices that interact with thephysical environment or manage devices that interact with the physical environment;

11726/23
ANNEX

JAI.2

EB/es

61

LIMITEEN(6)‘software’ means the part of an electronic information system which consists of computer
code;

(7)

‘hardware’ means a physical electronic information system, or parts thereof capable ofprocessing, storing or transmitting of digital data;(8)‘component’ means software or hardware intended for integration into an electronic
information system;(9)‘electronic information system’ means any system, including electrical or electronicequipment, capable of processing, storing or transmitting digital data;(10) ‘logical connection’ means a virtual representation of a data connection implemented
through a software interface;(11) ‘physical connection’ means any connection between electronic information systems orcomponents implemented using physical means, including through electrical, optical ormechanical interfaces, wires or radio waves;(12) ‘indirect connection’ means a connection to a device or network, which does not take place
directly but rather as part of a larger system that is directly connectable to such device or
network;(13) ‘privilege’ means an access right granted to particular users or programmes to performsecurity-relevant operations within an electronic information system;(14) ‘elevated privilege’ means an access right granted to particular users or programmes toperform an extended set of security-relevant operations within an electronic information
system that, if misused or compromised, could allow a malicious actor to gain wider access to
the resources of a system or organisation;

11726/23
ANNEX

JAI.2

EB/es

62

LIMITEEN

(15) ‘endpoint’ means any device that is connected to a network and serves as an entry point tothat network;(16) ‘networking or computing resources’ means data or hardware or software functionality that isaccessible either locally or through a network or another connected device;(17) ‘economic operator’ means the manufacturer, the authorised representative, the importer, thedistributor, or any other natural or legal person who is subject to obligations in relation to
the manufacture of products or making them available on the market in accordancewith laid down by this Regulation;(18) ‘manufacturer’ means any natural or legal person who develops or manufactures productswith digital elements or has products with digital elements designed, developed or
manufactured, and markets them under his or her name or trademark, whether for payment or
free of charge;(19) ‘authorised representative’ means any natural or legal person established within the Union
who has received a written mandate from a manufacturer to act on his or her behalf in relation
to specified tasks;(20) ‘importer’ means any natural or legal person established in the Union who places on themarket a product with digital elements that bears the name or trademark of a natural or legal
person established outside the Union;(21) ‘distributor’ means any natural or legal person in the supply chain, other than the
manufacturer or the importer, that makes a product with digital elements available on theUnion market without affecting its properties;(21a) ‘consumer’ means any natural person who acts for purposes which are outside that
person’s trade, business, craft or profession;

11726/23
ANNEX

JAI.2

EB/es

63

LIMITEEN

(22) ‘placing on the market’ means the first making available of a product with digital elements on
the Union market;(23) ‘making available on the market’ means any supply of a product with digital elements for
distribution or use on the Union market in the course of a commercial activity, whether in
return for payment or free of charge;(24) ‘intended purpose’ means the use for which a product with digital elements is intended by
the manufacturer, including the specific context and conditions of use, as specified in theinformation supplied by the manufacturer in the instructions for use, promotional or sales
materials and statements, as well as in the technical documentation;(25) ‘reasonably foreseeable use’ means use that is not necessarily the intended purpose suppliedby the manufacturer in the instructions for use, promotional or sales materials andstatements, as well as in the technical documentation, but which is likely to result fromreasonably foreseeable human behaviour or technical operations or interactions;(26) ‘reasonably foreseeable misuse’ means the use of a product with digital elements in a waythat is not in accordance with its intended purpose, but which may result from reasonably
foreseeable human behaviour or interaction with other systems;(27) ‘notifying authority’ means the national authority responsible for setting up and carrying out
the necessary procedures for the assessment, designation and notification of conformity
assessment bodies and for their monitoring;(28) ‘conformity assessment’ means the process of verifying whether the essential requirements set
out in Annex I have been fulfilled;(29) ‘conformity assessment body’ means a conformity assessment body as defined in Article 2,
point (13), of Regulation (EU) No 765/2008;

11726/23
ANNEX

JAI.2

EB/es

64

LIMITEEN

(30) ‘notified body’ means a conformity assessment body designated in accordance with Article 33of this Regulation and other relevant Union harmonisation legislation;(31) ‘substantial modification’ means a change to the product with digital elements following its
placing on the market, which affects the compliance of the product with digital elementswith the essential requirements set out in Section 1 of Annex I or results in a modification to
the intended use purpose for which the product with digital elements has been assessed;(32) ‘CE marking’ means a marking by which a manufacturer indicates that a product with digitalelements and the processes put in place by the manufacturer are in conformity with theessential requirements set out in Annex I and other applicable Union harmonisation legislation
harmonising the conditions for the marketing of products (‘Union harmonisation legislation’)providing for its affixing;(32a) ‘Union harmonisation legislation’ means Union legislation listed in Annex I to
Regulation (EU) 2019/1020 and any other Union legislation harmonising the conditions
for the marketing of products to which that Regulation applies;(33) ‘market surveillance authority’ means the a market surveillance authority as defined in
Article 3, point (4), of Regulation (EU) 2019/1020;(34) ‘harmonised standard’ means a harmonised standard as defined in Article 2, point (1)(c), ofRegulation (EU) No 1025/2012;(35) ‘cybersecurity risk’ means risk as defined in Article 6 2 , point ( 9 ) , [Article X] of
Directive (EU) 2022/2555[Directive XXX/XXXX (NIS2)];(36) ‘significant cybersecurity risk’ means a cybersecurity risk which, based on its technicalcharacteristics, can be assumed to have a high likelihood of an incident that could lead to asevere negative impact, including by causing considerable material or non-material loss or
disruption;

11726/23
ANNEX

JAI.2

EB/es

65

LIMITEEN

(37) ‘software bill of materials’ means a formal record containing details and supply chain
relationships of components included in the software elements of a product with digitalelements;(38) ‘vulnerability’ means a vulnerability as defined in Article 62, point (15),[Article X] of
Directive (EU) 2022/2555[Directive XXX/XXXX (NIS2)];(38a) ‘exploitable vulnerability' means a vulnerability as defined in Article 6, point (15), of
Directive (EU) 2022/2555 that has the potential to be effectively used by an adversary
under practical operational conditions;(39) ‘actively exploited vulnerability’ means a vulnerability as defined in Article 6, point (15), of
Directive (EU) 2022/2555 for which there is reliable evidence that execution of a malicious
actor has code was performed by an actor on attempted to exploit it in a system without
permission of the system owner, irrespective of whether this attempt has been successful
or not;(40) ‘personal data’ means personal data as defined in Article 4, point (1), of Regulation (EU)2016/679.
(41) ‘recall’ means recall as defined in Article 3, point (22), of Regulation (EU) 2019/1020;(42) ‘withdrawal’ means withdrawal as defined in Article 3, point (23), of Regulation (EU)2019/1020.
(43) ’incident having an impact on the security of the product with digital elements’ means anincident as defined in Article 6, point (6), of Directive (EU) 2022/2555 which
negatively affects the ability of a manufacturer’s product with digital elements toprotect the availability, authenticity, integrity or confidentiality of data or functions.

11726/23
ANNEX

JAI.2

EB/es

66

LIMITEEN

(44) ‘micro, small and medium-sized enterprises’ or ‘SMEs’ means micro, small andmedium-sized enterprises as defined in the Annex to Recommendation 2003/361/EC;(45) ‘cybersecurity’ means cybersecurity as defined in Article 2, point (1), of Regulation (EU)2019/881.
Article 4
Free movement
1.

Member States shall not impede, for the matters covered by this Regulation, the making
available on the market of products with digital elements which comply with this Regulation.

1(a) In accordance with paragraph 1, this Regulation shall not prevent Member States fromsubjecting products with digital elements to additional cybersecurity requirements forthe procurement or use of those products for specific purposes, provided that suchrequirements are consistent with Member States’ obligations laid down in Union law.
2.

At trade fairs, exhibitions and demonstrations or similar events, Member States shall notprevent the presentation and use of a product with digital elements which does not comply
with this Regulation.

3.

Member States shall not prevent the making available of unfinished software which does notcomply with this Regulation provided that the software is only made available for a limited
period required for testing purposes and that a visible sign clearly indicates that it does notcomply with this Regulation and will not be available on the market for purposes other thantesting.

4.

Paragraph 3 does not apply to safety components as specified under other Union
harmonisation legislation.

11726/23
ANNEX

JAI.2

EB/es

67

LIMITEEN

5.

This Regulation shall not prevent Member States from subjecting products with digitalelements to additional measures when these products will be used for military, defence
or national security purposes, and such measures are necessary and proportionate forthe achievement of those purposes.

6.

The obligations laid down in this Regulation shall not entail the supply of information
the disclosure of which would be contrary to the essential interests of Member States’
national security, public security or defence.
Article 5
Requirements for products with digital elements

Products with digital elements shall only be made available on the market where:(1)

they meet the essential requirements set out in Section 1 of Annex I, under the condition thatthey are properly installed, maintained, used for their intended purpose or under conditions
which can reasonably be foreseen, and, where applicable, updated, and(2)

the processes put in place by the manufacturer comply with the essential requirements set
out in Section 2 of Annex I.
Article 6

Critical Classification of products with digital elements subject to specific conformity assessment
procedures
1.

Products with digital elements that belong to a category which is listed in Annex III shall beconsidered critical products with digital elements. Products with digital elements which havethe core functionality of a category that is listed in Annex III to this Regulation shall be
subject to the conformity assessment procedures referred to in Article 24 (2) and (3). beconsidered as falling in belonging to that category.

11726/23
ANNEX

JAI.2

EB/es

68

LIMITEEN1a.

The Ccategories of critical products with digital elements referred to in paragraph 1 shallbe are divided into class I and class II as set out in Annex III, reflecting the level ofcybersecurity risk related to these products. The categories of products with digitalelements listed in class I of Annex III meet one of the following criteria:(a)the cybersecurity-related functionality of the product with digital elements performs
primarily functions critical to the cybersecurity of other products, networks orservices, including securing authentication and access, intrusion prevention anddetection, endpoint security or network protection;(b)

the product with digital elements performs a function which carries a significant
risk of adverse effects in terms of its intensity and ability to disrupt, control orcause damage to a large number of other products or to the health and safety of alarge number of individuals through direct manipulation, such as a central system
function, including network management, configuration control, virtualisation,
processing of personal data.

The categories of products with digital elements listed in class II of Annex III meet bothcriteria referred to in points (a) and (b) of this paragraph.
2.

The Commission is empowered to adopt delegated acts in accordance with Article 50 toamend Annex III by including in the list within each class of the categories of criticalproducts with digital elements a new category and specifying its definition, moving acategory of products from one class to the other or withdrawing an existing one from that
list. When assessing the need to amend the list in Annex III, the Commission shall take into
account the cybersecurity-related functionalities or the level function and the level ofcybersecurity risk posed by cybersecurity risk related to the category of the products withdigital elements as set out by the criteria referred to in paragraph 2 1a. In determining thelevel of cybersecurity risk, one or several of the following criteria shall be taken into account.:(a)the cybersecurity-related functionality of the product with digital elements, and whether
the product with digital elements has at least one of following attributes:

11726/23
ANNEX

JAI.2

EB/es

69

LIMITEEN(i)it is designed to run with elevated privilege or manage privileges;(ii)

it has direct or privileged access to networking or computing resources;(iii) it is designed to control access to data or operational technology;(iv) it performs a function critical to trust, in particular security functions such as
network control, endpoint security, and network protection.
(b)

the intended use in sensitive environments, including in industrial settings or byessential entities of the type referred to in the Annex [Annex I] to the Directive[Directive XXX/XXXX (NIS2)];(c)the intended use of performing critical or sensitive functions, such as processing of
personal data;(d)the potential extent of an adverse impact, in particular in terms of its intensity and its
ability to affect a plurality of persons;(e)the extent to which the use of products with digital elements has already caused material
or non-material loss or disruption or has given rise to significant concerns in relation to
the materialisation of an adverse impact.

3.

By … [18 months after the date of entry into force of this Regulation], tThe Commission
is empowered to shall adopt an delegated implementing act in accordance with Article 50 tosupplement this Regulation by specifying the definitions of the product categories of
products with digital elements under class I and class II as set out in Annex III and thedefinitions of the categories of products with digital elements set out in Annex IIIa. The
delegated act shall be adopted [by 12 months since the entry into force of this Regulation.
That implementing act shall be adopted in accordance with the examination procedurereferred to in Article 51(2).

11726/23
ANNEX

JAI.2

EB/es

70

LIMITE

EN

4.

Critical products with digital elements shall be subject to the conformity assessment
procedures referred to in Article 24(2) and (3).
Article 6aRequired use of European cybersecurity certification schemes
1.

The Commission is empowered to adopt delegated acts in accordance with Article 50
to supplement this Regulation to determine which products with digital elements thathave the core functionality of a category that is listed in Annex IIIa to thisRegulation shall be required to obtain a European cybersecurity certificate at a
specified assurance under a European cybersecurity certification scheme adopted
pursuant to Regulation (EU) 2019/881 to demonstrate conformity with the essential
requirements set out in Annex I to this Regulation or parts thereof, provided that a
European cybersecurity certification scheme covering those categories of productswith digital elements has been adopted pursuant to Regulation (EU) 2019/881, and isavailable to manufacturers. The delegated acts shall specify the required assurance
level that shall be proportionate to the level of cybersecurity risk associated with the
products with digital elements and shall take account of their intended purpose,including their critical dependency by entities of a type referred to in Annex I to
Directive (EU) 2022/2555.
Before adopting such delegated acts and provided that a European cybersecurity
certification scheme as referred to in the first subparagraph of this paragraph isavailable, the Commission shall carry out an impact assessment analysing thepotential market impact of the envisaged measures and shall carry out consultations
with relevant stakeholders, including the European Cybersecurity Certification
Group referred to in Regulation (EU) 2019/881. The impact assessment shall also
take into account the intended purpose of the products with digital elements
considered to be subject to such measures, including the extent to which there is a
critical dependency on these products of entities of a type referred to in Annex I to
Directive (EU) 2022/2555, and include an analysis of both the supply and demand

11726/23
ANNEX

JAI.2

EB/es

71

LIMITEENside as well as the readiness and the capacity level of the Member States for the
implementation of the respective European cybersecurity certification scheme.
Where no delegated act as referred to in the first subparagraph has been adopted,
products with digital elements which have the core functionality of a category listed
in Annex IIIa shall be subject to the conformity assessment procedures referred to in
Article 24 (3).
The delegated acts referred to in the first subparagraph shall provide for an adequatetransition period for their application.
2.

The Commission is empowered to adopt delegated acts in accordance with Article 50 toamend Annex IIIa by adding or withdrawing supplement this Regulation by specifying
categories of products with digital elements for which the manufacturers shall be required toobtain a European cybersecurity certificate under a European cybersecurity certification
scheme pursuant to Regulation (EU) 2019/881 to demonstrate conformity with the essential
requirements set out in Annex I, or parts thereof. When determining such categories of
products with digital elements and the required assurance level, the Commission shall take
into account the criteria referred to in paragraph 2 of Article 6 (1a) the level ofcybersecurity risk related to the category of products with digital elements, in light of one orseveral of the criteria listed in paragraph 2, as well as in view of the assessment of whether
that category of products is and ensure that the category of products with digital elements
meet at least one of the following criteria:

11726/23
ANNEX

JAI.2

EB/es

72

LIMITEEN(a)used or the extent to which there is a critical dependency of entities of a typereferred to in Annex I to the Directive (EU) 2022/2555 on the category of productswith digital elements relied upon byof the essential entities of a the type referred to in
Annex [Annex I] to the Directive (EU) 2022/2555 [Directive XXX/ XXXX (NIS2)] or
will have potential future significance for the activities of these entities; or(b)relevant for the resilience of the overall the extent to which cybersecurity incidents
and exploited vulnerabilities concerning the category of products with digitalelements can lead to serious disruptions to critical supply chains of products withdigital elements against disruptive events across the internal market.

Before adopting such delegated acts, the Commission shall carry out an impact
assessment of the type referred to in paragraph 1.
The delegated acts referred to in the first subparagraph shall provide for an adequatetransition period for their application.

Article 7
General product safety
By way of derogation from Article 2(1), third subparagraph, point (b), of Regulation (EU) 2023/988[General Product Safety Regulation], Chapter III, Section 1, Chapters V and VII, and Chapters
IX to XI of that Regulation shall apply to products with digital elements with respect to safety
risks not covered by this Regulation where those products with digital elements are not subject tospecific requirements laid down in other Union harmonisation legislation as defined in within themeaning of [Article 3, point (27) of the General Product Safety Regulation (EU) 2023/988],
Chapter III, Section 1, Chapters V and VII, and Chapters IX to XI of Regulation [General Product
Safety Regulation] shall apply to those products with respect to safety risks not covered by thisRegulation.

11726/23
ANNEX

JAI.2

EB/es

73

LIMITEEN

Article 8
High-risk AI systems
1.

Without prejudice to the requirements relating to accuracy and robustness set out in
Article [Article 15] Products with digital elements classified as high-risk AI systems inaccordance with Article [Article 6] of Regulation [the AI Regulation], products with digitalelements which fall within the scope of this Regulation, and which are classified as highrisk AI systems pursuant to Article [Article 6] of Regulation [the AI Regulation] andfulfil the essential requirements set out in Section 1 of Annex I of this Regulation, and where
the processes put in place by the manufacturer are compliant with the essential requirements
set out in Section 2 of Annex I, shall be deemed in compliantce with the cybersecurity
requirements related to cybersecurity set out in Article [Article 15] of that Regulation [the AI
Regulation], without prejudice to the other requirements related to accuracy and robustness
included in the aforementioned Article, and in so far as the achievement of the level ofprotection required by those requirements is demonstrated by the EU declaration ofconformity issued under this Regulation. if:(a)they fulfil the essential requirements set out in Section 1 of Annex I to thisRegulation;(b)

the processes put in place by the manufacturer are compliant with the essential
requirements set out in Section 2 of Annex I to this Regulation; and(c)the achievement of the level of cybersecurity protection required under Article[Article 15] of Regulation [the AI Regulation] is demonstrated in the EU
declaration of conformity issued under this Regulation.

11726/23
ANNEX

JAI.2

EB/es

74

LIMITEEN2.

For the products with digital elements and cybersecurity requirements referred to inparagraph 1, the relevant conformity assessment procedure as required by Article [Article 43 ]of Regulation [AI Regulation] shall apply. For the purpose of that assessment, notified bodies
which are entitled competent to control the conformity of the high-risk AI systems under the
Regulation [AI Regulation] shall be also entitled competent to control the conformity of thehigh-risk AI systems which fall within the scope of this Regulation with the requirements set
out in Annex I to this Regulation, provided that the compliance of those notified bodies withthe requirements laid down in Article 29 of this Regulation have has been assessed in thecontext of the notification procedure under Regulation [AI Regulation].

3.

By way of derogation from paragraph 2, critical products with digital elements listed in
Annex III of to this Regulation, which have to apply are subject to the conformity
assessment procedures referred to in Articles 24(2)(a), 24(2)(b), 24(3)(a) and 24(3)(b) underof this Regulation and which are also classified as high-risk AI systems accordingpursuant to
Article [Article 6] of the Regulation [AI Regulation], and to which the conformity assessment
procedure based on internal control referred to in Annex [Annex VI] to Regulation [the AI
Regulation] applies, shall be subject to the conformity assessment procedures as required byunder this Regulation in so far as the essential requirements of this Regulation are concerned.
Article 9
Machinery products

Machinery products under the scope of Regulation [Machinery Regulation proposal] which areproducts with digital elements within the meaning of this Regulation and for which an EU
declaration of conformity has been issued on the basis of this Regulation shall be deemed to be inconformity with the requirements related to cybersecurity regarding the protection against
corruption and safety and reliability of control systems essential health and safety requirements set
out in Sections 1.1.9 and 1.2.1 of Annex [Annex III, Sections 1.1.9 and 1.2.1] to Regulation[Machinery Regulation proposal], as regards protection against corruption and safety and reliabilityof control systems, and in so far as if the achievement of the level of cybersecurity protection
required by under those requirements Sections is demonstrated in the EU declaration of conformity
issued under pursuant to this Regulation.

11726/23
ANNEX

JAI.2

EB/es

75

LIMITEENCHAPTER IIOBLIGATIONS OF ECONOMIC OPERATORS
Article 10
Obligations of manufacturers
1.

When placing a product with digital elements on the market, manufacturers shall ensure that it
has been designed, developed and produced in accordance with the essential requirements set
out in Section 1 of Annex I.

2.

For the purposes of complying with the obligation laid down in paragraph 1, manufacturers
shall undertake an assessment of the cybersecurity risks associated with a product withdigital elements and take the outcome of that assessment into account during the planning,
design, development, production, delivery and maintenance phases of the product withdigital elements with a view to minimising cybersecurity risks, preventing security incidents
and minimising the impacts of such incidents, including in relation to the health and safety ofusers.

2a.

The risk assessment referred to in paragraph 2 shall be documented and updated as
appropriate during the expected lifetime of the product. It shall comprise at least an
analysis of cybersecurity risks based on the intended purpose and reasonably
foreseeable use, as well as the specific conditions of use of the product with digitalelements, such as the operational environment, and the assets to be protected, taking
into account the whole lifecycle of the product. The risk assessment shall indicate thespecific security requirements as set out in point 3 of section 1 of Annex I that are
applicable to the respective product with digital elements and how these are
implemented as informed by the risk assessment.

11726/23
ANNEX

JAI.2

EB/es

76

LIMITEEN

3.

When placing a product with digital elements on the market, the manufacturer shall include acybersecurity risk assessment in the technical documentation as set out in Article 23 andAnnex V. For products with digital elements referred to in Articles 8 and 24(4) that are also
subject to other Union acts, the cybersecurity risk assessment may be part of the risk
assessment required by those respective Union acts. Where certain essential requirements
are not applicable to the marketed product with digital elements, the manufacturer shall
include a clear justification in that documentation.

4.

For the purposes of complying with the obligation laid down in paragraph 1, manufacturers
shall exercise due diligence when integrating components sourced from third parties in
products with digital elements in a manner that such components do not compromise thesecurity of the product with digital elements. They shall ensure that such components do
not compromise the security of the product with digital elements.

5.

The manufacturer shall systematically document, in a manner that is proportionate to thenature and the cybersecurity risks, relevant cybersecurity aspects concerning the productwith digital elements, including vulnerabilities they it becomes aware of and any relevant
information provided by third parties, and, where applicable, update the cybersecurity risk
assessment of the product.

6.

When placing a product with digital elements on the market, and for the expected productlifetime or for a period of five years from the placing of the product on the market,
whichever is shorter, Manufacturers shall ensure, when placing a product with digitalelements on the market and for a period of time after the placing on the market appropriate
to the type of and its for the expected product lifetime, that vulnerabilities of that product,
including its components, are handled effectively and in accordance with the essential
requirements set out in Section 2 of Annex I.

11726/23
ANNEX

JAI.2

EB/es

77

LIMITEEN

Manufacturers shall determine the expected product lifetime referred to in the firstsubparagraph of this paragraph taking into account the time users reasonably
expect to be able to use the product with digital elements given its functionality andintended purpose and therefore can expect to receive security updates.
Manufacturers shall have appropriate policies and procedures, including coordinatedvulnerability disclosure policies, referred to in Section 2, point (5), of Annex I, to process
and remediate potential vulnerabilities in the product with digital elements reported frominternal or external sources.
Security updates, referred to in Section 2, point (8), of Annex I, which have been madeavailable to users shall remain available for a minimum duration of 10 years.
6a.

For the purpose of complying with the obligation provided for in the first subparagraphof paragraph 6, where manufacturers have placed subsequent versions of a software
product on the market, they may provide security updates only for the software productthat they have last placed on the market. They may do so only if the users of the relevant
previous product versions have access to the latest product version free of charge and do
not incur significant additional costs to adjust the hardware and software environment
in which they operate the product.

6bThis Regulation shall not prevent manufacturers from maintaining publicly available
archives of previously made available software versions if they provide in a clear andeasily accessible manner information on risks associated with using software that are notsupported or updated anymore.

7.

Before placing a product with digital elements on the market, manufacturers shall draw up thetechnical documentation referred to in Article 23.
They shall carry out the chosen conformity assessment procedures referred to in Article 24 or
have them carried out.

11726/23
ANNEX

JAI.2

EB/es

78

LIMITEEN

Where compliance of the product with digital elements with the essential requirements set
out in Section 1 of Annex I and of the processes put in place by the manufacturer with theessential requirements set out in Section 2 of Annex I has been demonstrated by that
conformity assessment procedure, manufacturers shall draw up the EU declaration ofconformity in accordance with Article 20 and affix the CE marking in accordance with
Article 22.
8.

Manufacturers shall keep the technical documentation and the EU declaration of conformity,
where relevant, at the disposal of the market surveillance authorities for ten years after the
product with digital elements has been placed on the market.

9.

Manufacturers shall ensure that procedures are in place for products with digital elementsthat are part of a series of production to remain in conformity with the requirements of thisRegulation. The manufacturer shall adequately take into account changes in thedevelopment and production process or in the design or characteristics of the product withdigital elements and changes in the harmonised standards, European cybersecurity
certification schemes or the common specifications referred to in Article 189 by reference towhich the conformity of the product with digital elements is declared or by application ofwhich its conformity is verified.

9a.

Manufacturers shall ensure that their products with digital elements bear a type, batchor serial number or other element allowing their identification, or, where that is notpossible, on its packaging or in a document accompanying the product with digitalelements.

9aa. Manufacturers shall indicate the name, registered trade name or registered trade markof the manufacturer, and the postal address, and the email address or other digitalcontact as well as, where applicable, the website at which the manufacturer can becontacted, on the product with digital elements or, where that is not possible, on its
packaging or in a document accompanying the product with digital elements. The
contact details shall be in a language which can be easily understood by users andmarket surveillance authorities

11726/23
ANNEX

JAI.2

EB/es

79

LIMITEEN10.

Manufacturers shall ensure that products with digital elements are accompanied by the
information and instructions set out in Annex II, in an electronic or physical form. Suchinformation and instructions shall be provided in a language which can be easily understoodby users and market surveillance authorities. They shall be clear, understandable,
intelligible and legible. They shall allow for a secure installation, operation and use of the
products with digital elements.

10a. Manufacturers shall ensure that the end date for the expected product lifetime asreferred to in paragraph 6, including at least the month and year, until which the
manufacturer will at least ensure the effective handling of vulnerabilities inaccordance with the essential requirements set out in Section 2 of Annex I to thisRegulation is clearly and understandably specified at the time of purchase, in an easily
accessible manner and where applicable on the product with digital elements, its
packaging or by digital means.
11.

Manufacturers shall either provide a copy of the EU declaration of conformity or asimplified EU declaration of conformity with the product with digital elements. Where asimplified EU declaration of conformity is provided, it shall c o n t a i n or includedin the instructions and information set out in Annex II the exact internet address at which
the full EU declaration of conformity can be accessed.

12.

From the placing on the market and for the period of time referred to in paragraph 6
expected product lifetime or for a period of five years after the placing on the market of a
product with digital elements, whichever is shorter, manufacturers who know or have reason tobelieve that the product with digital elements or the processes put in place by the
manufacturer are not in conformity with the essential requirements set out in Annex I shallimmediately take the corrective measures necessary to bring that product with digitalelements or the manufacturer’s processes into conformity, to withdraw or to recall the
product, as appropriate.

11726/23
ANNEX

JAI.2

EB/es

80

LIMITEEN13.

Manufacturers shall, further to a reasoned request from a market surveillance authority,
provide that authority, in a language which can be easily understood by it, with all theinformation and documentation, in paper or electronic form, necessary to demonstrate theconformity of the product with digital elements and of the processes put in place by the
manufacturer with the essential requirements set out in Annex I. They shall cooperate withthat authority, at its request, on any measures taken to eliminate adequately reduce thecybersecurity risks posed by the product with digital elements, which they have placed on themarket.

14.

A manufacturer that ceases its operations and, as a result, is not able to comply with the
obligations laid down in this Regulation shall inform, before the cease of operation takes
effect, the relevant market surveillance authorities about this situation, as well as, by anymeans available and to the extent possible, the users of the concerned products with digitalelements placed on the market.

15.

The Commission may, by means of implementing acts, specify the format and elements ofthe software bill of materials set out in Section 2, point (1), of Annex I and the format of theinformation and instructions referred to in Annex II. Those implementing acts shall be
adopted in accordance with the examination procedure referred to in Article 51(2).
Article 11
Reporting obligations of manufacturers

1.

The manufacturers shall, without undue delay, notify any actively exploited vulnerability
contained in the product with digital elements that they become aware of to the CSIRTs
designated as coordinators pursuant to Article 12(1) of Directive (EU) 2022/2555, in
accordance with paragraph 2b of this Article. and in any event within 24 hours of
becoming aware of it, notify to ENISA any actively exploited vulnerability contained in the
product with digital elements. The notification shall include details concerning thatvulnerability and, where applicable, any corrective or mitigating measures taken. ENISA
shall, without undue delay, unless for justified cybersecurity risk-related grounds, forward thenotification to the CSIRT designated for the purposes of coordinated vulnerability disclosurein accordance with Article [Article X] of Directive [Directive XXX/XXXX (NIS2)] ofMember States concerned upon receipt and inform the market surveillance authority about the
notified vulnerability.

11726/23
ANNEX

JAI.2

EB/es

81

LIMITEEN

1a.

For the purpose of the notification referred to in paragraph 1, the manufacturers shallsubmit:(a)Without undue delay and in any event within 24 hours of becoming aware of theactively exploited vulnerability, an early warning which shall provide general
information, as available, about the product with digital elements concerned, thenature of the exploit and of the respective vulnerability. The early warning shallalso indicate, where applicable, the Member States on the territory of which the
manufacturer is aware that their product with digital elements has been madeavailable. Where applicable, the early warning shall also indicate any corrective or
mitigating measures taken, corrective or mitigating measures that users can take,and include an indication of how sensitive the manufacturer deems the notified
information to be.

(b)Without undue delay and in any event within 72 hours of becoming aware of theactively exploited vulnerability, a notification updating the information referred toin point (a). Where applicable, the notification shall indicate any available
information about the actively exploited vulnerability, the status of remediation
and any corrective or mitigating measures taken.

2.

The manufacturers shall, without undue delay, notify any incident having an impact on
the security of the product with digital elements that they become aware of to the
CSIRTs designated as coordinators pursuant to Article 12(1) of Directive (EU)2022/2555, in accordance with paragraph 2b of this Article.

11726/23
ANNEX

JAI.2

EB/es

82

LIMITEEN

2a.

For the purpose of the notification referred to in paragraph 2, the manufacturers shallsubmit:(a)Without undue delay and in any event within 24 hours of becoming aware of theincident, an early warning which shall provide general information, as available,
about the nature of the incident and shall indicate whether the incident issuspected of being caused by unlawful or malicious acts or could have a crossborder impact. The early warning shall also indicate, where applicable, theMember States on the territory of which the manufacturer is aware that theirproduct with digital elements has been made available. Where applicable, the early
warning shall also indicate any corrective or mitigating measures taken, correctiveor mitigating measures that users can take, and include an indication of how
sensitive the manufacturer deems the notified information to be.

(b)Without undue delay and in any event within 72 hours of becoming aware of theincident, an incident notification which shall include information on the severity
and impact of the incident, and, where applicable, update the information referred
to in point (a). The notification shall also include, if available, information on theindicators of compromise.

2b.

The notifications referred to in paragraphs 1 and 2 shall be submitted through one of
the electronic notification end-points of the single reporting platform referred to inparagraph 2c.
Where the manufacturers have their main establishment in the Union, they shall submit
the notifications referred to in paragraphs 1 and 2 through the electronic notification
end-point of the CSIRT designated as coordinator pursuant to Article 12(1) of
Directive (EU) 2022/2555 of the Member State in which they have their mainestablishment.

11726/23
ANNEX

JAI.2

EB/es

83

LIMITEEN

For the purposes of this Regulation, a manufacturer shall be considered to have its mainestablishment in the Union in the Member State where the decisions related to thecybersecurity of its products with digital elements are predominantly taken.
Where manufacturers have no main establishment in the Union, they shall notify via thesingle reporting platform to the CSIRT designated as coordinator pursuant to Article
12(1) of Directive (EU) 2022/2555 in the Member State of their choice.
2c.

For the purposes of the notifications referred to in paragraphs 1 and 2, a single
reporting platform shall be established, and the day-to-day operations managed andmaintained by ENISA. The architecture of the single reporting platform shall allow
Member States and ENISA to put in place their own electronic notification end-points.
The initial recipient of a notification shall, without delay, disseminate the notification via
the single reporting platform to all the CSIRTs designated as coordinators pursuant to
Article 12(1) of Directive (EU) 2022/2555 on whose territory the manufacturer has
indicated that the product with digital elements has been made available and to ENISA.
In exceptional circumstances and in particular upon request by the manufacturer and inlight of the level of sensitivity of the notified information as indicated by the
manufacturer under paragraph 1a (a), the dissemination of the notification may bedelayed based on justified cybersecurity related grounds for a period of time that isstrictly necessary, including in cases where a vulnerability is subject to a coordinatedvulnerability disclosure procedure as referred to in Article 12(1) of Directive (EU)2022/2555. The CSIRTs network, established pursuant to Article 15 of Directive (EU)2022/2555, shall adopt guidelines on the terms and conditions for applying the
aforementioned cybersecurity related grounds.

11726/23
ANNEX

JAI.2

EB/es

84

LIMITEEN

After receiving a notification regarding an actively exploited vulnerability in a productwith digital elements or regarding an incident having an impact on the security of a
product with digital elements, the CSIRTs shall provide market surveillance authoritiesof their respective Member States with the notified information necessary for themarket surveillance authorities to fulfil their obligations under this Regulation.
2cc. ENISA shall notify without undue delay any security incident affecting the single
reporting platform to the CSIRTs network.
2d.

The CSIRTs network shall provide specifications on the organisational mattersregarding the establishment, maintenance and secure operation of the single reporting
platform, including at least the following:(a)security arrangements related to the establishment, operation and maintenance ofthe platform, as well as the electronic notification end-points setup by the CSIRTs
at national level, including security aspects;(b)

the type of information and format of the notifications.

2dd. ENISA shall comply with the specifications provided by the CSIRTs network as referred
to in paragraph 2d in the development and operations for the management andmaintenance of the single reporting platform.

11726/23
ANNEX

JAI.2

EB/es

85

LIMITEEN

2aaaa.

Manufacturers of products with digital elements shall have the possibility tovoluntarily report vulnerabilities of which active exploitation has not yet been observed.
2aaaaa.

Where a CSIRT designated as coordinator pursuant to Article 12(1) of Directive(EU) 2022/2555 has been made aware of an actively exploited vulnerability as part of acoordinated vulnerability disclosure procedure as referred to in Article 12(1) of
Directive (EU) 2022/2555, the initial recipient CSIRT may delay the dissemination of therespective notification via the single reporting platform based on justified cybersecurity
related grounds for a period of time that is strictly necessary and until consent fordisclosure by the involved coordinated vulnerability disclosure-parties is reached. This
does not prevent manufacturers from notifying such a vulnerability on a voluntary basis
in accordance with the procedure laid down in this Article.
2ab. Where a third party other than the manufacturer notifies an actively exploitedvulnerability or an incident having an impact on the security of a product w i t h
d i g i t a l e l e m e n t s under the scope of this Regulation to a CSIRT designated ascoordinator pursuant to Article 12(1) of Directive (EU) 2022/2555, that CSIRT shallwithout undue delay inform the manufacturer.
3.

ENISA may submit to the European cyber crisis liaison organisation network (EUCyCLONe) established under Article 16 of Directive (EU) 2022/2555 information
notified pursuant to paragraphs 1 (a), 1 (b), and 2a (a) and 2a (b) if such information isrelevant for the coordinated management of large- scale cybersecurity incidents and crises at
an operational level. For the purpose of determining such relevance, ENISA may consider
technical analyses performed by the CSIRTs network, where available.

11726/23
ANNEX

JAI.2

EB/es

86

LIMITEEN4.

The manufacturer shall inform, without undue delay and after becoming aware, the users of
the product with digital elements about the an actively exploited vulnerability or an
incident having an impact on the security of the product with digital elements and, where
necessary, about corrective measures that the user can deploy to mitigate the impact of thatvulnerability or incident, where appropriate in a structured and easily automaticallyprocessible machine-readable format. Where the manufacturer fails to inform the usersof the product with digital elements in a timely manner, the notified CSIRT may provide
such information to the users when considered proportionate and necessary forpreventing or mitigating the impact of that vulnerability or incident.

5.

The Commission may, by means of implementing acts, specify further the type of
information, format and procedure of the notifications submitted pursuant to paragraphs 1 to
2ab of this Article. Those implementing acts shall be adopted in accordance with theexamination procedure referred to in Article 51(2).

6.

ENISA, on the basis of the notifications received pursuant to paragraphs 1 and 2, shallprepare a biennial technical report on emerging trends regarding cybersecurity risks in
products with digital elements and submit it to the Cooperation Group establishedunder Article [Article X] 14 of Directive (EU) 2022/2555 [Directive XXX/XXXX(NIS2)]. The first such report shall be submitted within 24 months after the obligations laid
down in paragraphs 1 and 2 start applying.

7.

Manufacturers shall, upon identifying a vulnerability in a component, including in an open
source component, which is integrated in the product with digital elements, report thevulnerability to the person or entity maintaining the component. Where manufacturers
have developed a software modification to address the vulnerability in that component,
they shall share the relevant code with the person or entity maintaining the component,
where appropriate in a machine readable format.

11726/23
ANNEX

JAI.2

EB/es

87

LIMITEEN

Article 12
Authorised representatives
1.

A manufacturer may, by a written mandate, appoint an authorised representative by awritten mandate.

2.

The obligations laid down in Article 10(1) to (7) first indent and (9) shall not form part of
the authorised representative's mandate.

3.

An authorised representative shall perform the tasks specified in the mandate received fromthe manufacturer. The mandate shall allow the authorised representative to do at least thefollowing:(a)keep the EU declaration of conformity referred to in Article 20 and the technicaldocumentation referred to in Article 23 at the disposal of the market surveillanceauthorities for ten years after the product with digital elements has been placed on themarket;(b)further to a reasoned request from a market surveillance authority, provide that
authority with all the information and documentation necessary to demonstrate theconformity of the product with digital elements;(c)cooperate with the market surveillance authorities, at their request, on any action taken toeliminate the cybersecurity risks posed by a product with digital elements covered by
the authorised representative's mandate.

11726/23
ANNEX

JAI.2

EB/es

88

LIMITEEN

Article 13
Obligations of importers
1.

Importers shall only place on the market products with digital elements that comply with theessential requirements set out in Section 1 of Annex I and where the processes put in place by
the manufacturer are compliant with the essential requirements set out in Section 2 ofAnnex I.

2.

Before placing a product with digital elements on the market, importers shall ensure that:(a)the appropriate conformity assessment procedures referred to in Article 24 have been
carried out by the manufacturer;(b)the manufacturer has drawn up the technical documentation;(c)the product with digital elements bears the CE marking referred to in Article 22 and isaccompanied by the required documents as referred to in Article 10(11) and theinformation and instructions for use as set out in Annex II in a language which can beeasily understood by users and market surveillance authorities.

(d)

The manufacturer has complied with the requirements set out in Article 10(9a),10(9aa) and 10(10a).

3.

Where an importer considers or has reason to believe that a product with digital elements or
the processes put in place by the manufacturer are not in conformity with the essential
requirements set out in Annex I, the importer shall not place the product on the market untilthat product or the processes put in place by the manufacturer have been brought into
conformity with the essential requirements set out in Annex I. Furthermore, where theproduct with digital elements presents a significant cybersecurity risk, the importer shallinform the manufacturer and the market surveillance authorities to that effect.

11726/23
ANNEX

JAI.2

EB/es

89

LIMITEEN

4.

Importers shall indicate their name, registered trade name or registered trademark, the postal
address and website, the email address or other digital contact as well as, whereapplicable, the website at which they can be contacted on the product with digital elementsor, where that is not possible, on its packaging or in a document accompanying the productwith digital elements. The contact details shall be in a language easily understood by users
and market surveillance authorities.

5.

Importers shall ensure that the product with digital elements is accompanied by the
instructions and information set out in Annex II in a language which can be easily understoodby users.

6.

Importers who know or have reason to believe that a product with digital elements, which
they have placed on the market, or the processes put in place by its manufacturer, are not in
conformity with the essential requirements set out in Annex I shall immediately take thecorrective measures necessary to bring that product with digital elements or the processes
put in place by its manufacturer into conformity with the essential requirements set out inAnnex I, or to withdraw or recall the product, if appropriate.
Upon identifying a vulnerability in the product with digital elements, importers shall informthe manufacturer without undue delay about that vulnerability. Furthermore, where theproduct with digital elements presents a significant cybersecurity risk, importers shallimmediately inform the market surveillance authorities of the Member States in which they
made the product with digital elements available on the market to that effect, giving details, inparticular, of the non-conformity and of any corrective measures taken.

7.

Importers shall, for ten years after the product with digital elements has been placed on themarket, keep a copy of the EU declaration of conformity at the disposal of the market
surveillance authorities and ensure that the technical documentation can be made available tothose authorities, upon request.

11726/23
ANNEX

JAI.2

EB/es

90

LIMITEEN

8.

Importers shall, further to a reasoned request from a market surveillance authority, provide itwith all the information and documentation, in paper or electronic form, necessary todemonstrate the conformity of the product with digital elements with the essential
requirements set out in Section 1 of Annex I as well as of the processes put in place by the
manufacturer with the essential requirements set out in Section 2 of Annex I in a languagethat can be easily understood by that authority. They shall cooperate with that authority, at its
request, on any measures action taken to eliminate adequately reduce the cybersecurity
risks posed by a product with digital elements, which they have placed on the market.

9.

When the importer of a product with digital elements becomes aware that the manufacturer ofthat product ceased its operations and, as result, is not able to comply with the obligations laid
down in this Regulation, the importer shall inform the relevant market surveillanceauthorities about this situation, as well as, by any means available and to the extent possible,
the users of the products with digital elements placed on the market.
Article 14
Obligations of distributors

1.

When making a product with digital elements available on the market, distributors shall act
with due care in relation to the requirements of this Regulation.

2.

Before making a product with digital elements available on the market, distributors shallverify that:(a)the product with digital elements bears the CE marking;(b)

the manufacturer and the importer have complied with the obligations set out
respectively in Articles 10(9a), 10 (9aa), 10(10), 10(10a), 10(11) and 13(4).

11726/23
ANNEX

JAI.2

EB/es

91

LIMITEEN

3.

Where a distributor considers or has reason to believe that a product with digital elements or
the processes put in place by the manufacturer are not in conformity with the essential
requirements set out in Annex I, the distributor shall not make the product with digitalelements available on the market until that product or the processes put in place by the
manufacturer have been brought into conformity. Furthermore, where the product withdigital elements poses a significant cybersecurity risk, the distributor shall inform without
undue delay the manufacturer and the market surveillance authorities to that effect.

4.

Distributors who know or have reason to believe that a product with digital elements, which
they have made available on the market, or the processes put in place by its manufacturer
are not in conformity with the essential requirements set out in Annex I shall make sure thatthe corrective measures necessary to bring that product with digital elements or the processes
put in place by its manufacturer into conformity are taken, or to withdraw or recall the
product, if appropriate.
Upon identifying a vulnerability in the product with digital elements, distributors shallinform the manufacturer without undue delay about that vulnerability. Furthermore, where
the product with digital elements presents a significant cybersecurity risk, distributors shallimmediately inform the market surveillance authorities of the Member States in which they
have made the product with digital elements available on the market to that effect, giving
details, in particular, of the non-conformity and of any corrective measures taken.

5.

Distributors shall, further to a reasoned request from a market surveillance authority, provide itwith all the information and documentation, in paper or electronic form, necessary todemonstrate the conformity of the product with digital elements and the processes put inplace by its manufacturer with the essential requirements set out in Annex I in a languagethat can be easily understood by that authority. They shall cooperate with that authority, at its
request, on any measures taken to eliminate the cybersecurity risks posed by a product withdigital elements, which they have made available on the market.

6.

When the distributor of a product with digital elements becomes aware that the manufacturer ofthat product ceased its operations and, as result, is not able to comply with the obligations laid
down in this Regulation, the distributor shall inform, without undue delay, the relevantmarket surveillance authorities about this situation, as well as, by any means available and to
the extent possible, the users of the products with digital elements placed on the market.

11726/23
ANNEX

JAI.2

EB/es

92

LIMITEEN

Article 15Cases in which obligations of manufacturers apply to importers and distributors
An importer or distributor shall be considered a manufacturer for the purposes of this Regulation andshall be subject to the obligations of the manufacturer set out in Articles 10 and 11(1), (1a), (2), (2a),(2b), 2(aaaa), (4) and (7) where that importer or distributor places a product with digital elementson the market under his or her name or trademark or carries out a substantial modification of the
product with digital elements already placed on the market.
Article 16
Other cases in which obligations of manufacturers apply
A natural or legal person, other than the manufacturer, the importer or the distributor, that carries
out a substantial modification of the product with digital elements shall be considered amanufacturer for the purposes of this Regulation.
That person shall be subject to the obligations of the manufacturer set out in Articles 10 and
11(1), (1a), (2), (2a), (2b), 2(aaaa), (4) and (7), for the part of the product that is affected by thesubstantial modification or, if the substantial modification has an impact on the cybersecurity of the
product with digital elements as a whole, for the entire product.
Article 17
Identification of economic operators
1.

Economic operators shall, on request and where the information is available, provide to themarket surveillance authorities the following information:(a)name and address of any economic operator who has supplied them with a productwith digital elements;

11726/23
ANNEX

JAI.2

EB/es

93

LIMITEEN

(b)name and address of any economic operator to whom they have supplied a productwith digital elements;

2.

Economic operators shall be able to present the information referred to in paragraph 1 forten years after they have been supplied with the product with digital elements and for ten
years after they have supplied the product with digital elements.

Article 18

Presumption of conformity
1.

Products with digital elements and processes put in place by the manufacturer which are inconformity with harmonised standards or parts thereof the references of which have been
published in the Official Journal of the European Union shall be presumed to be in conformity
with the essential requirements set out in Annex I covered by those standards or parts
thereof.

2.

Products with digital elements and processes put in place by the manufacturer, which are inconformity with the common specifications referred to in Article 19 shall be presumed to be
in conformity with the essential requirements set out in Annex I, to the extent those common
specifications cover those requirements.

2.

The Commission shall, as provided in Article 10(1) of Regulation (EU) No 1025/2012,
request one or more European standardisation organisations to draft harmonised
standards for the essential requirements set out in Annex I.

3.

The Commission may adopt implementing acts establishing common specifications
covering technical requirements that provide a means to comply with the essential
requirements set out in Annex I for products with digital elements within the scope of
this Regulation.

11726/23
ANNEX

JAI.2

EB/es

94

LIMITEEN

Those implementing acts shall only be adopted where the following conditions are
fulfilled:(a)the Commission has requested, pursuant to Article 10(1) of Regulation (EU) No
1025/2012, one or more European standardisation organisations to draft a
harmonised standard for the essential requirements set out in Annex I and:(i)the request has not been accepted; or(ii)

the harmonised standards addressing that request are not delivered within
the deadline set in accordance with Article 10(1) of Regulation (EU) No
1025/2012;or(iii) the harmonised standards do not comply with the request; and(b)no reference to harmonised standards covering the relevant essential requirements
set out in Annex I has been published in the Official Journal of the European
Union in accordance with Regulation (EU) No 1025/2012 and no such reference is
expected to be published within a reasonable period.

Those implementing acts shall be adopted in accordance with the examination
procedure referred to in Article 51(2).
4.

Before preparing the draft implementing act referred to in paragraph 3, theCommission shall inform the committee referred to in Article 22 of Regulation (EU) No
1025/2012 that it considers that the conditions in paragraph 3 have been fulfilled.

5.

When preparing the draft implementing act referred to in paragraph 3, the Commission
shall take into account the views of relevant bodies or the expert group and shall duly
consult all relevant stakeholders.

11726/23
ANNEX

JAI.2

EB/es

95

LIMITEEN

6.

Products with digital elements and processes put in place by the manufacturer which are inconformity with the common specifications referred to in Article 19 established by
implementing acts referred to in paragraph 3, or parts thereof, shall be presumed to be inconformity with the essential requirements set out in Annex I, to the extent covered by thosecommon specifications or parts thereof cover those requirements.

7.

Where a harmonised standard is adopted by a European standardisation organisationand proposed to the Commission for the purpose of publishing its reference in the
Official Journal of the European Union, the Commission shall assess the harmonised
standard in accordance with Regulation (EU) No 1025/2012. When reference of aharmonised standard is published in the Official Journal of the European Union, theCommission shall repeal the implementing acts referred to in paragraph 3, or parts
thereof which cover the same essential requirements as those covered by that
harmonised standard.

8.

When a Member State considers that a common specification does not entirely satisfy
the essential requirements set out in Annex I, it shall inform the Commission thereof bysubmitting a detailed explanation. The Commission shall assess that detailed
explanation and may, if appropriate, amend the implementing act establishing thecommon specification in question.

39.

Products with digital elements and processes put in place by the manufacturer for which an
EU statement of conformity or certificate” has been issued under a European cybersecurity
certification scheme adopted as per Regulation (EU) 2019/881 and specified as per paragraph
4 10, shall be presumed to be in conformity with the essential requirements set out in Annex I
and related conformity assessment procedures in so far as the EU statement of conformity
or cybersecurity certificate, or parts thereof, cover those requirements. For the purposes ofthe presumption of conformity, products with digital elements that need to undergo theconformity assessment procedures referred to in Article 24 (2) and (3) shall have a
European cybersecurity certificate that refers to the required assurance level“substantial” or “high”.

11726/23
ANNEX

JAI.2

EB/es

96

LIMITEEN

4 10. The Commission is empoweredmay, by means of implementing acts, to specify the European
cybersecurity certification schemes adopted pursuant to Regulation (EU) 2019/881 that can beused to demonstrate conformity with the essential requirements or parts thereof as set out inAnnex I and related conformity assessment procedures. Furthermore, where applicable, theCommission shall specify if for which assurance levels, a cybersecurity certificate issued
under such schemes eliminates the obligation of a manufacturer to carry out a third-party
conformity assessment for the corresponding requirements, as set out in Article 24(2)(a), (b),(3)(a) and (b). Those implementing acts shall be adopted in accordance with the examination
procedure referred to in Article 51(2).
Article 19[Common specifications]
Where harmonised standards referred to in Article 18 do not exist or where the Commission
considers that the relevant harmonised standards are insufficient to satisfy the requirements of thisRegulation or to comply with the standardisation request of the Commission, or where there areundue delays in the standardisation procedure or where the request for harmonised standards by theCommission has not been accepted by the European standardisation organisations, the Commission
is empowered, by means of implementing acts, to adopt common specifications in respect of theessential requirements set out in Annex I. Those implementing acts shall be adopted in accordancewith the examination procedure referred to in Article 51(2).

11726/23
ANNEX

JAI.2

EB/es

97

LIMITEEN

Article 20
EU declaration of conformity
1.

The EU declaration of conformity shall be drawn up by manufacturers in accordance with
Article 10(7) and state that the fulfilment of the applicable essential requirements set out inAnnex I has been demonstrated.

2.

The EU declaration of conformity shall have the model structure set out in Annex IV andshall contain the elements specified in the relevant conformity assessment procedures set out
in Annex VI. Such a declaration shall be continuously updated. It shall be made available in
the language or languages required by the Member State in which the product with digitalelements is placed on the market or made available on the market.
The simplified EU declaration of conformity referred to in Article 10(11) shall containthe model structure set out in Annex [XX] and shall be continuously updated. It shall bemade available in the languages required by the Member State in which the productwith digital elements is placed on the market or made available on the market. The fulltext of the EU declaration of conformity shall be available at the internet address
referred to in the simplified EU declaration of conformity, in the languages required by
the Member State in which the product with digital elements is placed on the market or
made available on the market.

3.

Where a product with digital elements is subject to more than one Union act requiring an EU
declaration of conformity, a single EU declaration of conformity shall be drawn up in respectof all such Union acts. That declaration shall contain the identification of the Union acts
concerned, including their publication references.

4.

By drawing up the EU declaration of conformity, the manufacturer shall assume responsibility
for the compliance of the product.

5.

The Commission is empowered to adopt delegated acts in accordance with Article 50 tosupplement this Regulation by adding elements to the minimum content of the EU declarationof conformity set out in Annex IV to take account of technological developments.

11726/23
ANNEX

JAI.2

EB/es

98

LIMITEEN

Article 21
General principles of the CE marking
The CE marking as defined in Article 3(32) shall be subject to the general principles set out in
Article 30 of Regulation (EC) No 765/2008.
Article 22
Rules and conditions for affixing the CE marking
1.

The CE marking shall be affixed visibly, legibly and indelibly to the product with digitalelements. Where that is not possible or not warranted on account of the nature of the productwith digital elements, it shall be affixed to the packaging andthe accompanying documents
and where applicable to the packaging EU declaration of conformity referred to in Article
20 accompanying the product with digital elements. For products with digital elements which
are in the form of software, the CE marking shall be affixed either to the EU declaration ofconformity referred to in Article 20 or on the website accompanying the software product.

2.

On account of the nature of the product with digital elements, the height of the CE marking
affixed to the product with digital elements may be lower than 5 mm, provided that it remains
visible and legible.

3.

The CE marking shall be affixed before the product with digital elements is placed on themarket. It may be followed by a pictogram or any other mark indicating a special risk or use
set out in implementing acts referred to in paragraph 6.

4.

The CE marking shall be followed by the identification number of the notified body, wherethat body is involved in the conformity assessment procedure based on full quality assurance(based on module H) referred to in Article 24.
The identification number of the notified body shall be affixed by the body itself or, under its
instructions, by the manufacturer or the manufacturer’s authorised representative.

11726/23
ANNEX

JAI.2

EB/es

99

LIMITEEN

5.

Member States shall build upon existing mechanisms to ensure correct application of theregime governing the CE marking and shall take appropriate action in the event of improperuse of that marking. Where the product with digital elements is subject to other Union
legislation which also provides for the affixing of the CE marking, the CE marking shallindicate that the product also fulfils the requirements of that other legislation.

6.

The Commission may, by means of implementing acts, lay down technical specifications forpictograms or any other marks related to the security of the products with digital elements,and mechanisms to promote their use. Those implementing acts shall be adopted inaccordance with the examination procedure referred to in Article 51(2).
Article 23
Technical documentation

1.

The technical documentation shall contain all relevant data or details of the means used by the
manufacturer to ensure that the product with digital elements and the processes put in place by
the manufacturer comply with the essential requirements set out in Annex I. It shall at least
contain the elements set out in Annex V.

2.

The technical documentation shall be drawn up before the product with digital elements isplaced on the market and shall be continuously updated, where appropriate, during the
expected product lifetime or during a period of five years after the placing on the market of a
product with digital elements, whichever is shorter.

3.

For products with digital elements referred to in Articles 8 and 24(4) that are also subject toother Union acts, one single technical documentation shall be drawn up containing theinformation referred to in Annex V of this Regulation and the information required by those
respective Union acts.

11726/23
ANNEX

JAI.2

EB/es

100

LIMITEEN4.

The technical documentation and correspondence relating to any conformity assessment
procedure shall be drawn up in an official language of the Member State in which the notified
body is established or in a language acceptable to that body.

5.

The Commission is empowered to adopt delegated acts in accordance with Article 50 tosupplement this Regulation by the elements to be included in the technical documentation set
out in Annex V to take account of technological developments, as well as developments
encountered in the implementation process of this Regulation.
Article 24
Conformity assessment procedures for products with digital elements

1.

The manufacturer shall perform a conformity assessment of the product with digital elements
and the processes put in place by the manufacturer to determine whether the essential
requirements set out in Annex I are met. The manufacturer or the manufacturer’s authorised
representative shall demonstrate conformity with the essential requirements by using one anyof the following procedures:(a)the internal control procedure (based on module A) set out in Annex VI; or(b)

the EU-type examination procedure (based on module B) set out in Annex VI followedby conformity to EU-type based on internal production control (based on module C) set
out in Annex VI; or(c)conformity assessment based on full quality assurance (based on module H) set out inAnnex VI. ; or(d)where available and applicable, a European cybersecurity certification scheme as
specified in Article 18(9) and (10) at any assurance level.

11726/23
ANNEX

JAI.2

EB/es

101

LIMITEEN2.

Where, in assessing the compliance of the critical product with digital elements of class I as
set out in Annex III and the processes put in place by its manufacturer with the essential
requirements set out in Annex I, the manufacturer or the manufacturer’s authorised
representative has not applied or has applied only in part harmonised standards, common
specifications or European cybersecurity certification schemes as referred to in Article 18, or
where such harmonised standards, common specifications or European cybersecurity
certification schemes do not exist, the product with digital elements concerned and theprocesses put in place by the manufacturer shall be submitted with regard to those essential
requirements to either any of the following procedures:(a)the EU-type examination procedure (based on module B) provided for set out in Annex
VI followed by conformity to EU-type based on internal production control (based on
module C) set out in Annex VI; or(b)conformity assessment based on full quality assurance (based on module H) set out inAnnex VI. ; or(c)where available and applicable, a European cybersecurity certification scheme as
specified in Article 18(9) and (10) at the required assurance level.

3.

Where the product is a critical product with digital elements of class II as set out in Annex III,the manufacturer or the manufacturer’s authorised representative shall demonstrate
conformity with the essential requirements set out in Annex I by using one any of thefollowing procedures:(a)EU-type examination procedure (based on module B) set out in Annex VI followed by
conformity to EU-type based on internal production control (based on module C) set out
in Annex VI; or

11726/23
ANNEX

JAI.2

EB/es

102

LIMITEEN

(b)conformity assessment based on full quality assurance (based on module H) set out inAnnex VI.; or(c)where available and applicable, a European cybersecurity certification scheme as
specified in Article 18 (9) and (10) at the required assurance level.

3aa. Products listed in Annex IIIa shall demonstrate conformity with the essential
requirements set out in Annex I by using one of the following procedures:(a)a European cybersecurity certification scheme in accordance with Article 6a (1) ,
or,

(b)

where the conditions in Article 6a (1) are not met, any of the procedures referred
to in paragraph 3 of this Article.

4.

Manufacturers of products with digital elements that are classified as EHR systems under thescope of Regulation [the European Health Data Space Regulation] shall demonstrate
conformity with the essential requirements laid down in Annex I of this Regulation using therelevant conformity assessment procedure as required by Regulation [Chapter III of theEuropean Health Data Space Regulation].

5.

Notified bodies shall take into account the specific interests and needs of small and medium
sized enterprises (SMEs) when setting the fees for conformity assessment procedures andreduce those fees proportionately to their specific interests and needs.
The specific interests and needs of SMEs, including start-ups, shall be taken into
account when setting the fees for conformity assessment.

11726/23
ANNEX

JAI.2

EB/es

103

LIMITEEN

Article 24a
Support measures for small and micro enterprises
1.

Member States may undertake the following actions, tailored to the needs of small andmicro enterprises:(a)organise specific awareness raising and training activities about the application ofthis Regulation;(b)

where appropriate, establish a dedicated channel for communication with small
and micro enterprises and, as appropriate, local public authorities to provide
advice and respond to queries about the implementation of this Regulation.

(c)2.

where appropriate, support testing and conformity assessment activities.

The Commission shall ensure the development of guidance for small and microenterprises in relation to the implementation of this Regulation.

3.

Small and micro enterprises may provide the elements of the technical documentation
specified in Annex V in a simplified manner. For this purpose, the Commission, in
consultation with the market surveillance authorities, shall establish a simplified
technical documentation form targeted at the needs of small and micro enterprises.
Where a small or micro enterprise opts to provide the information required in Annex V
in a simplified manner, it shall use the form referred to in this paragraph. Notified
bodies shall accept the form for the purpose of conformity assessment.

11726/23
ANNEX

JAI.2

EB/es

104

LIMITEENCHAPTER IVNOTIFICATION OF CONFORMITY ASSESSMENT BODIESArticle 25
Notification
Member States shall notify the Commission and the other Member States of conformity assessment
bodies authorised to carry out conformity assessments in accordance with this Regulation.

Article 26
Notifying authorities
1.

Member States shall designate a notifying authority that shall be responsible for setting up
and carrying out the necessary procedures for the assessment and notification of conformity
assessment bodies and the monitoring of notified bodies, including compliance with Article
31.

2.

Member States may decide that the assessment and monitoring referred to in paragraph 1 shallbe carried out by a national accreditation body within the meaning of and in accordance with
Regulation (EC) No 765/2008.

3.

Where the notifying authority delegates or otherwise entrusts the assessment,
notification or monitoring referred to in paragraph 1 to a body which is not agovernmental entity, that body shall be a legal entity and shall comply mutatis mutandis
with the requirements laid down in [Article 27] of this Regulation. In addition it shallhave arrangements to cover liabilities arising out of its activities.

11726/23
ANNEX

JAI.2

EB/es

105

LIMITEEN4.

The notifying authority shall take full responsibility for the tasks performed by the bodyreferred to in paragraph 3.

Article 27
Requirements relating to notifying authorities
1.

A notifying authority shall be established in such a way that no conflict of interest with
conformity assessment bodies occurs.

2.

A notifying authority shall be organised and shall function so as to safeguard the objectivity
and impartiality of its activities.

3.

A notifying authority shall be organised in such a way that each decision relating to
notification of a conformity assessment body is taken by competent persons different fromthose who carried out the assessment.

4.

A notifying authority shall not offer or provide any activities that conformity assessment
bodies perform or consultancy services on commercial or competitive basis.

5.

A notifying authority shall safeguard the confidentiality of the information it obtains.

6.

A notifying authority shall have a sufficient number of competent personnel at its disposal forthe proper performance of its tasks.

Article 28
Information obligation on notifying authorities
1.

Member States shall inform the Commission of their procedures for the assessment andnotification of conformity assessment bodies and the monitoring of notified bodies, and of
any changes thereto.

2.

The Commission shall make that information publicly available.

11726/23
ANNEX

JAI.2

EB/es

106

LIMITEEN

Article 29
Requirements relating to notified bodies
1.

For the purposes of notification, a conformity assessment body shall meet the requirements
laid down in paragraphs 2 to 12.

2.

A conformity assessment body shall be established under national law and have legal
personality.

3.

A conformity assessment body shall be a third-party body independent of the organisation or
the product it assesses.
A body belonging to a business association or professional federation representing
undertakings involved in the design, development, production, provision, assembly, use or
maintenance of products with digital elements which it assesses, may, on condition that its
independence and the absence of any conflict of interest are demonstrated, be considered sucha body.

4.

A conformity assessment body, its top level management and the personnel responsible forcarrying out the conformity assessment tasks shall not be the designer, developer,
manufacturer, supplier, importer, distributor, installer, purchaser, owner, user or maintainerof the products with digital elements which they assess, nor the authorised representative of
any of those parties. This shall not preclude the use of assessed products that are necessary forthe operations of the conformity assessment body or the use of such products for personal
purposes.
A conformity assessment body, its top level management and the personnel responsible forcarrying out the conformity assessment tasks shall not be directly involved in the design,development, production, import, distribution, the marketing, installation, use or
maintenance of those products, or represent the parties engaged in those activities. They shallnot engage in any activity that may conflict with their independence of judgement or integrityin relation to conformity assessment activities for which they are notified. This shall inparticular apply to consultancy services.

11726/23
ANNEX

JAI.2

EB/es

107

LIMITEEN

Conformity assessment bodies shall ensure that the activities of their subsidiaries or
subcontractors do not affect the confidentiality, objectivity or impartiality of their conformity
assessment activities.
5.

Conformity assessment bodies and their personnel shall carry out the conformity assessment
activities with the highest degree of professional integrity and the requisite technicalcompetence in the specific field and shall be free from all pressures and inducements,
particularly financial, which might influence their judgement or the results of their conformity
assessment activities, especially as regards persons or groups of persons with an interest in the
results of those activities.

6.

A conformity assessment body shall be capable of carrying out all the conformity assessment
tasks referred to in Annex VI and in relation to which it has been notified, regardless ofwhether those tasks are carried out by the conformity assessment body itself or on its behalf
and under its responsibility.
At all times and for each conformity assessment procedure and each kind or category of
products with digital elements in relation to which it has been notified, a conformity
assessment body shall have at its disposal the necessary:(a)staff personnel with technical knowledge and sufficient and appropriate experience toperform the conformity assessment tasks;(b)descriptions of procedures in accordance with which conformity assessment is carriedout, ensuring the transparency and the ability of reproduction of those procedures. It
shall have appropriate policies and procedures in place that distinguish between tasks it
carries out as a notified body and other activities;(c)procedures for the performance of activities which take due account of the size of anundertaking, the sector in which it operates, its structure, the degree of complexity ofthe product technology in question and the mass or serial nature of the production
process.

11726/23
ANNEX

JAI.2

EB/es

108

LIMITEEN

It shall have the means necessary to perform the technical and administrative tasks connectedwith the conformity assessment activities in an appropriate manner and shall have access to
all necessary equipment or facilities.
7.

The personnel responsible for carrying out conformity assessment activities shall have thefollowing:(a)sound technical and vocational training covering all the conformity assessment activities
in relation to which the conformity assessment body has been notified;(b)satisfactory knowledge of the requirements of the assessments they carry out andadequate authority to carry out those assessments;(c)appropriate knowledge and understanding of the essential requirements set out inAnnex I, of the applicable harmonised standards as well as the common specifications
and of the relevant provisions of Union harmonisation legislation and of its
implementing acts;(d)the ability to draw up certificates, records and reports demonstrating that assessments
have been carried out.

8.

The impartiality of the conformity assessment bodies, their top level management and of theassessment personnel shall be guaranteed.
The remuneration of the top level management and assessment personnel of a conformity
assessment body shall not depend on the number of assessments carried out or on the resultsof those assessments.

11726/23
ANNEX

JAI.2

EB/es

109

LIMITE

EN

9.

Conformity assessment bodies shall take out liability insurance unless liability is assumed by
the State in accordance with national law, or the Member State itself is directly responsible
for the conformity assessment.

10.

The personnel of a conformity assessment body shall observe professional secrecy withregard to all information obtained in carrying out their tasks under Annex VI or any provisionof national law giving effect to it, except in relation to the market surveillance authorities ofthe Member State in which its activities are carried out. Proprietary rights shall be protected.
The conformity assessment body shall have documented procedures ensuring compliancewith this paragraph.

11.

Conformity assessment bodies shall participate in, or ensure that their assessment personnel
are informed of, the relevant standardisation activities and the activities of the notified bodycoordination group established under Article 40 and apply as general guidance theadministrative decisions and documents produced as a result of the work of that group.

12.

Conformity assessment bodies shall operate in accordance with a set of consistent, fair andreasonable terms and conditions, in particular taking into account the interests of SMEs inrelation to fees.

Article 30
Presumption of conformity of notified bodies
Where a conformity assessment body demonstrates its conformity with the criteria laid down in therelevant harmonised standards or parts thereof the references of which have been published in the
Official Journal of the European Union it shall be presumed to comply with the requirements set
out in Article 29 in so far as the applicable harmonised standards cover those requirements.

11726/23
ANNEX

JAI.2

EB/es

110

LIMITEEN

Article 31
Subsidiaries of and subcontracting by notified bodies
1.

Where a notified body subcontracts specific tasks connected with conformity assessment or
has recourse to a subsidiary, it shall ensure that the subcontractor or the subsidiary meets therequirements set out in Article 29 and shall inform the notifying authority accordingly.

2.

Notified bodies shall take full responsibility for the tasks performed by subcontractors or
subsidiaries wherever these are established.

3.

Activities may be subcontracted or carried out by a subsidiary only with the agreement of the
manufacturer.

4.

Notified bodies shall keep at the disposal of the notifying authority the relevant documents
concerning the assessment of the qualifications of the subcontractor or the subsidiary and thework carried out by them under this Regulation.

Article 32
Application for notification
1.

A conformity assessment body shall submit an application for notification to the notifying
authority of the Member State in which it is established.

2.

That application shall be accompanied by a description of the conformity assessment
activities, the conformity assessment procedure or procedures and the product or products forwhich that body claims to be competent, as well as by an accreditation certificate, whereapplicableone exists, issued by a national accreditation body attesting that the conformity
assessment body fulfils the requirements laid down in Article 29.

11726/23
ANNEX

JAI.2

EB/es

111

LIMITEEN

3.

Where the conformity assessment body concerned cannot provide an accreditation certificate,it shall provide the notifying authority with all the documentary evidence necessary for theverification, recognition and regular monitoring of its compliance with the requirements laid
down in Article 29.

Article 33
Notification procedure1.

Notifying authorities may notify only conformity assessment bodies, which have satisfied therequirements laid down in Article 29.

2.

The notifying authority shall notify the Commission and the other Member States using the
New Approach Notified and Designated Organisations (NANDO) information systemdeveloped and managed by the Commission.

3.

The notification shall include full details of the conformity assessment activities, theconformity assessment module or modules and product or products concerned and therelevant attestation of competence.

4.

Where a notification is not based on an accreditation certificate as referred to in Article 32(2),the notifying authority shall provide the Commission and the other Member States with
documentary evidence which attests to the conformity assessment body's competence and thearrangements in place to ensure that that body will be monitored regularly and will continue
to satisfy the requirements laid down in Article 29.

5.

The body concerned may perform the activities of a notified body only where no objections
are raised by the Commission or the other Member States within two weeks of a notification
where an accreditation certificate is used or within two months of a notification where
accreditation is not used.
Only such a body shall be considered a notified body for the purposes of this Regulation.

11726/23
ANNEX

JAI.2

EB/es

112

LIMITEEN6.

The Commission and the other Member States shall be notified of any subsequent relevantchanges to the notification.

Article 34
Identification numbers and lists of notified bodies
1.

The Commission shall assign an identification number to a notified body.
It shall assign a single such number even where the body is notified under several Union acts.

2.

The Commission shall make publicly available the list of the bodies notified under thisRegulation, including the identification numbers that have been allocated to them and theactivities for which they have been notified.
The Commission shall ensure that that list is kept up to date.

Article 35
Changes to notifications
1.

Where a notifying authority has ascertained or has been informed that a notified body nolonger meets the requirements laid down in Article 29, or that it is failing to fulfil its
obligations, the notifying authority shall restrict, suspend or withdraw notification as
appropriate, depending on the seriousness of the failure to meet those requirements or fulfil
those obligations. It shall immediately inform the Commission and the other Member Statesaccordingly.

2.

In the event of restriction, suspension or withdrawal of notification, or where the notified
body has ceased its activity, the notifying Member State shall take appropriate steps to ensurethat the files of that body are either processed by another notified body or kept available forthe responsible notifying and market surveillance authorities at their request.

11726/23
ANNEX

JAI.2

EB/es

113

LIMITEEN

Article 36
Challenge of the competence of notified bodies
1.

The Commission shall investigate all cases where it doubts, or doubt is brought to its attention
regarding the competence of a notified body or the continued fulfilment by a notified body of
the requirements and responsibilities to which it is subject.

2.

The notifying Member State shall provide the Commission, on request, with all information
relating to the basis for the notification or the maintenance of the competence of the bodyconcerned.

3.

The Commission shall ensure that all sensitive information obtained in the course of its
investigations is treated confidentially.

4.

Where the Commission ascertains that a notified body does not meet or no longer meets therequirements for its notification, it shall inform the notifying Member State accordingly andrequest it to take the necessary corrective measures, including de-notification if necessary.

Article 37
Operational obligations of notified bodies
1.

Notified bodies shall carry out conformity assessments in accordance with the conformity
assessment procedures provided for in Article 24 and Annex VI.

2.

Conformity assessments shall be carried out in a proportionate manner, avoiding unnecessary
burdens for economic operators. Conformity assessment bodies shall perform their activities
taking due account of the size of an undertaking, the sector in which it operates, its structure,
the degree of complexity of the product technology in question and the mass or serial natureof the production process.

3.

Notified bodies shall however respect the degree of rigour and the level of protection required
for the compliance of the product with the provisions of Regulation.

11726/23
ANNEX

JAI.2

EB/es

114

LIMITEEN

4.

Where a notified body finds that requirements laid down in Annex I or in corresponding
harmonised standards or in common specifications as referred to in Article 198 have not been
met by a manufacturer, it shall require that manufacturer to take appropriate corrective
measures and shall not issue a conformity certificate of conformity.

5.

Where, in the course of the monitoring of conformity following the issuance of a certificate, anotified body finds that a product no longer complies with the requirements laid down in thisRegulation, it shall require the manufacturer to take appropriate corrective measures and shallsuspend or withdraw the certificate if necessary.

6.

Where corrective measures are not taken or do not have the required effect, the notified bodyshall restrict, suspend or withdraw any certificates, as appropriate.

Article 37a
Appeal against decisions of notified bodies
Member States shall ensure that an appeal procedure against decisions of the notified bodies
is available.

Article 38
Information obligation on notified bodies
1.

Notified bodies shall inform the notifying authority of the following:(a)

any refusal, restriction, suspension or withdrawal of a certificate;(b)

any circumstances affecting the scope of and conditions for notification;(c)

any request for information which they have received from market surveillanceauthorities regarding conformity assessment activities;(d)on request, conformity assessment activities performed within the scope of theirnotification and any other activity performed, including cross-border activities andsubcontracting.

11726/23
ANNEX

JAI.2

EB/es

115

LIMITEEN

2.

Notified bodies shall provide the other bodies notified under this Regulation carrying out
similar conformity assessment activities covering the same products with relevant information
on issues relating to negative and, on request, positive conformity assessment results.

Article 39
Exchange of experience
The Commission shall provide for the organisation of exchange of experience between the Member
States' national authorities responsible for notification policy.
Article 40
Coordination of notified bodies
1.

The Commission shall ensure that appropriate coordination and cooperation between notified
bodies are put in place and properly operated in the form of a cross-sectoral group of notified
bodies.

2.

Member States shall ensure that the bodies notified by them participate in the work of thatgroup, directly or by means of designated representatives.

11726/23
ANNEX

JAI.2

EB/es

116

LIMITEENCHAPTER V
MARKET SURVEILLANCE AND ENFORCEMENT
Article 41
Market surveillance and control of products with digital elements in the Union market
1.

Regulation (EU) 2019/1020 shall apply to the products with digital elements within the scopeof this Regulation.

2.

Each Member State shall designate one or more market surveillance authorities for the
purpose of ensuring the effective implementation of this Regulation. Member States may
designate an existing or new authority to act as market surveillance authority for thisRegulation.

3.

Where relevant, the market surveillance authorities shall cooperate with the national
cybersecurity certification authorities designated under Article 58 of Regulation (EU)2019/881 and exchange information on a regular basis. With respect to the supervision of theimplementation of the reporting obligations pursuant to Article 11 of this Regulation, thedesignated market surveillance authorities shall cooperate with the CSIRTs designated ascoordinators pursuant to Article 12(1) of Directive (EU) 2022/2555 and ENISA.

4.

Where relevant, the market surveillance authorities shall cooperate with other market
surveillance authorities designated on the basis of other Union harmonisation legislation forother products, and exchange information on a regular basis.

11726/23
ANNEX

JAI.2

EB/es

117

LIMITEEN

5.

Market surveillance authorities shall cooperate, as appropriate, with the authorities
supervising Union data protection law. Such cooperation includes informing these authorities
of any finding relevant for the fulfilment of their competences, including when issuing
guidance and advice pursuant to paragraph 8 of this Article if such guidance and advice
concerns the processing of personal data.
Authorities supervising Union data protection law shall have the power to request and accessany documentation created or maintained under this Regulation when access to that
documentation is necessary for the fulfilment of their tasks. They shall inform the designatedmarket surveillance authorities of the Member State concerned of any such request.

6.

Member States shall ensure that the designated market surveillance authorities are provided
with adequate financial, and human and technical resources, including, where appropiate,
processing automation tools, to fulfil their tasks under this Regulation.

7.

The Commission shall facilitate the exchange of experience between designated market
surveillance authorities.

8.

Market surveillance authorities may provide guidance and advice to economic operators on
the implementation of this Regulation, with the support of the Commission.

9.

The market surveillance authorities shall report to the Commission on an annual basis theoutcomes of relevant market surveillance activities. The designated market surveillanceauthorities shall report, without delay, to the Commission and relevant national competition
authorities any information identified in the course of market surveillance activities that may
be of potential interest for the application of Union competition law.

11726/23
ANNEX

JAI.2

EB/es

118

LIMITEEN10.

For products with digital elements in the scope of this Regulation classified as high-risk AI
systems according to Article [Article 6] of the Regulation [the AI Regulation], the market
surveillance authorities designated for the purposes of the Regulation [the AI Regulation]
shall be the authorities responsible for market surveillance activities required under thisRegulation. The market surveillance authorities designated pursuant to Regulation [the AI
Regulation] shall cooperate, as appropriate, with the market surveillance authorities
designated pursuant to this Regulation and, with respect to the supervision of theimplementation of the reporting obligations pursuant to Article 11, with the CSIRTs
designated as coordinators pursuant to Article 12(1) of Directive (EU) 2022/2555
and ENISA. Market surveillance authorities designated pursuant to Regulation [the AI
Regulation] shall in particular inform market surveillance authorities designated pursuant tothis Regulation of any finding relevant for the fulfilment of their tasks in relation to theimplementation of this Regulation.

11.

A dedicated administrative cooperation group (ADCO) shall be established for the uniform
application of this Regulation, pursuant to Article 30(2) of Regulation (EU) 2019/1020. This
ADCO shall be composed of representatives of the designated market surveillance authorities
and, if appropriate, representatives of single liaison offices.

11a. ADCO may publish relevant statistics on categories of products with digital elements,
including about the average expected product lifetime, as specified by the manufacturer
pursuant to Article 10 (10a), per category of products with digital elements.

11726/23
ANNEX

JAI.2

EB/es

119

LIMITEEN

Article 42
Access to data and documentation
Where necessary to assess the conformity of products with digital elements and the processes put inplace by their manufacturers with the essential requirements set out in Annex I and upon a reasoned
request, the market surveillance authorities shall be granted access to the data, in a language easily
understood by them, required to assess the design, development, production and vulnerability
handling of such products, including related internal documentation of the respective economic
operator.

Article 43
Procedure at national level concerning products with digital elements presenting a significant
cybersecurity risk
1.

Where the market surveillance authority of a Member State has sufficient reasons to consider
that a product with digital elements, including its vulnerability handling, presents a significant
cybersecurity risk, it shall carry out an evaluation of the product with digital elements
concerned in respect of its compliance with all the requirements laid down in this Regulation.
The relevant economic operators shall cooperate as necessary with the market surveillanceauthority.
Where, in the course of that evaluation, the market surveillance authority finds that the
product with digital elements does not comply with the requirements laid down in thisRegulation, it shall without delay require the relevant economic operator to take allappropriate corrective actions to bring the product with digital elements into compliancewith those requirements, to withdraw it from the market, or to recall it within a reasonable
period, commensurate with the nature of the risk, as it the market surveillance authority
may prescribe.
The market surveillance authority shall inform the relevant notified body accordingly. Article
18 of Regulation (EU) 2019/1020 shall apply to the appropriate corrective actions.

11726/23
ANNEX

JAI.2

EB/es

120

LIMITEEN2.

Where the market surveillance authority considers that non-compliance is not restricted to its
national territory, it shall inform the Commission and the other Member States of the resultsof the evaluation and of the actions which it has required the economic operator to take.

3.

The manufacturer economic operator shall ensure that all any appropriate corrective action
is taken in respect of all the products with digital elements concerned that it has madeavailable on the market throughout the Union.

4.

Where the manufacturer economic operator of a product with digital elements does not takeadequate corrective action within the period referred to in paragraph 1, second subparagraph,the market surveillance authority shall take all appropriate provisional measures to prohibit or
restrict that product with digital elements from being made available on its national market,
to withdraw it from that market or to recall it.
That authority shall inform notify the Commission and the other Member States, without
delay, of those measures.

5.

The information referred to in paragraph 4 shall include all available details, in particular thedata necessary for the identification of the non-compliant products with digital elements, theorigin of the that product with digital elements, the nature of the alleged non-compliance andthe risk involved, the nature and duration of the national measures taken and the arguments
put forward by the relevant economic operator. In particular, the market surveillanceauthority shall indicate whether the non-compliance is due to one or more of the following:(a)a failure of the product with digital elements or of the processes put in place by the
manufacturer to meet the essential requirements set out in Annex I;(b)shortcomings in the harmonised standards, cybersecurity certification schemes, orcommon specifications, referred to in Article 18.

11726/23
ANNEX

JAI.2

EB/es

121

LIMITEEN6.

The market surveillance authorities of the Member States other than the market surveillanceauthority of the Member State initiating the procedure shall without delay inform theCommission and the other Member States of any measures adopted and of any additional
information at their disposal relating to the non-compliance of the product with digitalelements concerned, and, in the event of disagreement with the notified national measure, of
their objections.

7.

Where, within three months of receipt of the information notification referred to in paragraph4, no objection has been raised by either a Member State or the Commission in respect of aprovisional measure taken by a Member State, that measure shall be deemed justified. This iswithout prejudice to the procedural rights of the economic operator concerned in accordancewith Article 18 of Regulation (EU) 2019/1020.

8.

The market surveillance authorities of all Member States shall ensure that appropriate
restrictive measures are taken in respect of the product with digital elements concerned, suchas withdrawal of thate product from their market, without delay.

Article 44
Union safeguard procedure
1.

Where, within three months of receipt of the notification referred to in Article 43(4),objections are raised by a Member State against a measure taken by another Member State, orwhere the Commission considers the measure to be contrary to Union legislation law, theCommission shall without delay enter into consultation with the relevant Member State andthe economic operator or operators and shall evaluate the national measure. On the basis of
the results of that evaluation, the Commission shall decide whether the national measure isjustified or not within nine months from the notification referred to in Article 43(4) and notify
such that decision to the Member State concerned.

11726/23
ANNEX

JAI.2

EB/es

122

LIMITEEN

2.

If the national measure is considered justified, all Member States shall take the measuresnecessary to ensure that the non-compliant product with digital elements is withdrawn fromtheir market, and shall inform the Commission accordingly. If the national measure isconsidered unjustified, the Member State concerned shall withdraw the measure.

3.

Where the national measure is considered justified and the non-compliance of the productwith digital elements is attributed to shortcomings in the harmonised standards, theCommission shall apply the procedure provided for in Article 10 11 of Regulation (EU) No
1025/2012.

4.

Where the national measure is considered justified and the non-compliance of the productwith digital elements is attributed to shortcomings in a European cybersecurity certification
scheme as referred to in Article 18, the Commission shall consider whether to amend or
repeal the implementing act as referred to in Article 18(4) that specifies the presumption ofconformity concerning that certification scheme.

5.

Where the national measure is considered justified and the non-compliance of the productwith digital elements is attributed to shortcomings in common specifications as referred to in
Article 198, the Commission shall consider whether to amend or repeal the implementing act
referred to in Article 198 setting out those common specifications.

Article 45
Procedure at EU level concerning products with digital elements presenting a significant
cybersecurity risk
1.

Where the Commission has sufficient reasons to consider, including based on information
provided by ENISA, that a product with digital elements that presents a significant
cybersecurity risk is non-compliant with the requirements laid down in this Regulation, it
shall may request inform the relevant market surveillance authorities. to carry out anevaluation of compliance and follow the procedures referred to in Article 43. Where themarket surveillance authorities carry out an evaluation of that product with digitalelements that may present a significant cybersecurity risk in respect of its compliancewith the requirements laid down in this Regulation, the procedures referred to in
Articles 43 and 44 shall apply.

11726/23
ANNEX

JAI.2

EB/es

123

LIMITEEN

2.

In exceptional circumstances which justify an immediate intervention to preserve the goodfunctioning of the internal market and where the Commission has sufficient reasons to
consider that the product with digital elements referred to in paragraph 1 remains noncompliant with the requirements laid down in this Regulation and no effective measures havebeen taken by the relevant market surveillance authorities, the Commission may request
ENISA to provide an analysis to support carry out an evaluation of compliance. The
Commission shall inform the relevant market surveillance authorities accordingly. The
relevant economic operators shall cooperate as necessary with ENISA.

3.

Based on ENISA’sthe evaluation referred to in paragraph 2, the Commission may decidethat a corrective or restrictive measure is necessary at Union level. To this end, it shallwithout delay consult the Member States concerned and the relevant economic operator oroperators.

4.

On the basis of the consultation referred to in paragraph 3, the Commission may adopt
implementing acts to decide on corrective or restrictive measures at Union level, includingordering withdrawal of the product with digital elements from the market, or recalling of it,
within a reasonable period, commensurate with the nature of the risk. Those implementing
acts shall be adopted in accordance with the examination procedure referred to in Article
51(2).

5.

The Commission shall immediately communicate the decision implementing acts referred toin paragraph 4 to the relevant economic operator or operators. Member States shall implement
those acts referred to in paragraph 4 without delay and shall inform the Commission
accordingly.

6.

Paragraphs 2 to 5 are applicable for the duration of the exceptional situation that justified theCommission’s intervention and for as long as the respective product with digital elements
concerned is not brought in compliance with this Regulation.

11726/23
ANNEX

JAI.2

EB/es

124

LIMITEEN

Article 46
Compliant products with digital elements which present a significant cybersecurity risk
1.

The market surveillance authority of a Member State shall require an economic
operator to take appropriate measures where, having performed an evaluation under
Article 43, it finds that although a product with digital elements and the processes put inplace by the manufacturer are in compliance with this Regulation, it presents asignificant cybersecurity risk as well as a risk to:(a)the health or safety of persons;(b)the compliance with obligations under Union or national law intended to protect
fundamental rights;(c)the availability, authenticity, integrity or confidentiality of services offered using
an electronic information system by entities of a type referred to in Annex I to
Directive (EU) 2022/2555; or(d)other aspects of public interest protection.

The measures referred to in the first subparagraph may include measures to ensure thatthe product with digital elements concerned and the processes put in place by the
manufacturer no longer present the relevant risks [when made available on the market],withdrawal from the market of the product with digital elements concerned, or recallingof it, and shall be commensurate with the nature of those risks.

11726/23
ANNEX

JAI.2

EB/es

125

LIMITEEN1.

Where, having performed an evaluation under Article 43, the market surveillance authority ofa Member State finds that although a product with digital elements and the processes put inplace by the manufacturer are in compliance with this Regulation, they present a significant
cybersecurity risk and, in addition, they pose a risk to the health or safety of persons, to thecompliance with obligations under Union or national law intended to protect fundamental
rights, the availability authenticity, integrity or confidentiality of services offered using anelectronic information system by essential entities of the type referred to in [Annex I to
Directive XXX / XXXX (NIS2)] or to other aspects of public interest protection, it shallrequire the relevant operator to take all appropriate measures to ensure that the product withdigital elements and the processes put in place by the manufacturer concerned, when placedon the market, no longer present that risk, to withdraw the product with digital elements fromthe market or to recall it within a reasonable period, commensurate with the nature of the risk.

2.

The manufacturer or other relevant economic operators shall ensure that corrective action istaken in respect of the products with digital elements concerned that they have made available
on the market throughout the Union within the timeline established by the market surveillanceauthority of the Member State referred to in paragraph 1.

3.

The Member State shall immediately inform the Commission and the other Member States
about the measures taken pursuant to paragraph 1. That information shall include all available
details, in particular the data necessary for the identification of the products with digitalelements concerned, the origin and the supply chain of those products with digital elements,
the nature of the risks involved and the nature and duration of the national measures taken.

4.

The Commission shall without delay enter into consultation with the Member States and therelevant economic operator and shall evaluate the national measures taken. On the basis of theresults of that evaluation, the Commission shall decide whether the measure is justified or not
and, where necessary, propose appropriate measures.

11726/23
ANNEX

JAI.2

EB/es

126

LIMITEEN5.

The Commission shall address its decision to the Member States.

6.

Where the Commission has sufficient reasons to consider, including based on information
provided by ENISA, that a product with digital elements, although compliant with thisRegulation, presents the risks referred to in paragraph 1, it may request shall inform therelevant market surveillance authority. or authorities to carry out an evaluation ofcompliancethe risks and follow the procedures referred to in Article 43 and paragraphs 1, 2
and 3 of this Article.

7.

In exceptional circumstances which justify an immediate intervention to preserve the goodfunctioning of the internal market and where the Commission has sufficient reasons to
consider that the product with digital elements referred to in paragraph 6 continues to present
the risks referred to in paragraph 1, and no effective measures have been taken by the relevant
national market surveillance authorities, the Commission may request ENISA to provide ananalysis to supportcarry out an evaluation of the risks presented by that product with digitalelements and shall inform the relevant market surveillance authorities accordingly. The
relevant economic operators shall cooperate as necessary with ENISA.

8.

Based on ENISA’s the evaluation referred to in paragraph 7, the Commission may establishthat a corrective or restrictive measure is necessary at Union level. To this end, it shallwithout delay consult the Member States concerned and the relevant economic operator oroperators.

9.

On the basis of the consultation referred to in paragraph 8, the Commission may adopt
implementing acts to decide on corrective or restrictive measures at Union level, includingordering withdrawal of the product with digital elements from the market, or recalling of it,
within a reasonable period, commensurate with the nature of the risk. Those implementing
acts shall be adopted in accordance with the examination procedure referred to in Article
51(2).

11726/23
ANNEX

JAI.2

EB/es

127

LIMITEEN10.

The Commission shall immediately communicate the decision implementing acts referred toin the paragraph 9 to the relevant economic operator or operators. Member States shall
implement such those acts without delay and shall inform the Commission accordingly.

11.

Paragraphs 6 to 10 shall apply for the duration of the exceptional situation that justified theCommission’s intervention and for as long as the respective product with digital elements
concerned continues to present the risks referred to in paragraph 1.

Article 47
Formal non-compliance
1.

Where the market surveillance authority of a Member State makes one of the following
findings, it shall require the relevant manufacturer to end to the non-compliance concerned:(a)the conformity CE marking has been affixed in violation of Articles 21 and 22;(b)

the conformity CE marking has not been affixed;(c)the EU declaration of conformity has not been drawn up;(d)the EU declaration of conformity has not been drawn up correctly;(e)the identification number of the notified body, which is involved in the conformity
assessment procedure, where applicable, has not been affixed;(f)2.

the technical documentation is either not available or not complete.

Where the non-compliance referred to in paragraph 1 persists, the Member State concerned
shall take all appropriate measures to restrict or prohibit the product with digital elementsfrom being made available on the market or ensure that it is recalled or withdrawn from themarket.

11726/23
ANNEX

JAI.2

EB/es

128

LIMITEEN

Article 48
Joint activities of market surveillance authorities
1.

Market surveillance authorities may agree with other relevant authorities to carry out joint
activities aimed at ensuring cybersecurity and protection of consumers with respect to specificproducts with digital elements placed on the market or made available on the market, inparticular products with digital elements that are often found to present cybersecurity risks.

2.

The Commission or ENISA may propose joint activities for checking compliance with thisRegulation to be conducted by market surveillance authorities based on indications orinformation of potential non-compliance across several Member States of products withdigital elements falling in the scope of this Regulation with the requirements laid down by
the latterherein.

3.

The market surveillance authorities and, where applicable, the Commission, whereapplicable, shall ensure that the agreement to carry out joint activities does not lead to unfair
competition between economic operators and does not negatively affect the objectivity,
independence and impartiality of the parties to the agreement.

4.

A market surveillance authority may use any information resulting from the joint activities
carried out as part of any investigation that it undertakes.

5.

The market surveillance authority concerned and, where applicable, the Commission, whereapplicable, shall make the agreement on joint activities, including the names of the parties
involved, available to the public.

11726/23
ANNEX

JAI.2

EB/es

129

LIMITEEN

Article 49
Sweeps1.

Market surveillance authorities may decide to conduct simultaneous coordinated control
actions (“sweeps”) of particular products with digital elements or categories thereof to checkcompliance with or to detect infringements to this Regulation.

2.

Unless otherwise agreed upon by the market surveillance authorities involved, sweeps shall becoordinated by the Commission. The coordinator of the sweep may, where appropriate, makethe aggregated results publicly available.

3.

ENISA may identify, in the performance of its tasks, including based on the notifications
received according to Article 11(1) and (2), categories of products with digital elements forwhich sweeps may be organised. The proposal for sweeps shall be submitted to the potential
coordinator referred to in paragraph 2 for the consideration of the market surveillanceauthorities.

4.

When conducting sweeps, the market surveillance authorities involved may use theinvestigation powers set out Articles 41 to 47 and any other powers conferred upon them bynational law.

5.

Market surveillance authorities may invite Commission officials, and other accompanying
persons authorised by the Commission, to participate in sweeps.

11726/23
ANNEX

JAI.2

EB/es

130

LIMITEENCHAPTER VI
DELEGATED POWERS AND COMMITTEE PROCEDURE
Article 50
Exercise of the delegation
1.

The power to adopt delegated acts is conferred on the Commission subject to the conditions
laid down in this Article.

2.

The power to adopt delegated acts referred to in Article 2(4), Article 6(2), Article 6(3),Article 6a(1), Article 6a(25), Article 20(5) and Article 23(5) shall be conferred on theCommission for a period of five years from … [date of entry into force of thisRegulation]. The Commission shall draw up a report in respect of the delegation of
power not later than nine months before the end of the five-year period. The delegationof power shall be tacitly extended for periods of an identical duration, unless theEuropean Parliament or the Council opposes such extension not later than three months
before the end of each period.

3.

The delegation of power referred to in Article 2(4), Article 6(2), Article 6(3), Article 6a(1),Article 6a(25), Article 20(5) and Article 23(5) may be revoked at any time by the European
Parliament or by the Council. A decision to revoke shall put an end to the delegation of thepower specified in that decision. It shall take effect the day following the publication of thedecision in the Official Journal of the European Union or at a later date specified therein. It
shall not affect the validity of any delegated acts already in force.

11726/23
ANNEX

JAI.2

EB/es

131

LIMITEEN

4.

Before adopting a delegated act, the Commission shall consult experts designated by each
Member State in accordance with principles laid down in the Inter-institutional Agreement of
13 April 2016 on Better Law-Making.

5.

As soon as it adopts a delegated act, the Commission shall notify it simultaneously to theEuropean Parliament and to the Council.

6.

A delegated act adopted pursuant to Article 2(4), Article 6(2), Article 6(3), Article 6a(1),Article 6a(25), Article 20(5) and Article 23(5) shall enter into force only if no objection has
been expressed either by the European Parliament or by the Council within a period of twomonths of notification of that act to the European Parliament and to the Council or if, before
the expiry of that period, the European Parliament and the Council have both informed theCommission that they will not object. That period shall be extended by two months at theinitiative of the European Parliament or of the Council.

Article 51
Committee procedure
1.

The Commission shall be assisted by a committee. That committee shall be a committee
within the meaning of Regulation (EU) No 182/2011.

2.

Where reference is made to this paragraph, Article 5 of Regulation (EU) No 182/2011 shallapply.

3.

Where the opinion of the committee is to be obtained by written procedure, that procedure
shall be terminated without result when, within the time-limit for delivery of the opinion, thechair of the committee so decides or a committee member so requests.

11726/23
ANNEX

JAI.2

EB/es

132

LIMITEENCHAPTER VII
CONFIDENTIALITY AND PENALTIESArticle 52
Confidentiality
1.

All parties involved in the application of this Regulation shall respect the confidentiality of
information and data obtained in carrying out their tasks and activities in such a manner as toprotect, in particular:(a)intellectual property rights, and confidential business information or trade secrets of anatural or legal person, including source code, except the cases referred to in Article 5
of Directive 2016/943 of the European Parliament and of the Council33;(b)

the effective implementation of this Regulation, in particular for the purpose of
inspections, investigations or audits;

2.

(c)

public and national security interests;(d)integrity of criminal or administrative proceedings.

Without prejudice to paragraph 1, information exchanged on a confidential basis between themarket surveillance authorities and between market surveillance authorities and theCommission shall not be disclosed without the prior agreement of the originating market
surveillance authority.

33

Directive (EU) 2016/943 of the European Parliament and of the Council of 8 June 2016 on
the protection of undisclosed know-how and business information (trade secrets) against
their unlawful acquisition, use and disclosure (OJ L 157, 15.6.2016, p. 1).

11726/23
ANNEX

JAI.2

EB/es

133

LIMITE

EN

3.

Paragraphs 1 and 2 shall not affect the rights and obligations of the Commission, Member
States and notified bodies with regard to the exchange of information and the dissemination of
warnings, nor the obligations of the persons concerned to provide information under criminal
law of the Member States.

4.

The Commission and Member States may exchange, where necessary, sensitive information
with relevant authorities of third countries with which they have concluded bilateral or
multilateral confidentiality arrangements guaranteeing an adequate level of protection.

Article 53
Penalties
1.

Member States shall lay down the rules on penalties applicable to infringements by economic
operators of this Regulation and shall take all measures necessary to ensure that they are
enforcedimplemented. The penalties provided for shall be effective, proportionate anddissuasive.

2.

Member States shall, without delay, notify the Commission of those rules and of thosemeasures and shall notify it without delay of any subsequent amendment affecting them.

3.

The non-compliance with the essential cybersecurity requirements laid down in Annex I andthe obligations set out in Articles 10 and 11 shall be subject to administrative fines of up to 15
000 000 EUR or, if the offender is an undertaking, up to 2.5 % of the its total worldwide
annual turnover for the preceding financial year, whichever is higher.

11726/23
ANNEX

JAI.2

EB/es

134

LIMITEEN4.

The non-compliance with any other the obligations set out in Articles [Articles12; 13; 14;
15; 16; 17; 20; 22 (1)-(4); 23 (1)-(4); 24(1)-(3); 29; 31; 37; 38; 42] under this Regulation
shall be subject to administrative fines of up to 10 000 000 EUR or, if the offender is anundertaking, up to 2 % of its total worldwide annual turnover for the preceding financial year,
whichever is higher.

5.

The supply of incorrect, incomplete or misleading information to notified bodies and market
surveillance authorities in reply to a request shall be subject to administrative fines of up to 5
000 000 EUR or, if the offender is an undertaking, up to 1 % of its total worldwide annual
turnover for the preceding financial year, whichever is higher.

6.

When deciding on the amount of the administrative fine in each individual case, all relevant
circumstances of the specific situation shall be taken into account and due regard shall begiven to the following:(a)the nature, gravity and duration of the infringement and of its consequences;(b)whether administrative fines have been already applied by other market surveillanceauthorities to the same economic operator for a similar infringement;(c)7.

the size and market share of the economic operator committing the infringement.

Market surveillance authorities that apply administrative fines shall share communicate thisto information with the market surveillance authorities of other Member States through theinformation and communication system referred to in Article 34 of Regulation (EU)2019/1020.

11726/23
ANNEX

JAI.2

EB/es

135

LIMITEEN8.

Each Member State shall lay down rules on whether and to what extent administrative fines
may be imposed on public authorities and public bodies established in that Member State.

9.

Depending on the legal system of the Member States, the rules on administrative fines may be
applied in such a manner that the fines are imposed by competent national courts or otherbodies according to the competences established at national level in those Member States. The
application of such rules in those Member States shall have an equivalent effect.

10.

Administrative fines may be imposed, depending on the circumstances of each individual
case, in addition to any other corrective or restrictive measures applied by the market
surveillance authorities for the same infringement.

CHAPTER VIII
TRANSITIONAL AND FINAL PROVISIONS
Article 54
Amendment to Regulation (EU) 2019/1020
In Annex I to Regulation (EU) 2019/1020 the following point is added:’71. [Regulation XXX][Cyber Resilience Act]’.

Article 54a
Representative actions
Directive (EU) 2020/1828 shall apply to the representative actions brought against
infringements by economic operators of provisions of this Regulation that harm, or may
harm, the collective interests of consumers.

11726/23
ANNEX

JAI.2

EB/es

136

LIMITEEN

Article 54b
Amendment to Directive (EU) 2020/1828
In Annex I to Directive (EU) 2020/1828, the following point is added:'(XX)[Regulation XXX][Cyber Resilience Act]'

Article 55
Transitional provisions
1.

EU type-examination certificates and approval decisions issued regarding cybersecurity
requirements for products with digital elements that are subject to other Union harmonisation
legislation shall remain valid until [42 months after the date of entry into force of thisRegulation], unless they expire before that date, or unless otherwise specified in other Union
legislation, in which case they shall remain valid as referred to in that Union legislation.

2.

Products with digital elements that have been placed on the market before [date of applicationof this Regulation referred to in Article 57], shall be subject to requirements of thisRegulation only if, from that date, those products are subject to substantial modifications intheir design or intended purpose.

3.

By way of derogation from paragraph 2, the obligations laid down in Article 11 shall apply toall products with digital elements within the scope of this Regulation that have been placed on
the market before [date of application of this Regulation referred to in Article 57].

11726/23
ANNEX

JAI.2

EB/es

137

LIMITEEN

Article 56
Evaluation and review
By [36 months after the date of application of this Regulation] and every four years thereafter, theCommission shall submit a report on the evaluation and review of this Regulation to the European
Parliament and to the Council. The reports shall be made public.

Article 57
Entry into force and application
This Regulation shall enter into force on the twentieth day following that of its publication in the
Official Journal of the European Union.
It shall apply from [24 36 months after the date of entry into force of this Regulation]. However
Article 11 shall apply from [12 24 months after the date of entry into force of this Regulation].
This Regulation shall be binding in its entirety and directly applicable in all Member States.
Done at Brussels,

For the European Parliament
The President

11726/23
ANNEX

For the Council
The President

JAI.2

EB/es

138

LIMITEEN

ANNEX IESSENTIAL CYBERSECURITY REQUIREMENTS

1.

SECURITY REQUIREMENTS RELATING TO THE PROPERTIES OF PRODUCTS
WITH DIGITAL ELEMENTS
1.

Products with digital elements shall be designed, developed and produced in such a
way that they enable ensure an appropriate level of cybersecurity based on the risks;

2.

Products with digital elements shall be delivered without any known exploitable
vulnerabilities;

3.

On the basis of the cybersecurity risk assessment referred to in Article 10(2) andwhere applicable, products with digital elements shall:(aa) be placed on the market without any known exploitable vulnerabilities;(a)be placed on the market delivered with a secure by default configuration,
including the possibility to reset the product to its original state, and including adefault setting that security updates be installed automatically according torequirements in point (aaa) of this section and Annex II (9), with a clear andeasy- to-use opt-out mechanism.

(aaa) where applicable under Annex I,1 (3)a of this section, set as a default setting– which can be switched off – that security updates are installed
automatically on products with digital elements if not installed within acertain timeframe;

11726/23
ANNEX I

JAI.2

EB/es

139

LIMITEEN

(b)ensure protection from unauthorised access by appropriate control mechanisms,
including but not limited to authentication, identity or access management
systems;(c)

protect the confidentiality of stored, transmitted or otherwise processed data,
personal or other, such as by encrypting relevant data at rest or in transit by stateof the art mechanisms;(d)protect the integrity of stored, transmitted or otherwise processed data, personal orother, commands, programs and configuration against any manipulation or
modification not authorised by the user, as well as report on corruptions;(e)process only data, personal or other, that are adequate, relevant and limited towhat is necessary in relation to the intended use purpose of the product(‘minimisation of data’);(f)protect the availability of essential functions, including the resilience against andmitigation of denial of service attacks;(g)minimise their own negative impact by themselves or connected devices on theavailability of services provided by other devices or networks;(h)be designed, developed and produced to limit attack surfaces, including externalinterfaces;(i)be designed, developed and produced to reduce the impact of an incident using
appropriate exploitation mitigation mechanisms and techniques;

11726/23
ANNEX I

JAI.2

EB/es

140

LIMITEEN(j)provide security related information by recording and/or monitoring relevantinternal activity, including the access to or modification of data, services orfunctions;(k)ensure enable that vulnerabilities can be addressed through security updates,
including, where applicable, through automatic updates by default, but with aclear and easy-to-use opt-out mechanism, and where applicable through thenotification of available updates to users, and the option to temporarily
postpone them;(l)provide the possibility for users to securely and easily remove all data andsettings and, where such data can be transferred to other products or
systems, ensure this is done in a secure manner.

2.

VULNERABILITY HANDLING REQUIREMENTS
Manufacturers of the products with digital elements shall:
1.

identify and document vulnerabilities and components contained in the product,
including by drawing up a software bill of materials in a commonly used and machinereadable format covering at the very least the top-level dependencies of the product;2.

in relation to the risks posed to the products with digital elements, address andremediate vulnerabilities without delay, including by providing security updates;3.

apply effective and regular tests and reviews of the security of the product with digitalelements;

11726/23
ANNEX I

JAI.2

EB/es

141

LIMITEEN

4.

once a security update has been made available, publically disclose information about
fixed vulnerabilities, including a description of the vulnerabilities, information allowing
users to identify the product with digital elements affected, the impacts of thevulnerabilities, their severity and clear and user friendly information helping users toremediate the vulnerabilities; in duly justified cases, where manufacturers consider
the security risks of publication to outweigh the security benefits, they may delay
making public information regarding a fixed vulnerability until after users havebeen given the possibility to apply the relevant patch;5.

put in place and enforce a policy on coordinated vulnerability disclosure;6.

take measures to facilitate the sharing of information about potential vulnerabilities intheir product with digital elements as well as in third party components contained in that
product, including by providing a contact address for the reporting of the vulnerabilities
discovered in the product with digital elements;

7.

in relation to the cybersecurity risks posed to the products with digital elements,
provide for mechanisms to securely distribute updates for products with digital elements
to ensure that exploitable vulnerabilities are fixed or mitigated in a timely and, whereapplicable, automatic manner;

8.

ensure that, where security patches or updates are available to address identified
security issues, they are disseminated without delay and free of charge, accompanied byadvisory messages providing users with the relevant information, including on potential
action to be taken.

11726/23
ANNEX I

JAI.2

EB/es

142

LIMITEEN

ANNEX IIINFORMATION AND INSTRUCTIONS TO THE USER
As a minimum, the product with digital elements shall be accompanied by:(1)

the name, registered trade name or registered trade mark of the manufacturer, and the postal
address, and the email address or other digital contact as well as, where applicable, thewebsite at which the manufacturer can be contacted, on the product or, where that is notpossible, on its packaging or in a document accompanying the product;(2)

the single point of contact where information about cybersecurity vulnerabilities of the
product with digital elements can be reported and received;(3)

Name and type and any additional information enabling the unique correct identificationof the type, batch, version or serial number or other element allowing the identification of the
product and the corresponding instructions and user information;(4)

the intended purpose use, including the security environment provided by the manufacturer,
as well as the product’s essential functionalities and information about the security properties;(5)

any known or foreseeable circumstance, related to the use of the product with digital elementsin accordance with its intended purpose or under conditions of reasonably foreseeable misuse,
which may lead to significant cybersecurity risks;(6)

if and, where applicable, where the software bill of materials can be accessed;(7)

where applicable, the internet address at which the full EU declaration of conformity can beaccessed;

11726/23
ANNEX II

JAI.2

EB/es

143

LIMITEEN(8)the type of technical security support offered by the manufacturer, expected product lifetimeand end-date and until when it the technical security support will be provided, at the very
least until when users can expect to receive security updates;(9)

detailed instructions or, where applicable, an internet address referring to such detailed
instructions and information on:(a)the necessary measures during initial commissioning and throughout the lifetime of the
product to ensure its secure use;(b)

how changes to the product can affect the security of data;(c)

how security-relevant updates can be installed;(d)the secure decommissioning of the product, including information on how user data canbe securely removed;(e)

how the default setting of automatically installed updates, as required by point(aaa) of section 1.3 of Annex I, can be turned off.

(10) If the manufacturer decides to make available the software bill of materials to the user,
the information and instructions to the user accompanying the product with digitalelements shall also include that software bill of materials as set out in Section 2, point (1)of Annex I.

11726/23
ANNEX II

JAI.2

EB/es

144

LIMITEEN

ANNEX III

CLASSES AND CATEGORIES OF CRITICAL PRODUCTS WITH DIGITAL ELEMENTS
Class I
Categories of products with digital elements which meet the criteria referred to in Article
6(1a), point (a):1. Identity management systems software and privileged access management software;
2. Standalone and embedded browsers;
3. Password managers;
4.Software that searches for, removes, or quarantines malicious software;
5. Products with digital elements with the function of virtual private network (VPN);
6. Network management systems;
7. Network configuration management tools;
8.Network traffic monitoring systems;
9. Management of network resources;
10. Security information and event management (SIEM) systems;
11. Update/patch management, including General purpose boot managers;
12. Application configuration management systems;
13. Remote access/sharing software;
14. Mobile device management software;
17. Firewalls, intrusion detection and/or prevention systems not covered by class II;

11726/23
ANNEX III

JAI.2

EB/es

145

LIMITEEN3. Public key infrastructure and digital certificate issuersance software;
Categories of products with digital elements which meet the criteria referred to in Article
6(1a), point (b):16. General purpose Ooperating systems not covered by class II;
15. Physical and virtual network interfaces;
18. Routers, modems intended for the connection to the internet, and switches, not covered by class
II
19. Microprocessors not covered by class II;
20. Microcontrollers;
21. Application specific integrated circuits (ASIC) and field-programmable gate arrays (FPGA)
intended for the use by essential entities of the type referred to in [Annex I to the Directive
XXX/XXXX (NIS2)];
22. Products that are intended for use in Industrial Automation & Control Systems (IACS), such as
programmable logic controllers (PLC), distributed control systems (DCS), computerised numericcontrollers for machine tools (CNC) and supervisory control and data acquisition systems(SCADA);
23. Industrial Internet of Things not covered by class II;

11726/23
ANNEX III

JAI.2

EB/es

146

LIMITEEN

Class II
Categories of products with digital elements which meet both criteria referred to in Article
6(2), points (a) and (b):1. Operating systems for servers, desktops, and mobile devices;
1. Products with digital elements that support virtual private network (VPN) functions such
as VPN server and clients;
2. Hypervisors and container runtime systems that support virtualised execution of operating
systems and similar environments;
3.Public key infrastructure and digital certificate issuers;
4.Firewalls, intrusion detection and/or prevention systems intended for industrial use;
5.General purpose microprocessors;
6. Microprocessors intended for integration in programmable logic controllers and secure elements;
7.Routers, modems intended for the connection to the internet, and switches, intended for industrialuse;
8. Secure Elements;
9. Hardware Security Modules (HSMs);
10. Secure cryptoprocessors;
11. Smartcards, smartcard readers and tokens.
3. Firewalls, intrusion detection and/or prevention systems intended for industrial use.

11726/23
ANNEX III

JAI.2

EB/es

147

LIMITEEN

12. Industrial Automation & Control Systems (IACS) intended for the use by essential entities of
the type referred to in [Annex I to the Directive XXX/XXXX (NIS2)], such as programmable logic
controllers (PLC), distributed control systems (DCS), computerised numeric controllers for machine
tools (CNC) and supervisory control and data acquisition systems (SCADA);
13. Industrial Internet of Things devices intended for the use by essential entities of the typereferred to in [Annex I to the Directive XXX/XXXX (NIS2)];
14.

Robot sensing and actuator components and robot controllers;

15.

Smart meters.

11726/23
ANNEX III

JAI.2

EB/es

148

LIMITEEN

ANNEX IIIa
CATEGORIES OF PRODUCTS WITH DIGITAL ELEMENTS SUBJECT TO THE
PROCEDURE PROVIDED FOR IN ARTICLE 6A

1.

Hardware Devices with Security Boxes;

2.

Smart meter gateways within smart metering systems as defined in Article 2 (23) of
Directive (EU) 2019/944 and other devices for advanced security purposes, including for
secure cryptoprocessing;3.

Smartcards or similar devices, including secure elements.

11726/23
ANNEX III

JAI.2

EB/es

149

LIMITEEN

ANNEX IIIb
SIMPLIFIED EU DECLARATION OF CONFORMITY
The simplified EU declaration of conformity referred to in Article [10(11)] shall be provided
as follows:
Hereby, [Name of manufacturer] declares that the product with digital elements type[designation of type of product with digital element] is in compliance with Regulation XX.
The full text of the EU declaration of conformity is available at the following internet address:

11726/23
ANNEX [XX]IIIb

JAI.2

EB/es

150

LIMITEEN

ANNEX IV
EU DECLARATION OF CONFORMITYThe EU declaration of conformity referred to in Article 20, shall contain all of the following
information:
1.

Name and type and any additional information enabling the unique identification of the
product with digital elements;

2.

Name and address of the manufacturer or his authorised representative;

3.

A statement that the EU declaration of conformity is issued under the sole responsibility ofthe provider;

4.

Object of the declaration (identification of the product allowing traceability. It may include aphotograph, where appropriate);

5.

A statement that the object of the declaration described above is in conformity with therelevant Union harmonisation legislation;

6.

References to any relevant harmonised standards used or any other common specification or
cybersecurity certification in relation to which conformity is declared;

7.

Where applicable, the name and number of the notified body, a description of the conformity
assessment procedure performed and identification of the certificate issued;

8.

Additional information:
Signed for and on behalf of: …………………………………
(place and date of issue):(name, function) (signature):

11726/23
ANNEX IV

JAI.2

EB/es

151

LIMITEEN

ANNEX V
CONTENTS OF THE TECHNICAL DOCUMENTATION
The technical documentation referred to in Article 23 shall contain at least the following
information, as applicable to the relevant product with digital elements:
1.

a general description of the product with digital elements, including:(a)

its intended purpose;(b)versions of software affecting compliance with essential requirements;(c)where the product with digital elements is a hardware product, photographs orillustrations showing external features, marking and internal layout;(d)2.

user information and instructions as set out in Annex II;

a description of the design, development and production of the product and vulnerability
handling processes, including:(a)complete information on the design and development of the product with digitalelements, including, where applicable, drawings and schemes and/or a description of thesystem architecture explaining how software components build on or feed into eachother and integrate into the overall processing;(b)

complete information and specifications of the vulnerability handling processes put inplace by the manufacturer, including the software bill of materials, the coordinatedvulnerability disclosure policy, evidence of the provision of a contact address for thereporting of the vulnerabilities and a description of the technical solutions chosen forthe secure distribution of updates;

11726/23
ANNEX V

JAI.2

EB/es

152

LIMITEEN(c)complete information and specifications of the production and monitoring processes ofthe product with digital elements and the validation of these processes.

3.

an assessment of the cybersecurity risks against which the product with digital elements isdesigned, developed, produced, delivered and maintained as laid down in Article 10 of thisRegulation;

4.

a list of the harmonised standards applied in full or in part the references of which have been
published in the Official Journal of the European Union, common specifications as set out in
Article 19 of this Regulation or cybersecurity certification schemes under Regulation (EU)2019/881 pursuant to Article 18(3), and, where those harmonised standards, common
specifications or cybersecurity certification schemes have not been applied, descriptions of
the solutions adopted to meet the essential requirements set out in Sections 1 and 2 of Annex
I, including a list of other relevant technical specifications applied. In the event of partly
applied harmonised standards, common specifications or cybersecurity certifications, thetechnical documentation shall specify the parts which have been applied;5.

reports of the tests carried out to verify the conformity of the product and of the vulnerability
handling processes with the applicable essential requirements as set out in Sections 1 and 2 ofAnnex I;6.

a copy of the EU declaration of conformity;

7.

where applicable, the software bill of materials as defined in Article 3, point (36), further to areasoned request from a market surveillance authority provided that it is necessary in order forthis authority to be able to check compliance with the essential requirements set out in AnnexI.

11726/23
ANNEX V

JAI.2

EB/es

153

LIMITEEN

ANNEX VI
CONFORMITY ASSESSMENT PROCEDURES
Conformity Assessment procedure based on internal control (based on Module A)
1.

Internal control is the conformity assessment procedure whereby the manufacturer fulfils theobligations laid down in points 2, 3 and 4, and ensures and declares on its sole responsibility
that the products with digital elements satisfy all the essential requirements set out in Section
1 of Annex I and the manufacturer meets the essential requirements set out in Section 2 ofAnnex I.

2.

The manufacturer shall draw up the technical documentation described in Annex V.

3.

Design, development, production and vulnerability handling of products with digital elements
The manufacturer shall take all measures necessary so that the design, development,
production and vulnerability handling processes and their monitoring ensure compliance ofthe manufactured or developed products with digital elements and of the processes put inplace by the manufacturer with the essential requirements set out in sections 1 and 2 of Annex
I.

4.

Conformity marking and declaration of conformity

4.1. The manufacturer shall affix the CE to each individual product with digital elements thatsatisfies the applicable requirements of this Regulation.

11726/23
ANNEX VI

JAI.2

EB/es

154

LIMITE

EN

4.2. The manufacturer shall draw up a written EU declaration of conformity for each product withdigital elements in accordance with Article 20 and keep it together with the technicaldocumentation at the disposal of the national authorities for 10 years after the product withdigital elements has been placed on the market. The EU declaration of conformity shallidentify the product with digital elements for which it has been drawn up. A copy of the EU
declaration of conformity shall be made available to the relevant authorities upon request.
5.

Authorised representatives
The manufacturer’s obligations set out in point 4 may be fulfilled by his authorised
representative, on his behalf and under his responsibility, provided that they are specified in
the mandate.

EU-type examination (based on Module B)
1.

EU-type examination is the part of a conformity assessment procedure in which a notified
body examines the technical design and development of a product and the vulnerability
handling processes put in place by the manufacturer, and attests that a product with digitalelements meets the essential requirements set out in Section 1 of Annex I and that the
manufacturer meets the essential requirements set out in Section 2 of Annex I.

2.

EU-type examination shall be carried out by assessment of the adequacy of the technicaldesign and development of the product through examination of the technical documentationand supporting evidence referred to in point 3, plus examination of specimens of one or morecritical parts of the product (combination of production type and design type).

11726/23
ANNEX VI

JAI.2

EB/es

155

LIMITEEN3.

The manufacturer shall lodge an application for EU-type examination with a single notified
body of his choice.
The application shall include:– the name and address of the manufacturer and, if the application is lodged by theauthorised representative, his name and address as well;– a written declaration that the same application has not been lodged with any othernotified body;– the technical documentation, which shall make it possible to assess the product's
conformity with the applicable essential requirements as set out in Section 1 of Annex I
and the manufacturer's vulnerability handling processes set out in Section 2 of Annex I,
and shall include an adequate analysis and assessment of the risk(s). The technicaldocumentation shall specify the applicable requirements and cover, as far as relevant for
the assessment, the design, manufacture and operation of the product. The technicaldocumentation shall contain, wherever applicable, at least the elements set out in Annex
V;– the supporting evidence for the adequacy of the technical design and development
solutions and vulnerability handling processes. This supporting evidence shall mention
any documents that have been used, in particular where the relevant harmonised
standards and/or technical specifications have not been applied in full. The supporting
evidence shall include, where necessary, the results of tests carried out by theappropriate laboratory of the manufacturer, or by another testing laboratory on hisbehalf and under his responsibility.

11726/23
ANNEX VI

JAI.2

EB/es

156

LIMITEEN4.

The notified body shall:

4.1

examine the technical documentation and supporting evidence to assess the adequacy of thetechnical design and development of the product with the essential requirements set out in
Section 1 of Annex I and of the vulnerability handling processes put in place by the
manufacturer with the essential requirements set out in Section 2 of Annex I;

4.2

verify that the specimen(s) have been developed or manufactured in conformity with thetechnical documentation, and identify the elements which have been designed and developedin accordance with the applicable provisions of the relevant harmonised standards and/or
technical specifications, as well as the elements which have been designed and developed
without applying the relevant provisions of those standards;

4.3

carry out appropriate examinations and tests, or have them carried out, to check whether,where the manufacturer has chosen to apply the solutions in the relevant harmonised
standards and/or technical specifications for the requirements set out in Annex I, these havebeen applied correctly;

4.4

carry out appropriate examinations and tests, or have them carried out, to check whether,where the solutions in the relevant harmonised standards and/or technical specifications forthe requirements set out in Annex I have not been applied, the solutions adopted by the
manufacturer meet the corresponding essential requirements;

4.5

agree with the manufacturer on a location where the examinations and tests will be carriedout.

11726/23
ANNEX VI

JAI.2

EB/es

157

LIMITEEN5.

The notified body shall draw up an evaluation report that records the activities undertaken inaccordance with point 4 and their outcomes. Without prejudice to its obligations vis-à-vis thenotifying authorities, the notified body shall release the content of that report, in full or inpart, only with the agreement of the manufacturer.

6.

Where the type and the vulnerability handling processes meet the essential requirements set
out in Annex I, the notified body shall issue an EU-type examination certificate to the
manufacturer. The certificate shall contain the name and address of the manufacturer, theconclusions of the examination, the conditions (if any) for its validity and the necessary datafor identification of the approved type and vulnerability handling processes. The certificate
may have one or more annexes attached.
The certificate and its annexes shall contain all relevant information to allow the conformityof manufactured or developed products with the examined type and vulnerability handlingprocesses to be evaluated and to allow for in-service control.
Where the type and the vulnerability handling processes do not satisfy the applicable essential
requirements set out in Annex I, the notified body shall refuse to issue an EU-type
examination certificate and shall inform the applicant accordingly, giving detailed reasons for
its refusal.

7.

The notified body shall keep itself apprised of any changes in the generally acknowledged
state of the art which indicate that the approved type and the vulnerability handling processes
may no longer comply with the applicable essential requirements set out in Annex I to thisRegulation, and shall determine whether such changes require further investigation. If so, thenotified body shall inform the manufacturer accordingly.

11726/23
ANNEX VI

JAI.2

EB/es

158

LIMITEENThe manufacturer shall inform the notified body that holds the technical documentation
relating to the EU-type examination certificate of all modifications to the approved type andthe vulnerability handling processes that may affect the conformity with the essential
requirements set out in Annex I, or the conditions for validity of the certificate. Suchmodifications shall require additional approval in the form of an addition to the original EUtype examination certificate.
8.

Each notified body shall inform its notifying authorities concerning the EU-type examination
certificates and/or any additions thereto which it has issued or withdrawn, and shall,periodically or upon request, make available to its notifying authorities the list of certificates
and/or any additions thereto refused, suspended or otherwise restricted.
Each notified body shall inform the other notified bodies concerning the EU-type examination
certificates and/or any additions thereto which it has refused, withdrawn, suspended orotherwise restricted, and, upon request, concerning the certificates and/or additions thereto
which it has issued.
The Commission, the Member States and the other notified bodies may, on request, obtain acopy of the EU-type examination certificates and/or additions thereto. On request, theCommission and the Member States may obtain a copy of the technical documentation andthe results of the examinations carried out by the notified body. The notified body shall keep a
copy of the EU-type examination certificate, its annexes and additions, as well as thetechnical file including the documentation submitted by the manufacturer, until the expiry of
the validity of the certificate.

9.

The manufacturer shall keep a copy of the EU-type examination certificate, its annexes andadditions together with the technical documentation at the disposal of the national authorities
for 10 years after the product has been placed on the market.

10.

The manufacturer's authorised representative may lodge the application referred to in point 3
and fulfil the obligations set out in points 7 and 9, provided that they are specified in the
mandate.

11726/23
ANNEX VI

JAI.2

EB/es

159

LIMITEEN

Conformity to type based on internal production control (based on Module C)
1.

Conformity to type based on internal production control is the part of a conformity assessment
procedure whereby the manufacturer fulfils the obligations laid down in points 2 and 3, andensures and declares that the products concerned are in conformity with the type described in
the EU-type examination certificate and satisfy the essential requirements set out in Section 1of Annex I and that the manufacturer meets the essential requirements set out in Section
2 of Annex I.

2.

Production

2.1

The manufacturer shall take all measures necessary so that the production and its monitoring
ensure conformity of the manufactured products with the approved type described in the EUtype examination certificate and with the essential requirements as set out in Section 1 ofAnnex I and ensures that the manufacturer meets the essential requirements set out in
Section 2 of Annex I.

3.

Conformity marking and declaration of conformity

3.1

The manufacturer shall affix the CE marking to each individual product that is in conformity
with the type described in the EU-type examination certificate and satisfies the applicablerequirements of the legislative instrument.

3.2

The manufacturer shall draw up a written declaration of conformity for a product model andkeep it at the disposal of the national authorities for 10 years after the product has been placedon the market. The declaration of conformity shall identify the product model for which it has
been drawn up. A copy of the declaration of conformity shall be made available to therelevant authorities upon request.

4.

Authorised representative
The manufacturer's obligations set out in point 3 may be fulfilled by his authorised
representative, on his behalf and under his responsibility, provided that they are specified in
the mandate.

11726/23
ANNEX VI

JAI.2

EB/es

160

LIMITEEN

Conformity based on full quality assurance (based on Module H)
1.

Conformity based on full quality assurance is the conformity assessment procedure whereby
the manufacturer fulfils the obligations laid down in points 2 and 5, and ensures and declareson his sole responsibility that the products (or product categories) concerned satisfy the
essential requirements set out in Section 1 of Annex I, and that the vulnerability handlingprocesses put in place by the manufacturer meet the requirements set out in Section 2 ofAnnex I.

2.

Design, development, production and vulnerability handling of products with digital elements
The manufacturer shall operate an approved quality system as specified in point 3 for thedesign, development, and production of the products concerned and for handlingvulnerabilities, maintain its effectiveness throughout the lifecycle of the products concerned,
and shall be subject to surveillance as specified in point 4.

3.

Quality system

3.1

The manufacturer shall lodge an application for assessment of his quality system with thenotified body of his choice, for the products concerned.
The application shall include:– the name and address of the manufacturer and, if the application is lodged by theauthorised representative, his name and address as well;– the technical documentation for one model of each category of products intended to be
manufactured or developed. The technical documentation shall, wherever applicable,
contain at least the elements as set out in Annex V;– the documentation concerning the quality system; and– a written declaration that the same application has not been lodged with any othernotified body.

11726/23
ANNEX VI

JAI.2

EB/es

161

LIMITEEN

3.2

The quality system shall ensure compliance of the products with the essential requirements set
out in Section 1 of Annex I and compliance of the vulnerability handling processes put inplace by the manufacturer with the requirements set out in Section 2 of Annex I.
All the elements, requirements and provisions adopted by the manufacturer shall be
documented in a systematic and orderly manner in the form of written policies, procedures
and instructions. That quality system documentation shall permit a consistent interpretation of
the quality programmes, plans, manuals and records.
It shall, in particular, contain an adequate description of:– the quality objectives and the organisational structure, responsibilities and powers of the
management with regard to design, development, product quality and vulnerability
handling;– the technical design and development specifications, including standards, that will beapplied and, where the relevant harmonised standards and/or technical specifications
will not be applied in full, the means that will be used to ensure that the essential
requirements set out in Section 1 of Annex I that apply to the products will be met;
– the procedural specifications, including standards, that will be applied and, where therelevant harmonised standards and/or technical specifications will not be applied in full,the means that will be used to ensure that the essential requirements set out in Section 2of Annex I that apply to the manufacturer will be met;
– the design and development control, as well as design and development verification
techniques, processes and systematic actions that will be used when designing anddeveloping the products pertaining to the product category covered;– the corresponding production, quality control and quality assurance techniques,
processes and systematic actions that will be used;

11726/23
ANNEX VI

JAI.2

EB/es

162

LIMITEEN

– the examinations and tests that will be carried out before, during and after production,and the frequency with which they will be carried out;
– the quality records, such as inspection reports and test data, calibration data,
qualification reports on the personnel concerned, etc;
– the means of monitoring the achievement of the required design and product quality andthe effective operation of the quality system.
3.3

The notified body shall assess the quality system to determine whether it satisfies therequirements referred to in point 3.2.
It shall presume conformity with those requirements in respect of the elements of the quality
system that comply with the corresponding specifications of the national standard that
implements the relevant harmonised standard and/or technical specification.
In addition to experience in quality management systems, the auditing team shall have at least
one member experienced as an assessor in the relevant product field and product technology
concerned, and knowledge of the applicable requirements of this Regulation. The audit shall
include an assessment visit to the manufacturer's premises, where such premises exist. The
auditing team shall review the technical documentation referred to in point 3.1, second indent,
to verify the manufacturer's ability to identify the applicable requirements of this Regulationand to carry out the necessary examinations with a view to ensuring compliance of the
product with those requirements.
The manufacturer or his authorised representative shall be notified of the decision.
The notification shall contain the conclusions of the audit and the reasoned assessment
decision.

11726/23
ANNEX VI

JAI.2

EB/es

163

LIMITEEN

3.4

The manufacturer shall undertake to fulfil the obligations arising out of the quality system asapproved and to maintain it so that it remains adequate and efficient.

3.5

The manufacturer shall keep the notified body that has approved the quality system informedof any intended change to the quality system.
The notified body shall evaluate any proposed changes and decide whether the modified
quality system will continue to satisfy the requirements referred to in point 3.2 or whether areassessment is necessary.
It shall notify the manufacturer of its decision. The notification shall contain the conclusionsof the examination and the reasoned assessment decision.

4.

Surveillance under the responsibility of the notified body

4.1

The purpose of surveillance is to make sure that the manufacturer duly fulfils the obligations
arising out of the approved quality system.

4.2

The manufacturer shall, for assessment purposes, allow the notified body access to the design,development, production, inspection, testing and storage sites, and shall provide it with allnecessary information, in particular:– the quality system documentation;– the quality records as provided for by the design part of the quality system, such as
results of analyses, calculations, tests, etc.;– the quality records as provided for by the manufacturing part of the quality system, suchas inspection reports and test data, calibration data, qualification reports on the
personnel concerned, etc.

11726/23
ANNEX VI

JAI.2

EB/es

164

LIMITE

EN

4.3. The notified body shall carry out periodic audits to make sure that the manufacturer maintains
and applies the quality system and shall provide the manufacturer with an audit report.
5.

Conformity marking and declaration of conformity

5.1

The manufacturer shall affix the CE marking, and, under the responsibility of the notified
body referred to in point 3.1, the latter's identification number to each individual product thatsatisfies the requirements set out in Section 1 of Annex I to this Regulation.

5.2

The manufacturer shall draw up a written declaration of conformity for each product modeland keep it at the disposal of the national authorities for 10 years after the product has beenplaced on the market. The declaration of conformity shall identify the product model forwhich it has been drawn up.
A copy of the declaration of conformity shall be made available to the relevant authorities
upon request.

6.

The manufacturer shall, for a period ending at least 10 years after the product has been placedon the market, keep at the disposal of the national authorities:– the technical documentation referred to in point 3.1;
– the documentation concerning the quality system referred to in point 3.1;
– the change referred to in point 3.5, as approved;– the decisions and reports of the notified body referred to in points 3.5, 4.3 and 4.4.

11726/23
ANNEX VI

JAI.2

EB/es

165

LIMITEEN

7.

Each notified body shall inform its notifying authorities of quality system approvals issued orwithdrawn, and shall, periodically or upon request, make available to its notifying authorities
the list of quality system approvals refused, suspended or otherwise restricted.
Each notified body shall inform the other notified bodies of quality system approvals which it
has refused, suspended or withdrawn, and, upon request, of quality system approvals which it
has issued.

8.

Authorised representative
The manufacturer's obligations set out in points 3.1, 3.5, 5 and 6 may be fulfilled by his
authorised representative, on his behalf and under his responsibility, provided that they are
specified in the mandate.

11726/23
ANNEX VI

JAI.2

EB/es

166

LIMITE

EN