Table of contents 1.Introduction: Political and legal context 2.Problem definition 2.1.What are the problems? 2.2.What are the problem drivers? 2.3.How will the problem evolve? 2.4.Impact of COVID-19 3.Why should the EU act? 3.1.Legal basis 3.2.Subsidiarity: Necessity of EU action 3.3.Subsidiarity: Added value of EU action 4.Objectives: What is to be achieved? 4.1.General objectives 4.2.Specific objectives 5.What are the available policy options? 5.1.What is the baseline from which options are assessed? 5.2.Description of the policy options 5.3.Discarded options

6.What are the impacts of the policy options? 6.1.Policy Option 0 – baseline scenario 6.2.Policy Option 1 – voluntary approach 6.3.Policy Option 2 – Article 3(3)(e), focus on protection of privacy and personal data 6.4.Policy Option 3 – Article 3(3)(f), focus on protection from fraud 6.5.Policy Option 4 – Article 3(3)(e) and 3(3)(f), focus on protection of privacy and against fraud 6.6.Policy Option 5 – Article 3(3)(d), 3(3)(e) and 3(3)(f), focus on privacy and fraud protection and network security 7.How do the options compare? 8.Preferred option 8.1.Preferred policy option: option 5 8.2.REFIT (simplification and improved efficiency) 9.How will actual impacts be monitored and evaluated? Annex 1: Procedural information 1.Lead DG, Decide Planning/CWP references 2.Organisation and timing 3.Consultation of the RSB 4.Evidence, sources and quality Annex 2: Stakeholder consultation Interviews Targeted consultation

Open public consultation Annex 3: Who is affected and how? 1.Practical implications of the initiative 2.Summary of costs and benefits Annex 4: Analytical methods Annex 5: Applicable Delegated Acts Annex 6: Coherency mapping – related pieces of EU law Annex 7: Case Studies 1.1. Introduction: Political and legal context This Impact Assessment concerns an initiative to strengthen the cybersecurity of certain categories of radio equipment. The European Parliament and the Council have repeatedly expressed the need to strengthen Cybersecurity in the EU , recognising the growing importance of connected devices, including machines, sensors and networks that make up the Internet of Things (IoT) and the related security concerns. The EU framework is comprised of several pieces of legislation that cover aspects linked to cybersecurity or some of its elements. Notably they are: (i) the General Data Protection Regulation (EU) 2016/679 (GDPR), (ii) the Directive 2002/58/EC on privacy and electronic communications (ePrivacy Directive, ePD), (iii) the Regulation (EU) 2019/881, the “Cybersecurity Act” (CSA), (iv) the Directive (EU) 2019/713 on combating fraud and counterfeiting of non-cash means of payment, “non-cash payment Directive”, (v) the Directive 2013/40/EU on attacks against information systems (the ‘cyberattack directive’), (vi) the Directive (EU) 2016/1148 on security of network and information systems (the NIS Directive) and (vii) the Regulation (EU) 910 (2014) on electronic identification and trust services for electronic transactions in the internal market (the eIDAS Regulation) . When addressing certain cybersecurity matters, different actors/stakeholders may have specific obligations to contribute ensuring that the entire ecosystem remains secure. For instance, network operators and service providers should ensure that their systems and platforms are secure, manufacturers of equipment should ensure that it is designed taking into account security principles, users should be aware of risks performing certain operations and of the need of performing the necessary updates of the equipment they use, Member States may establish priorities. Cybersecurity of the entire ecosystem is ensured only if all its components are cyber-secure. Currently, however there are no mandatory requirements ensuring the cyber-security of equipment, placed on the EU market. Indeed, the aforementioned pieces of EU legislation neither set out mandatory obligations for manufacturers of equipment which is placed on the EU market, nor allow for corrective measures in case insecure equipment is found on the market. The Radio Equipment Directive 2014/53/EU (“RED”) establishes a regulatory framework for placing radio equipment on the Single Market. It concerns mandatory market access conditions of products and allows Member States (MS) to take corrective measures on non-compliant equipment. The RED covers devices that can use the radio spectrum for communication and/or radio determination purposes. It can apply in parallel to other pieces of EU legislation (e.g. on machinery, toys, drones, etc), which focus on the product safety aspects. All internet-connected radio equipment, including Internet of Things (IoT) with a radio (wireless) function and wearables (such as smart watches) fall under the Directive’s scope. As a typical legislation for market access of goods, the RED applies to both consumer and professional products. Equipment that can communicate exclusively by physical means (e.g. a cable) does not fall into the definitions of the Directive and therefore is excluded from its scope. In the specific case of the IoT, the progressive digitalisation and connection to the internet of goods, directly or indirectly, has created over the past years the IoT, which can be defined as in the Recommendation ITU-T Y.2060, section 3.2.2, i.e. a “global infrastructure for the information society, enabling advanced services by interconnecting (physical and virtual) things based on existing and evolving interoperable information and communication technologies”. The vast majority of the devices comprising the IoT is radio equipment. In line with the New Legislative Framework (“NLF”), the Directive is based on Article 114 of the TFEU (the approximation of laws). Article 3(1) and Article 3(2) of the RED set out the essential requirements that all radio equipment in scope of the Directive shall respect in terms of health and safety, electromagnetic compatibility, efficient use of radio spectrum and avoiding harmful interference. In order to support innovation, the RED, in its Annex I, has a specific exclusion for certain equipment used for research and development, specifically “custom-built evaluation kits destined for professionals to be used solely at research and development facilities for such purposes”. Article 3(3) provides the basis for further delegated regulation governing additional aspects by empowering the Commission to adopt acts specifying which categories or classes of radio equipment are concerned by each of the requirements set out in its points (a) to (i) of that Article. The requirements referred to in points (a) to (i) relate to interoperability, emergency services, software, fraud, accessibility, privacy, personal data and misuse of the network. Annex 5 reports the already applicable delegated acts, which so far have been issued under Article 3(3)(g) only. When adopting delegated acts activating the new essential requirements under Article 3(3), a date of applicability has to be specified. This date of applicability needs to provide sufficient time to the manufacturers to adapt their radio equipment to the new essential requirements and demonstrate compliance. Only radio equipment placed on the market after the date of applicability will be subject to the new essential requirements. Radio equipment placed on the EU market before the date of applicability can still be sold in the EU market and does not need to be recalled or modified, provided that it fulfilled the applicable essential requirements at the moment when it was placed on the market. The three sub-articles relevant for this impact assessment are the following: ·3(3)(d), to ensure network protection; ·3(3)(e), to ensure safeguards for the protection of personal data and privacy, ·3(3)(f), contributing towards protection from fraud. The aim is, however, not to produce additional or overlapping rules to existing legislation but to ensure that the existing principles, where applicable, are translated into specific requirements for manufacturing goods to be placed on the EU market with a certain degree of enforcement or verifiability. It is important to ensure complementarity with the existing EU framework. As regards to this initiative, consequently, a coherency mapping of the already applicable legislation is reported in Annex 6.

In more detail, Article 3(3)(d) of the RED can complement the framework established by the NIS Directive, ensuring that not only the networks per se are secure, but also that the connected radio equipment does not harm them. For example, the security of all networks depends on the ability to identify and authenticate each device that is connected to these networks. Without appropriate identification and authentication (features provided by the devices themselves) networks are at risk. Similarly, Article 3(3)(e) can ensure that manufacturers will take into account the “security by design” aspect of the principle of “data protection by design and by default” in the GDPR and the confidentiality of electronic communications in the ePD in designing the equipment. Likewise, Article 3(3)(f) can ensure that manufacturers take the necessary measures to ensure that devices, when used for non-cash payments, support the objectives in the non-cash payment Directive. In a similar manner, the cyberattack Directive defines illegal cyberactivities and lays down obligations to MS to tackle them. The three Articles of the RED mentioned above may complement this framework by introducing mandatory requirements in the equipment which would make it more difficult to perpetrate such activities by means of radio equipment, hence they can support the policy objectives of that Directive. Finally, the basic security assurance referred to in the voluntary cybersecurity schemes developed under the CSA can be a benchmark for the development of technical specifications/harmonised standards in support of the mandatory requirements for market access set out through the RED delegated act. The adoption of a delegated act under Articles 3(3)(d), 3(3)(e) and 3(3)(f) of the RED would represent an action under already granted empowerments, without the need to draft a new piece of EU legislation, which has to follow the co-decision procedure. In particular, the empowerment in the delegated acts under the RED has already been written by the co-legislators. Under this framework, the Commission can specify certain aspects only (e.g. the class or categories of affected products, the date of applicability) and, at the non-opposition of the co-legislators, the acts enter into force and become applicable after an appropriate transitional period. This would be a much faster process than the establishment of a new framework under a co-decision procedure. A further piece of EU law that may be related to this initiative is the Directive 2008/114 on the identification and designation of European critical infrastructures and the assessment of the need to improve their protection. It currently does not address digital aspects, which are addressed under the NIS. However, this piece of legislation is being revised and complementarity will be ensured in case a future revision requires addressing radio equipment connected to the resilience of critical entities. A number of regulatory and non-regulatory initiatives, mostly at the national level in Europe, as summarised by the European Network and Information Security Agency (ENISA), are being deployed to address different types of security vulnerabilities also identified in connected products. Those initiatives have been developed also in response to reports highlighting concerns on the lack of baseline requirements to ensure a degree of security in these products. In some cases they may impose national requirements on aspects not covered by EU harmonisation legislation. At the international level, other examples include the UK and its voluntary code of practice relating to consumer IoT security for manufacturers of IoT devices or California and its legislation to regulate consumer IoT security through Senate Bill 327. The latter introduces security requirements for connected devices. It defines them as any device that connects directly or indirectly to the internet and has an IP or Bluetooth address. The Bill provides that, from 1st January 2020, a manufacturer of a connected device is required to equip the device with a “reasonable security feature or features that are appropriate to the nature and function of the device, appropriate to the information it may collect, contain, or transmit, and designed to protect the device and any information contained therein from unauthorized access, destruction, use, modification, or disclosure, as specified”. One recent and very relevant development in the field was the endorsement of the significance of 5G networks to the European economy by the European Council in December 2019 stressing the need to mitigate security risks linked to 5G. As all 5G terminal equipment is radio equipment, it is necessary to ensure that the request of a paramount security is addressed with the existing legislative tools. This initiative is therefore also a complement, on the equipment side and under NLF, to the EU toolbox on 5G Cybersecurity which sets out a coordinated European approach aiming at mitigating the main cybersecurity risks of 5G networks, through coordinated approaches among Member States. The options examined in this impact assessment are fully complementary to that, focusing on the security of equipment connecting to the network. A further Council Conclusion of 2nd December 2020 acknowledges that regulatory measures on certain radio equipment through delegated acts under the RED are a part of a broader strategy to raise the level of cybersecurity of connected devices at Union level. In fact, strengthening the cybersecurity on products will help the protection of the networks. This initiative aims to ensure that certain protection measures implemented on the networks as a result of the provisions of the NIS Directive are not weakened when radio equipment connects to those networks. Some of the radio equipment covered by this initiative may also fall in the scope of a possible future initiative on the upload of new software on radio equipment pursuant Articles 3(3)(i) and/or 4 of the RED. This other initiative aims to ensure that the level of protection of privacy and against fraud at the moment of placing radio equipment on the market would be maintained with the upload of new software. It will be therefore a further complementing initiative to ensure that the compliance with the RED is demonstrated not only at the moment of initial placing on the market, but also at each upload of software which can impact the essential requirements. Both these initiatives are to be seen in the broader context of developing a legislative framework for Artificial Intelligence (AI), strengthening the applicability of existing “European legislation on fundamental rights (e.g. data protection, privacy, non-discrimination), consumer protection, and product safety and liability rules”. The aim is, again, to ensure that products placed on the EU market can support, where applicable, the policy objectives laid down in relevant EU legislation and that MS have enforcing tools to ensure it. In the specific case of “cybersecurity”, although the RED does not mention the word, some of its essential requirements in Article 3(3) concern elements of it, such as the protection of the networks (Article 3(3)(d)), the protection of privacy and personal data (Article 3(3)(e)), the protection against fraud (Article 3(3)(f)) and the obligation that software does not compromise the compliance of the equipment that has been demonstrated at the moment of placing on the market (Article 3(3)(i)). Therefore these initiatives are to be seen also in the general context of increasing the cybersecurity in goods that are placed on the EU market. Numerous MS and consumer associations flagged the absence of certain security features in equipment which is placed on the market - and the consequent risks - to the EU institutions as well as to the members of Telecommunications Conformity Assessment and Market Surveillance (TCAM) Committee, the TCAM Working Group and the Commission Expert Group on Radio Equipment. More specifically, experts as well as international organizations are concerned about the ways personal information and data are collected and shared and how these data may be used for illicit practices. Some MS have brought to the Commission’s attention the increasing risks in the area of cybersecurity linked to the increased use of connected products, stressing that it would be beneficial to apply a minimum level of mandatory security to all radio equipment directly or indirectly connected to the internet . As a matter of fact, MS do not have a legislative tool to recall or to impose corrective measures to the equipment that (i) either harms the networks to which it is connected, (ii) does not processes, transmits or stores personal data appropriately, or (iii) does not processes transmits or stores financial data appropriately. 2.2. Problem definition In this section we explain what the problem is (section 2.1), how it originated (section 2.2) and how it is expected to evolve (section 2.3). Large numbers of radio equipment are used on a daily basis, not only by adult consumers or professional users, but also by vulnerable users like children. In December 2016, the Norwegian Consumer Council had assessed the technical features of selected radio-connected toys. Its findings point to a possible lack in the protection of children’s rights to privacy and security. Thanks to integrated speakers, microphones and other sensors, inter-connected toys are by definition “smart” and can for instance interpret speech, which makes them capable of interacting with the child. They may also record not only photos, videos, geolocalisation data, data linked to the play experience, but also heartrate, sleeping habits or other biometrical data. They can also be connected to phones/tablets or directly to the internet. The ability of these products to record, store and share information raises concerns related to their safety, security and privacy. Through a few simple steps, as shown in the report of the Norwegian Consumer Council, a stranger can take control of the toy without having physical access to it, and eavesdrop on and communicate with the child. He/she might be able to track the child or fake the location of the child. The report also shows that some of these toys can also advertise products when interacting with the child, which may not be in line with the expected transparency of this kind of products. For this reason, its outcome has made the European Consumer Associations call for action. Toys are just a part of a broader sector, which present similar risks. Smart appliances, smart cameras and a number of other connected radio equipment like mobile phones, laptops, dongles, alarm systems and home automation systems are also examples of equipment at risk of hacking and of privacy issues when they are connected to the internet. In addition, wearable devices (e.g. rings, wristbands, pocket clips, headsets, fitness trackers, etc.) can monitor and register a number of the user’s sensitive data over time (e.g. position, temperature, blood pressure, heart rate) and retransmit them, not only over the internet, but also through short range communication technologies. In the latter case, certain short range communication technologies have been identified as insecure and, as they are used in wearable devices, personal data can be intercepted even in the absence of an internet connection. Therefore, the products concerned by this initiative are “internet-connected and/or wearable radio equipment”, a broad category of radio equipment, i.e. electronic or electrical product communicating or detecting through radio waves, as per definition in Article 2 of the RED. In the rest of this Impact Assessment, “internet-connected” radio equipment it is intended to be radio equipment that is capable itself to communicate over the internet, regardless if it communicates directly or “indirectly”, i.e. via any other equipment. This category of radio equipment includes not only a number of “conventional” wireless products, such as mobile phones, laptops, wireless cameras, routers, etc., but also “conventional” goods that recently have been provided with a radio function, such as toys, locks, printers, watches, home appliances, and the radio components which allow the connection, in all market segments (e.g. professional, amateur, consumers, industrial, etc.). “Internet-connected radio equipment” refers to radio equipment connected (directly or via another equipment) to the internet. Certain radio equipment that are not connected to the internet, as for instance stand-alone RFIDs (Radio Frequency IDentification), i.e. tags or proximity sensors, would not follow under this initiative, as they are not internet-connected, nor they transmit/process personal or financial data. However, when a specific equipment contains a RFID and that equipment is internet-connected or can transmit/process personal or financial data, the entire product, including the RFID, will fall in the scope of the initiative. Whilst there are pieces of EU law regulating the general rules for privacy, against frauds or to protect networks or providing for specific actors (e.g. data controllers or MS) to take appropriate measures – see Annex 6 – stakeholders, and in particular Member States and consumer associations, have stressed the absence of legislative tools which would allow to take corrective measures (e.g. fines or withdrawal) against insecure connected products that are placed on the market. Most of these products are wireless or have a wireless capability, hence these products as a whole, fall under the scope of the RED. Also products which can be connected through cables but still have at least one wireless capability fall into the scope of the Directive. As explained in the next subsections, there are three kinds of incidents which could be mitigated through delegated acts under the RED, obliging manufacturers to design the equipment in a more secure manner. These concern: the protection of the privacy and personal data, the protection from frauds and the protection of the networks where the equipment operates. For all the described incidents, numerous studies and reports (see footnotes 8, 9, 16, 17, 19) show or flag shortcomings in products, e.g. presence of default passwords, lack of encryption, and reduced attention to privacy protection in manufacturing. However, there are no data on the technical features of the equipment causing the incidents, specifically whether they are wireless or wired-only products. On a statistical basis, however, it is likely that most of the incidents occur by means of radio equipment, as more and more products have a wireless functionality. For 2021, it is estimated that there will be every 55 wired-connected devices there will be more than 220 wireless-connected devices, i.e. radio equipment will account for at least 80% of the connected equipment. On one hand, consequently, not all incidents can be prevented through acting solely on radio equipment, but on the other hand it is likely that this would improve significantly the current situation. 2.1.2.1. What are the problems? 2.1.1.2.1.1. Personal data and privacy As detailed in Annex 6, the protection of privacy is already regulated by other EU legislation. Minimization of data collection, privacy assessments and ensuring a level of security appropriate to the risk are already legal obligations (e.g. in the GDPR) although there are no tools for enforcing these when placing goods on the market, contrary to what is done regarding (physical) safety aspects. The lack of enforcement possibilities at the product level cannot therefore tackle the absence of basic measures such as data encryption and device authentication which would support the policy goals of other pieces of EU legislation.

Consequences of data and privacy breaches are largely dependent on the type and amount of information but can be severe and can result in: ·Identity fraud: Identity fraud occurs from the unauthorized use of one’s identity and/or data associated with an identity for fraudulent purposes. It is a specific case of issues which can stem from poor protection of personal data. Identity fraud vulnerabilities during data transfer can arise from poor design of the equipment and lack of sufficient security safeguards. ·Location breach: Location breaches generally concern unauthorised access to location information. Unwanted notification of the location of a user (via wearable devices and transport equipment) or radio equipment in a particular location (home, second home, workplace) can reveal the presence of a known or unidentified person(s). Unauthorised access to information that could identify the lack of presence in a home or location is also a concern (e.g., this information could be of use to those seeking to commit burglaries). For instance, two-way pull-push communication information from an electricity or water smart meter may reveal the absence of a home owner for a prolonged period whilst on holiday and it is therefore essential such information is sufficiently protected. ·Geolocational data breaches: Many devices, such as mobile phones and smart watches, incorporate Global Navigation Satellite System (GNSS) and provide real-time information about the location of the user. This is a growing trend where more and more radio equipment, occasionally worn (e.g. a wristband) has the capability of collect and process a vast number of personal data. When the equipment cannot protect the privacy of the transmitted data, the position of the user can be used to put him/her in danger (e.g. children or users that could be a target, such as military personnel). In the specific case of privacy, according to the guidelines published by the European Data Protection Board (EDPB) on personal data breach notification under the GDPR , personal data breaches typically fall in one of the following categories: (1) confidentiality breaches: where there is an unauthorised or accidental disclosure of, or access to, personal data; (2) availability breaches: where there is an accidental or unauthorised loss of access to, or destruction of, personal data; and (3) integrity breaches: where there is an unauthorised or accidental alteration of personal data. In all these cases, the cause can lie in a lack of features in the equipment. When it concerns data related to children, the risks of any breach is even greater. This concerns not only toys, but also products for childcare. Although in certain cases breaches depend on vulnerabilities that are not related to radio equipment manufacturing (e.g. insecure services, operators’ mishandling of data, etc), there is already applicable EU legislation (e.g. the GDPR), which has provisions for manufacturers but does not foresee conditions for market access. Some diligent manufacturers – and other economic operators in their value chain – have already incurred costs to get their products in line with the requirements. Yet, as noted in several studies, at the cheaper end of the market, some producers provide low-quality connected radio equipment that lacks minimum levels of protection. This lack of security does not only impact the citizens using them (e.g. with reduced privacy protection), or operators of networks to which these devices are connected (it being easy to interfere with the intended behaviour of this equipment), but represents also a level-playing field issue, as manufacturers providing higher levels of protection may not have sufficient incentives to continue to do so, which in turn risks a race to the lowest level of protection. Especially Member States and Consumers’ Associations believe the problem has grown much worse in the past five years. Therefore low-quality, non-cyber secure products remain on the European single market. The problem had in their view been exacerbated by the trend towards smart and connected products, which is described in section 2.3. Finally, as regards the implementation of eIDAS, there is currently no commonly agreed methodology for demonstrating compliance. This impacts negatively on the effectiveness and efficiency of the process to achieve mutual recognition and therefore the availability of trusted and secure eID solutions. These weaknesses particularly affect mobile schemes which benefit from high convenience and user uptake. Globally, an increase in demand for digital identity solutions is expected, with a predicted annual market growth ranging from 13% to 20% . Users’ expectations with regard to control of personal identity data and effective technologies for fraud and identity theft prevention will increase . Continued growth in mobile penetration strengthens the demand for convenient and secure mobile-first solutions . 2.1.2.2.1.2. Fraud Frauds can involve a number of criminal activities which can be also related to stealing personal data. The concept is broad and encompasses a plethora of deceitful and criminal actions, which can have significant and long-terms impacts on the person who suffered the theft. The costs can be high and do not only concern the person who suffered the fraud, but also society as a whole (e.g. the cost of police investigation, the costs of victim services, the costs of trials to establish responsibilities, etc). In many cases, frauds are perpetrated in a way that does not concern radio equipment or depend on vulnerabilities that are not related to radio equipment (e.g. insecure services, operators’ mishandling of data, etc). However, in certain cases, specific kinds of frauds do concern it, as radio equipment (e.g. smartphones or smartwatches) are used not only to perform non-cash payments over the internet, but progressively also as non-cash means of payment. For instance, smartphone owners have often financial data stored in a digital wallet in their equipment. In turn, this digital wallet allows to transfer money (e.g. to a retailer or a friend) using a near-field communication (NFC) technology embedded in the smartphone. Consumers are progressively enabling this feature in their radio equipment. In this or similar cases, it is then necessary to ensure that radio equipment contains specific features to support trustworthy transactions and minimise the risk that the user can suffer financial damages when using it. Digital wallets and specific payments details can be stored in the radio equipment and become accessible if no sufficient protection is provided. A low-risk, high-profit criminal activity, is the “card-not-present (CNP) fraud”, which occurs largely online, involving the unauthorised use of credit or debit data (the card number, billing address, security code and expiry date) to purchase products and services in a non-face-to-face setting, such as via e-commerce websites or over the telephone. In the majority of cases, the victims are unaware of the unauthorised use of their cards, which remain in their possession. This type of illegal activity has grown steadily, as compromised card details stolen by means of data breaches, certain attacks and data-stealing malware become more readily available on forums, marketplaces and automated card shops in the deep web. According to the European Central Bank in 2019, “the total number of non-cash payments in the euro area increased by 7.9% to 90.7 billion in 2018 compared with the previous year. Card payments accounted for 46% of the total number of non-cash payments in the euro area, while credit transfers and direct debits accounted each for 23%. […] Around 44 billion transactions were processed by retail payment systems in the euro area with an amount of €34.0 trillion” and its fifth card fraud report notes that the total value of card-not-present fraud is increasing: “With €1.32 billion in fraud losses in 2016, CNP fraud was not only the largest category of fraud in absolute value but, unlike ATM and POS fraud, it was also the only one to record an increase (of 2.1%) compared with the previous year” and “Fraud involving cards issued inside SEPA increased for CNP transactions and decreased across the other transaction channels. In 2016 CNP fraud accounted for 73% of total fraud losses on cards issued inside SEPA, compared with 71% in 2015”. In 2017, the Impact Assessment accompanying the proposal for a Directive of the European Parliament and the Council on combating fraud and counterfeiting of non-cash means of payments has found that ·“Average loss per fraudulent card transaction: around EUR 130 (result of dividing the value of card fraud, EUR 1440 million, by the number of card transactions, 11.3 million, in 2013). ·The average monthly salary in the EU is around EUR 1500 (EUR 1489 in 2014). Losing around 10% of the monthly salary due to fraud (a conservative estimate since there is only card fraud data available) is a significant amount which becomes much more relevant for the citizens earning below the average EU salary (for example, these fraud losses would have represented more than two thirds of the minimum wage in Bulgaria of EUR 173 in 2014); ·The probability of a card transaction being fraudulent was 1 in 5000. This was about 4 times more likely than dying on a road traffic accident in the same year, all vehicles combined, and including pedestrians. The most problematic aspect of non-cash payment fraud is that it represents a threat to security. In addition, it is an obstacle to the digital single market. The number of credit transfers within the euro area increased in 2018 by 4.7% to 21.0 billion. The relative importance of transactions initiated electronically continued to increase, with the ratio of transactions initiated electronically to paper based transactions now standing at around eleven to one.” Some payment-related frauds have been estimated by the European Central Bank (ECB) and they amount in 2018 to EUR 1.8 billion for cards issued in the Single Euro Payments Area (SEPA), increasing by 8.7% compared to the latest figures available (2013) (EUR 1.44 billion).

As in the case of privacy, there is already applicable EU legislation, but there are no provisions in the “non-cash payment Directive” that concern that the radio equipment placed on the EU market is built according to specific requirements. 2.1.3.2.1.3. Network protection As a major enabler for future digital services, 5G and networks of equipment will play a key role in the development of our digital economy and society in the years to come. At the same time, due to the connectivity of digitally enabled conventional goods, a less centralised architecture, and smart computing power of terminal equipment, networks offer more potential entry points for attackers. Therefore, ensuring the security of the EU's future 5G networks and that terminal equipment can be connected without risks of creating harm is of utmost importance. While operators are largely responsible for the secure rollout of 5G, Member States are responsible for national security. Network security is an issue of strategic importance for the entire EU and therefore manufacturers have to contribute to the success of the deployment and security of 5G and other networks. A significant risk of network attacks exists such as through the use of BotNets if a large number of connected but unprotected devices are hacked. For instance, attacks can occur when fraudsters spread malware through a piece of code in an ad. When a user clicks on that code, the code takes over the user’s device and creates a botnet, a network of computers infected without the users’ knowledge. Fraudsters then can use this botnet to send spam emails, transmit viruses and engage in other acts of cybercrime, such as Distributed Denial of Services (DDoS) attacks. This botnet risk perpetrated through ad fraud underlies a central threat of IoT frauds. Many newer IoT devices, typically with a wireless connectivity and hence radio equipment, as for instance connected home appliance, do not even have security systems protecting them from botnet attacks. In the same way, ad fraud offers an ideal pathway to creating a botnet because, in general, security intrusions come from perpetrators trying to hack into a system directly, or from perpetrators using a third-party code to try to get into a system indirectly. A study from F-Secure reports that IoT threats were rarely encountered before 2014, but “that changed around the time the source code for Gafgyt – a threat that targeted a variety of IoT devices, including BusyBox devices, closed-circuit television (CCTV) devices and many digital video recorder (DVR) devices – was released”. The ENISA threat landscape for 5G networks stresses that “mobile communication systems have been prone to security vulnerabilities from their very inception. […] With a growing demand for IP based communications, the fourth generation (4G) enabled the proliferation of smart devices, multimedia traffic, and new services into the mobile domain. This development led to a more complex and dynamic threat landscape. With the advent of the fifth generation (5G) of mobile networks, security threat vectors will expand, in particular with the exposure of new connected industries (Industry4.0) and critical services (connected vehicles, smart cities etc.). […] The integration with and exposure to the data network, is even more prevalent across the 5G network. The growing concerns over availability and protection of user data and privacy will exacerbate with the security challenges introduced by 5G. Hence, the most critical challenges relate to the resilience of the network and the protection of content and metadata of 5G communications”. As the communication occurs between the 5G network infrastructure and the mobile terminals, all being radio equipment, it is then evident that complementing measures need to ensure that the equipment supports the appropriate protection of the networks, without prejudice to further actions to be taken at the network level. 2.1.4.2.1.4. Interdependences and impact on costs In general, due to the equipment being vulnerable, consumers, professionals and industry may suffer costs of data breaches. There is a degree of interdependence between privacy protection, prevention of fraud and network protection. There have been many examples of large numbers of insecure internet-connected and/or wearable radio equipment, such as CCTV monitors and baby monitors, being left password unprotected and these vulnerabilities have been exploited through botnet attacks on networks and on individual websites. Hacking into an individuals’ home network via a cheap product involves a data breach, which could then expose personal banking details – fraud may be related to the use of personal data, and hacked equipment can be used to produce harm to networks. The inter-linkage between consumer IoT device-level risks and network risks is therefore important and should not be under-estimated. Several pieces of research provide estimates for costs of data breaches. For example, in the US, IBM and the Ponemon Institute identified the global average cost of a breach as $3.92 million in their 14th joint annual 2019 Cost of Data Breach study , though certain industries can have more costly breaches. The study reports that “the cost of a data breach has risen 12% over the past 5 years and now costs $3.92 million on average. These rising expenses are representative of the multiyear financial impact of breaches, increased regulation and the complex process of resolving criminal attacks. The financial consequences of a data breach can be particularly acute for small and midsize businesses. In the study, companies with less than 500 employees suffered losses of more than $2.5 million on average – a potentially crippling amount for small businesses, which typically earn $50 million or less in annual revenue.” Among the high-level findings from the IBM / Ponemon study are that 1) Breaches originating from malicious attacks are the most common, accounting for 51% of all breaches, 2) Smaller companies pay disproportionately larger costs in terms of costs per staff member 3) Encryption has the greatest impact on reducing breach costs. The 2018 and 2019 Cost of Data Breaches studies include two new factors in their analysis that influence data-breach costs: deployment of artificial intelligence (AI) and the extensive use of IoT devices. A key finding was that extensive use of IoT devices by organisations increased the risks. It contains data relating to 500 companies globally, of which 115 from Germany, France, Italy, and “Scandinavia”. The 2020 report “estimates that the cost of a destructive malware attack to companies can be particularly high, with large multinational companies incurring a cost of $239 million per incident, on average”, i.e. “over 60 times more than the average cost of a data breach”. As the costs of data breaches are assumed to be lower in Europe (less litigious business culture, other economic factors), the assumption is that a typical data breach might cost €100,000 on average for a firm in Europe. This is only an estimate, as the estimates mentioned in surveys and studies vary widely. Another report concluded that the cost of data breaches will rise globally from $3 trillion each year to over $5 trillion in 2024. This represents an average annual growth of 11%. According to Juniper, "This will primarily be driven by increasing fines for data breaches as regulation tightens, as well as a greater proportion of business lost as enterprises become more dependent on the digital realm". According to another research by Verizon, 58% of data breach victims are small businesses, although large firms face particular challenges, as they have large customer databases. Organisations in transport, manufacturing and healthcare have reportedly suffered substantial losses due to IoT-related vulnerabilities and data breaches. According to a survey based on responses from 700 enterprises in five countries (China, Germany, Japan, UK and US), the average financial impact as a result of an IoT cyberattack was estimated at more than $330,000. However, estimates as to the costs of IoT attacks and of data breaches vary considerably. A more conservative estimate, which is also based on data available from EU sources, follows a recent (2019) Eurostat survey which shows that 6% of EU companies appear to be affected by destruction or corruption of data following a security incident. The survey concerned companies with more than 10 employees and not in the financial sector (approximately 1.700.000). Even assuming that the micro enterprises did not suffer any loss due to data breaches, it can be estimated that 100.000 companies suffered data breaches. Taking the above average cost of data breaches (100.000 EUR), the costs for data breaches can be conservatively estimated to at least EUR 10 billion per year. This number is confirmed as a low-bound estimate by looking at the approximately 90.000 breaches – concerning the GDPR only – which were reported in 2019. Even if data breaches do not occur, the costs of DDoS attacks can be high: in 2016 Kaspersky estimated that “other major DDoS-related costs included PR expenses to restore a company’s reputation (9%), upgrading IT infrastructure and software (10%), staff training (10%) and customer compensation (12%). This can bring the average cost of a DDoS attack to about $106,000 for smaller companies and more than $1.6 million for large enterprises.” It also reported that “DDoS attacks are one of the most expensive cyberthreats for companies. […] There have been incidents where prolonged DDoS attacks have led to the bankruptcy and closure of successful online businesses”. The estimates of 2017 showed that “the financial implications of reacting to a DDoS attack in 2017 is $123K for SMBs, compared to $106K in 2016. For enterprises, the cost has soared to more than half a million dollars – from $1.6M in 2016 to $2.3M in 2017, on average”. CISCO estimates that approximately 10.8 million DDoS attacks will occur globally in 2020. Considering the ratio of the population, 600.000 DDoS will likely concern EU companies. Recalling the costs of each DDoS ($123.000 or approximately EUR 110.000), the overall costs in the EU due to DDoS can be estimated to be in the order of EUR 65 billion. 600.000 companies represent approximately 2.4% of all EU companies. The recent Eurostat survey also covers the unavailability of ICT services for companies with more than 10 employees and not in the financial sector following a security incident, which are exemplified as “DDoS, ransomware attacks, hardware or software failure, theft”. It shows that 10% of the surveyed EU companies suffered unavailability of ICT services following a security incident, at least once. Considering the differences in scope of the threats between the two sources, the percentage of affected companies in the two sources do not appear to be in contradiction. Loss of personal or financial data, and suffering disruption of services can impact on the reputation of companies. Reputation can account to 25% of the value of a company and trust plays a significant role in the willingness of users and customers to pay a premium. Costs related to reputational damage could not be estimated, but the interview programme run by the Commission’s contractor with manufacturers in the related Impact Assessment Study also found that leading European manufacturers in some product groups for internet-connected and/or wearable radio equipment are investing significant resources in strengthening product security to enhance their brand’s reputation, by building security into their value proposition. Whilst a percentage of their investment in improving product security is made for regulatory compliance reasons, the primary reason for focusing on security is to embed it within their marketing. However, not all equipment will have minimum common protections. Consumers associations have been repeatedly invoking the need of baseline mandatory requirements, and some of them may underestimate the importance of network security, as it is not a matter they perceive. In 2019, the European Court of Auditors confirmed that “Citizens are often vectors for attacks […], since they are likely to be unwittingly exposed to vulnerabilities in cheap and widely distributed devices and software […]” and “the exponential growth of the Internet of Things, the cloud, big data and the digitisation of industry is accompanied by a growth in the exposure of vulnerabilities, enabling malicious actors to target ever more victims. The variety of attack types and their growing sophistication make it genuinely difficult to keep pace. Malware (malicious software) is designed to harm devices or networks”. It is consequently paramount to increase the security – and the security of radio equipment, for what it concerns this initiative – as an important component of value, reputation and trust. Perceived security is an enabler to the digital transformation and non-action can have, consequently, a negative impact. Recent research has investigated consumer trust purchasing behaviours. The result is that consumers are ready to pay, on average, between 30% and 40% more for equipment with demonstrated security features (a label in the study). The Commission contractor’s estimate was more conservative and estimated between 10% and 20% would pay extra for more secure products. However, this depends what is taken as the baseline comparator. For example, a consumer might purchase a better quality product with improved functionality, performance and security and pay 20-40% more for it compared with a cheaper brand. Alternatively, they may be willing to pay a smaller premium if the same product were to have its security enhanced (the 10% to 20% estimate mentioned above). Whilst it is difficult to estimate the willingness to pay precisely, this shows that consumers are indeed looking for more secure products. In conclusion, the connection of equipment to a network can produce privacy risks, risks of fraud and risks to the network itself (e.g. misuse) that need to be addressed. 2.2.2.2. What are the problem drivers?

Several studies and reports (from OECD, MS and consumers, see footnotes 8, 9, 16, 17, 19) identify that there is a lack of security features in the equipment and that MS do not have a harmonised legislative tool to remove insecure equipment from the EU market. The growth of internet-connected and/or wearable radio equipment will likely provide numerous benefits and business opportunities. However, there are associated risks which are inherent to this kind of connectivity. These risks arise from unauthorised access to radio equipment and the network communications that the devices undertake with local routers and/or more widely with other organisations. These risks can be mitigated through a “Security by Design and Default” principle. This approach seeks to make systems as free of vulnerabilities and impervious to attack as possible through basic security measures such as continuous testing, authentication safeguards and adherence to best programming practices. This approach ensures that some security aspects are an integral part of product development so that it is embedded into the device at the manufacturing stage prior to being placed on the market, and not dealt with retrospectively. A number of stakeholders, in particular associations of consumers and MS, believe that cyber risks have grown significantly in the past five years, since cybersecurity has not been addressed through market access regulation. In particular, MS can only rely on possible national acts to withdraw products that are not “secured by design” from the market and therefore there is a need for specific action to have a solid harmonised legal basis at EU level for this purpose. Low-quality, non-cyber secure products remain legally sold on the European single market. The problem had in their view been exacerbated by the trend towards smart and connected products. MS and consumers also reported that certain products may individually be perceived as “less risky”, but the growing number of such devices connected to networks (conservatively estimated to be several hundred million, see next section) creates a “great risk”. When placing radio equipment on the market, manufacturers are best placed to know the technical characteristics that would ensure a specific level of security. Consumers or certain users have limited or no capacities to perform this analysis. As a consequence, there are limited disincentives for manufacturers to place insecure equipment on the market at low prices. This makes secure products that are more expensive seemingly less attractive to consumers and users. This may in turn induce manufacturers to also cut on security in order to remain competitive, leading to a downward spiral. Another problem driver is a lack of consumer awareness regarding security. While there are some consumers that care about security (and would be willing to pay more), other consumers might not care at all. Yet these consumers can inadvertently create problems for others (e.g. by becoming part of a botnet carrying out DDOS attacks). 2.3.2.3. How will the problem evolve? Internet-connected and/or wearable radio equipment is growing exponentially as a result of simple products being transformed into smart products and connected to the internet for a variety of reasons, including greater efficiencies, convenience, additional functionality, as well as facilitating ease of monitoring, servicing and maintenance. This process has strong potential to foster economic growth and to address societal challenges as it is recognised as an enabler that will increase efficiency in a number of areas, including transport and logistics, health, and manufacturing. It is expected to assist in the optimisation of processes through advanced data analytics, and be the catalyst for new market segments. In a previous study radio equipment usage between 2015 and 2030 was forecast for different application categories and more than 30 types of devices. The numbers therein contained have been revisited and, through desk research and interviews with experts, forecasts and predictions have been updated. This has led to small changes in previous forecasts and to a reduction for the number of tablets sold, which are now expected to decrease in the future. Figure 1 provides an overview of forecasts for the number of radio equipment devices that will be in use across five application categories between 2015 and 2030 in Member States. Estimates suggest there were 1,097 million radio equipment devices in the Member States in 2015. This is estimated to rise to 7.43 billion by 2030. This represents a compound annual growth rate (CAGR) of 14.6 per cent. The largest application category is expected to be devices associated with smart homes; it is expected that 4.5 billion of these devices will be in use in 2030 in the EU. The second largest application category is expected to be wideband data transmission devices. This category largely concerns devices used on short range local area networks typically using RLANs (Radio Local Access Networks). It is expected that 2.18 billion of these radio devices will be in use in 2030 in the EU. These forecasts highlight the large number of radio equipment devices – 7.7 billion – that are forecasted to be in use by 2030. This translates into 29 radio devices per household in 2030 . According to an Ericsson report of May 2020, Service providers’ revenues from existing business, mainly driven by connectivity, are expected to remain stagnant, […]. Therefore, they are exploring new opportunities in order to capture a larger share of the potential global ICT revenue enabled by 5G, of up to USD 700 billion in 2030 across 10 industries. This confirms the expected future trend to switch to 5G and connectivity. Taking into account the ratio between the global and the EU population (approximately 6%), a conservative estimate is that the revenues for ICT products sold in the EU will amount to at least EUR 36 billion in 10 years, only for 5G-related technologies. It is then rather clear that there is a progressive digitization of conventional goods and that attention has to be paid to ensure that the risks stemming from this increased connectivity are sufficiently mitigated. The large number of internet-connected and/or wearable radio equipment sold on the European single market emphasises the significance of the threats, vulnerabilities and the perceived impacts of device-level risks stemming from this increased interconnection. Source: Commission’s contractor Whilst some industry manufacturing associations expressed the view that the nature of the risks has been exaggerated outside of smart toys, ICT and cybersecurity associations and cybersecurity testing houses mentioned that despite improved awareness among industry about the vulnerabilities, there are still too many products coming to the market that do not even have the most basic cybersecurity features integrated into smart products, making them vulnerable to hacking, attack and data thefts (see for instance the study in footnote 5). With the increase in sales and use of conventional goods with a wireless functionality, which is an external factor (i.e. a development that contributes to the problems but will occur regardless of any possible EU action), the overall risks can only be expected to increase, unless they are compensated by an improved attention in manufacturing. Manufacturers putting insecure equipment on the market at low prices can appear more competitive and in turn also induce other manufacturers to cut on security, leading to a downward spiral. This requires to ensure at least a baseline mandatory degree of security of the equipment, to limit unsecure products from coming to the market. 2.4.2.4. Impact of COVID-19 COVID-19 has already had a number of immediate implications on the EU engineering industries, such as supply chain dislocation in certain areas. However, it is likely to have ongoing economic impacts on the economy in the medium and longer-term, which are difficult to predict as the situation is constantly evolving. Consequently, it is difficult to form a comprehensive picture, both due to its ever-changing nature, and due to the absence of any reliable quantitative data from official sources. Indeed, even if official statistics were available, these would likely rapidly become out of date as the situation is fast-changing. The possible outcomes of the crisis are likely to differ significantly across different sectors of the economy. Regarding the general impact on GDP, the IMF expects European GDP across the EU-27 to decline by 7.5% in 2020. However, a rebound is possible as the economy recovers in 2021, but this is greatly dependent on many variables, which have such considerable uncertainty. COVID-19 promoted the demand for more flexibility in production systems with an increased demand for augmented reality, cybersecurity, and big data applications. 3D printing could also provide solutions to help manufacturers overcome supply chain dislocation, for instance, when crucial components are unavailable due to lockdowns. Euromonitor, for example, forecasts 30% annual growth in the 3D printing market in the next few years, a trend it recognised had been accelerated by COVID-19.

The EU industries are already relatively digitalised, although they are behind US and Asian manufacturers in terms of the level of deployment of Industry 4.0 technologies. However, as in other sectors of the European economy, there is expected to be an increased pace of adoption of digitalisation both in terms of the adoption of digital manufacturing technologies, and in working practices due to COVID-19. According to a ZVEI survey, half of the companies participating in the survey intend to invest even more in digitization in the future than already planned due to the corona crisis. Also from the consumers’ side, the boost of online sales has been acknowledged. As early as March 2020, the European Parliament noted that “in South Korea, for instance, card and mobile payments grew 30 % between January and February 2020, as did innovation in contactless pickup and delivery services. As people stay at home more, they also download more online content and games for entertainment.” In April 2020, the Commission has also urged the promotion of digital banking, while at the same time, remaining alert and continuing to fight financial crime, which is likely to increase in the context of the pandemic. The Commission has also launched consultations on (i) a retail payment strategy and a new digital finance strategy for the EU in order to gather views on further developing European retail payments and digital finance so that citizens benefit from faster, cheaper and more efficient systems, while ensuring consumer protection and (ii) the revision of the NIS Directive to help the speedy digital transformation of our society following the sudden growth in demand for internet-based solutions. This means that increased attention has to be paid to ensure security of digital payments and protection from fraud, also on the equipment side. More generally, COVID-19 has already had an impact in terms of accelerating the take-up of new forms of work organisation, such as remote working and the use of video conferencing, with more teleworking with own equipment (e.g. routers, sometimes their private laptops, etc) which may have not undergone a corporate strengthening of security.Once again, when sensitive meetings are to be organised remotely, it is paramount also to trust the devices which are used and the enforcement at the market access of products will support this trust. ENISA’s report of October 2020 summarised that additional extraordinary measures had to be taken in urgency because of COVID-19: “While working from home, cybersecurity specialists had to adapt existing defences to a new infrastructure paradigm, attempting to minimise the exposure to a variety of novel attacks where the entry points are employees’ Internet-connected home and other smart devices. At the same time and under high-pressure, they had to implement solutions based on previously less trusted components, such as remote access through the public Internet, cloud services, unsecured video streaming services and mobile devices and apps. The necessary reaction to the COVID-19 pandemic to guarantee safety and at the same [time] reduce the impact on businesses, has pushed organisations to the limits of their ability to respond to changes. Furthermore, numerous modus operandi quickly adapted to the changing work patterns, cybersecurity professionals found themselves acting at the limits of their capacities”. This strengthens the need for timely actions under the available legal framework. This need for a secure digital world has to be balanced against the call of engineering industry associations to maintain a stable regulatory framework, retaining a technology-neutral approach based on the NLF approach. The rationale is that the engineering industries are having to cope with not only major international competition, but also with the costs of the COVID-19 crisis. Therefore, the adoption of existing empowerments, such as delegated acts under the RED, can address the risks posed by radio equipment by adapting an existing framework and hence represents a viable trade-off between the needs of all actors. 3.3. Why should the EU act? 3.1.3.1. Legal basis The RED is based on Article 114 of the TFEU. Certain RED requirements could be made applicable via delegated acts. More specifically, Articles 3(3)(d), 3(3)(e) and 3(3)(f) refer to network protection, safeguards to protect privacy and against fraud, respectively. This kind of protections objectives can be better achieved at EU level, rather than by the Member States alone, due to: ·The delegated powers conferred to the Commission by the RED, which would allow a harmonised framework for market access; ·The need for harmonised standards and interoperable solutions; ·The global nature of industrial value chains, as well as the activity of global competitors working across the markets. Therefore, the EU can adopt measures in accordance with the principle of subsidiarity as set out in Article 5 of the Treaty on European Union. In accordance with the principle of proportionality, the proposed measures will not go beyond what is necessary in order to achieve those objectives. Any delegated act under Article 3(3) will make applicable the corresponding essential requirements for specific categories of radio equipment. It will also not require a co-decision process, as the co-legislators have already agreed to delegate specific empowerments to the Commission. The RED is a new approach legislation, where only essential requirements are defined. Manufacturers are requested to demonstrate how the technical solutions in their products comply with the law. 3.2.3.2. Subsidiarity: Necessity of EU action EU intervention in this area is a common interest. As outlined above, the EU needs to make sure that products placed on the EU market support the trust in the technological transformation. The technology to improve the security of connected and wearable products is available, and needs to be timely implemented and widely deployed so that the policy objectives of the Union can be reached. The scale and cross-border dimension on data privacy, frauds and network protection requires EU action. This can be widely identified in the reports from private, national and international Organisations described before.

Finally, national schemes are being discussed also for market access of products. It is consequently necessary to prevent the fragmentation of the Internal Market for aspects that can be regulated under the EU law. For the specific case, the regulatory options considered in this Impact Assessment have built on existing delegated empowerments that the co-legislators had already introduced in the RED. 3.3.3.3. Subsidiarity: Added value of EU action Although legislation is already applicable to connected equipment, see Annex 6, the absence of enforcing measures when products are placed on the market does not make it possible to verify that products placed on the EU market contain appropriate safeguards or features to minimise the risks relating to frauds, violation of privacy or misuse of the networks. It is also not possible to recall them under EU law or impose corrective measures on manufacturers. While in a few cases, certain national criminal laws could be used to recall insecure products, this is not the case in all Member States. The policy objectives laid down in the mentioned pieces of EU law are then severely impacted. The status quo has likewise implicit quantifiable and non-quantifiable indirect (or implicit) costs which are expected to increase together with the increased use of interconnected products. A prompt response is therefore needed. A regulatory action at the EU level, allowing market enforcement at the national level according to the NLF principles, will consequently fit a coherent implementation of the EU law, supporting the development of the Internal and Digital Single Markets and providing legal certainty for both manufacturers and consumers. In particular, it would allow to (i) verify ex-ante that equipment placed on the EU market is fit for the protection of the personal data and privacy, the protection from fraud and the protection of the networks and (ii) keep the current framework and conformity assessment procedures for placing radio equipment on the market. The EU is already contributing to voluntary schemes (e.g. by means of the Cybersecurity Act or codes of conduct under the GDPR) to ensure increased security. Based on this experience, the RED would request that certain related requirements are enforceable across the entire Union as a mandatory market access condition. Manufacturers, who diligently addressed security risks in their products, would see their efforts rewarded against manufacturers who paid so far little attention to these risks. In this sense, an EU regulatory action will also establish a level-playing field for the equipment in scope, harmonising the requirements that are to be demonstrated across the Union for market access, hence ensuring a common level of protection on the aspects in Articles 3(3)(d/e/f). Also for these reasons, this initiative could improve the consistent implementation and application of the existing legislation in all Member States increasing predictability and legal certainty for all parties concerned. 4.4. Objectives: What is to be achieved? 4.1.4.1. General objectives The key objective of this initiative is to contribute to strengthen the ‘ecosystem of trust’ which stems from the synergies of all related pieces of EU law concerning protection of networks, privacy and against fraud (see Annex 6). This initiative should then allow on the EU market only the radio equipment which is sufficiently secure. The radio equipment presenting most risks would be covered. 4.2.4.2. Specific objectives With the general objectives in mind, the initiative intends to strengthen the respect of certain fundamental rights (e.g. privacy) and to support the policy objectives laid down in other pieces of EU law which do not allow market enforcement. A timely action is also necessary, given the extent of the risks and considering that a prompt applicability has a positive impact on existing EU policy objectives. The possibility to use existing empowerments that have already been granted to the Commission will allow to act, in respect of the existing framework and without the need of a specific additional legislation. In order to address the problems regarding products lacking security features, a specific objective is to provide market surveillance authorities with an enforcement tool allowing them to take corrective action. Another objective is to ensure a single market in the products concerned, unhampered by diverging local or national regulations that increase administrative burdens for smaller companies in particular. A final objective is to establish a level-playing field through clear and proportionate rules that are effectively and uniformly enforced across the EU. A graphical illustration of the intervention logic is contained in the form of a problem tree in the following page (Figure 2).

5.5. What are the available policy options? The different policy options include a status quo option, non-regulatory and regulatory options. The latter ones have been built on the existing empowerments in the legislation, namely delegated acts pursuant Article 3(3) of the RED. The focus on delegated acts under RED, in the context of the regulatory option, is explained mainly by the urgency to act. The Commission was asked by several Member States and stakeholders to act urgently upon those empowerments, existing since 2014, given that they were deemed to be sufficient to cover most of the risks in most of the concerned products, hence allowing a timely response. The assessment of policy options has taken into consideration the extent to which the different policy options could achieve the policy and regulatory objectives set out above and in the Commission’s inception impact assessment. Different consultations of the TCAM Working Group, now Expert Group on Radio Equipment, took place to verify the extent to which the policy options could respond to the stakeholders’ and the MS inputs. The options are outlined in the following box (table 1).



Option Description Option 0 - Baseline scenario based on existing EU legislation. A situation in which economic operators follow requirements in existing EU legislation (e.g. GDPR, e-Privacy Directive, NIS, Cybersecurity Act, etc). No specific requirements at product level for radio equipment. Option 1 – Voluntary approach A situation in which equipment manufacturers implement voluntarily features to protect personal data, protection against fraud and to protect the network where the equipment operates. This voluntary approach can be pursued using codes of conducts that are developed by either (i) industry alone or (ii) industry and authorities also on the basis of policy objectives in related legislation (e.g. see Annex 6). Option 2 - Adoption of a delegated act based on Article 3(3)(e). ·Internet-connected and/or wearable radio equipment would be required to incorporate safeguards to ensure that the personal data and privacy of users and subscribers are protected. ·Baseline security requirements would have to be demonstrated as a condition of market access. Option 3 - Adoption of a delegated act based on Article 3(3)(f). ·Internet-connected and/or wearable radio equipment would be required to incorporate certain features to ensure protection from fraud, and a tool to enhance certain cybersecurity aspects of these products. ·Baseline security requirements would need to be demonstrated as a condition of market access. Option 4 - Adoption of two delegated acts based on both Articles 3(3)(e) and 3(3)(f). ·The requirements in Options 2 and 3 would have to be demonstrated for the purposes of market access. ·This would entail manufacturers demonstrating that baseline security requirements have been met to ensure safeguards in respect of 1) data protection and privacy and 2) protection from fraud as a condition of market access. Option 5 - Adoption of three delegated acts based on Articles 3(3)(d), 3(3)(e) and 3(3)(f). ·The requirements in Options 4 would have to be demonstrated for the purposes of market access. An additional delegated act would strengthen the requirements to ensure that radio equipment neither harms the network to which it is connected, nor misuses its resources. ·This would entail manufacturers demonstrating that baseline security requirements have been met to ensure safeguards in respect of 1) data protection and privacy, 2) protection from fraud and 3) avoidance of harm to the network where they operate, as a condition of market access. 5.1.5.1. What is the baseline from which options are assessed? Policy Option 0 is the current baseline. Under this policy option, the status quo will be preserved, i.e. manufacturers and other economic operators of internet-connected and/or wearable radio equipment will not be requested to demonstrate certain essential requirements for market access either relating to data protection and privacy, or protection from fraud, or protection of the networks. The existing EU legislation – see Annex 6 – would be applicable but with the limitations discussed above. In this scenario, manufacturers and other economic operators of internet-connected and/or wearable radio equipment will be allowed to place their equipment on the market even if they could be considered insecure, e.g. they do not provide certain basic protection. Under Option 0, consequently, users of internet-connected and/or wearable radio equipment, or the networks to which they are connected, face the risks presented in section 2. The expected increase in the number of connected wireless products in use over the next few years and in the data that will circulate in networks of these products can reasonably be expected to lead to an increase of the risks. Although in certain cases (e.g. a privacy breaches), corrective measures can be taken ex post, which may serve as a deterrent, they will come only after an investigation of the incident. However, products cannot be removed from the market other than through recourse to national legislation, which may also be subject to different interpretation. This means that there can still be a risk for the internal market’s effectiveness as regards the free circulation of internet-connected and/or wearable radio equipment, since there are no legal enforcement powers stemming from EU legislation to remove products from the market. Indeed, some MS have instead had to use different pieces of national legislation to find alternative ways for removing insecure products from the market where a risk of device penetration or data breaches could occur, and/or where the manufacturer was found to have placed a product on the market which did not respect data protection and privacy rules. Not all Member States could invoke a similar law, showing de facto a fragmentation. Some technical solutions are common and they can protect privacy, prevent fraud and ensure network protection. Examples can be simple, as for instance (i) the avoidance of default passwords to access the equipment and/or (ii) the use of cryptography to store user’s data and access parameters. Both these techniques can mitigate the chances that third parties take control of the equipment, accessing the users’ personal or financial data and/or using the equipment to launch DDoS attacks. However, they are not mandatory and not all manufacturers adopt them, with the result that many risks which could be mitigated in manufacturing are present when the equipment operates. 5.2.5.2. Description of the policy options Policy Option 1 relates to the possibility of adopting a voluntary approach to addressing the concerns of consumer associations and national authorities. Two sub-options could be possible, i.e.

·A fully industry-led process with the development and publication of good practices and industry codes of conduct relating to internet-connected and/or wearable radio equipment OR ·A voluntary adherence to non-mandatory initiatives, such as EU-level codes of conduct and/or the incorporation of non-mandatory elements from EU legislation. Examples can be voluntary certification schemes under the CSA, or voluntary codes of conduct developed under the GDPR. The rationale for defining these two sub-options is that several stakeholders, in particular equipment manufacturers, stated that a voluntary approach would only be effective if supported by accompanying measures, such as awareness-raising among manufacturers and other economic operators, and among consumers regarding the importance of ensuring high levels of data protection and privacy and protection from fraud through the enhanced security of internet-connected and/or wearable radio equipment. ENISA has for instance developed baseline security requirements for IoT products. While the focus of the original guidance document was on the specific risks posed when connected products are installed in particular locations, such as in critical infrastructures, the general principles relating to cybersecurity in the design of connected products have wider applicability and relevance. The general principles relating to security by design and default provide a starting point from which more detailed technical solutions for connected products could be developed in the future. The guidance on baseline security requirements is relevant irrespective as to whether the approach to taking their implementation forward were to be through an industry-led voluntary approach, or through a regulatory approach. However, whilst codes of practice and other voluntary approaches to promote improved consumer IoT security may help in changing the behaviour of IoT device manufacturers over time, manufacturers of cheap equipment falling short of the expectations have limited or no incentives to introduce certain necessary improvements in the design of their products, as explained above in the problem definition section. Under Policy Options 2, 3 and 4, either one or both of the delegated acts in the RED under Article 3(3)(e) and Article 3(3)(f) would be activated. Any delegated act under Article 3(3) will make applicable the corresponding essential requirements for specific categories of radio equipment. Mandatory requirements would be then introduced for manufacturers to ensure that their products are secure in relation to ensuring safeguards for data protection and privacy, for protection from fraud and/or protection of the networks. While each the options in principle addresses all problems, each of them has a different focus. There are common technical solutions that may be applied for instance to deal with privacy issues that also have a positive effect on fraud prevention. The precise technical solutions are to be established via harmonised standards under options 2-4, so it is not possible at this stage to present a thorough analysis of the extent to which each option addresses each problem. Yet, all options are likely to have a positive impact on each problem but to a different degree. Policy Option 2 would consist of a delegated act under Article 3(3)(e) of the RED, and thus focus on the protection of privacy and personal data. Policy Option 3 would be a delegated act under Article 3(3)(f) of the RED, focusing on the protection against fraud. Policy Option 4 would be a combination of options 2 and 3. Policy Option 5 stems from option 4 but includes the requirement that equipment should not harm the network. This addition was suggested by MS and stakeholders after the initial Inception Impact Assessment as it was considered a needed and a logic complement to Option 4, based on the existing empowerments in the RED. The progressive requests of the Council to protect certain networks (e.g. 5G) can further explain this late addition. Finally, being certain technical solution in common, the inclusion of the protection of the network was assumed to potentially improve the benefits of the initiative, at reduced costs. These options build on the essential requirements for whose adoption the European Commission has already been empowered by the co-legislators. Whilst the adoption of delegated acts would require manufacturers of certain categories of radio equipment, duly specified in the delegated acts themselves, to demonstrate new essential requirements as a market access condition, the rest of the provisions of the RED will remain applicable. Manufacturers, Authorities and other stakeholders can use the existing practices, Expert Groups, Committees, etc. These options would require minimum baseline security requirements to be implemented alongside existing applicable EU regulations. Policy Option 5 builds on option 4, adding the protection of the networks as an additional policy objective to pursue. This option stems from a political request of the Member States in both the Council and in the Expert Group on Radio Equipment, urging to take actions to enhance the resilience of radio equipment which will be connected to networks, specifically 5G networks, these being vital infrastructures in support of the economy. This request arrived after the data collection exercise and aims to complement the existing national work on the infrastructures. The Member States considered Article 3(3)(d) a needed complement to Article 3(3)(e) and 3(3)(f). At the technical level, the request originates from the complementarity of many technical solutions that, once applied to protect personal data and against fraud, also can protect the network, which has been confirmed also by relevant Committees in the European Standardisation Organisations. The RED is aligned to the NLF. Consequently, for all regulatory options from 2 to 5, following the procedures in the Standardization Regulation 1025/2012, the Commission would request European Standardisation Organisations (ESOs) to produce harmonised standards so to allow manufacturers to benefit from the presumption of conformity, in line with Articles 16 and 17(3) of the RED. The request would also contain a reference to appropriate pieces of EU law, see Annex 6, whose implementation would benefit from ensuring that radio equipment demonstrates new essential requirements for the purposes of market access. 5.3.5.3. Discarded options A few policy options were either discarded at an early stage, or during the development of this initiative, for different reasons, as below: ·At an early stage, a potential further considered policy option was the introduction of a horizontal piece of legislation on cybersecurity. Several individual manufacturers and their industry associations proposed it as the best policy option which, in their view, would avoid fragmentation of the results, efficiency and effectiveness. It was however pointed out for example in discussions in the Expert Group on Radio Equipment that realistically, given legislative timeframes which are required for a co-decision procedure, such an option may not be as timely as one or more delegated acts under the RED. In addition, at the time of the revision of other sectoral legislation, e.g. on medical devices, this option was also not considered, given the urgency to address risks in those products. The sectoral legislation was then favourite as the evidence of risks is stronger. Consequently, although there are still residual risks and products that may need to be addressed by a complementary horizontal initiative, this option has been discarded, favouring the timely adoption of a delegated regulation (options 2 to 5), which could effectively address in the short term the most urgently perceived security risks in a broad range of products. The policy option of establishing a mandatory cybersecurity framework was considered viable in the medium-long term and not retained for this initiative. This approach is fully in line with the recent Council’s conclusion (footnote 13) which while acknowledging the need “to address in short-term ICT cybersecurity aspects in relevant legal acts, for example the New Legislative Framework (NLF) including the within Directive 2014/53/EU (Radio Equipment Directive)”, underlines “the importance of assessing the need for horizontal legislation, also specifying the necessary conditions for the placement on the market, in the long-term to address all relevant aspects of cybersecurity of connected devices, such as availability, integrity and confidentiality.” ·At the time of publishing the Inception Impact Assessment, the Cybersecurity Act was not yet adopted, hence no options could be based on this piece of legislation. When the act was adopted as a voluntary piece of legislation, it was considered covered under the industrial voluntary approaches in section 6.1. ·Finally, at a later stage, i.e. after the publication of the Inception Impact Assessment, certain MS suggested to adopt Article 3(3)(d) in conjunction with Article 3(3)(e) and 3(3)(f), noting the synergies of the adoption of the three articles together. As the MS and the consumer associations considered the adoption of Article 3(3)(d) a complement to option 4, a stand-alone option for Article 3(3)(d) was therefore not considered. In addition, a stand-alone option for Article 3(3)(d) would have ignored the documented risks (see footnotes 8, 9, 16, 17, 19) that triggered the initiative and would not have allowed to meet some of the specific objectives (in particular the risks to privacy and of fraud of specific radio equipment) and hence would have mitigated the risks only partially.

6.6. What are the impacts of the policy options? Economic, social and environmental impacts were considered in assessing the policy options. In more detail, it was sought to have a quantitative analysis, wherever possible, of the following aspects. Considered economic impacts included: 1)Administrative costs for manufacturers and economic operators; 2)Substantive compliance costs for manufacturers and economic operators; 3)Enforcement costs for Authorities; 4)Other direct costs, i.e.: a)For professionals and industry, costs directly attributable to data breaches and DDoS and post-breach activities to manage the fallout e.g. informing customers about data and information compromised, restoring network integrity, auditing with IT security specialists to rectify the problem, strengthen security and/or possible related litigation costs/liability matters; b)For citizens, (i) money lost due to financial fraud, (ii) identity theft and (iii) the consequent resources that have to be spent to remediate possible matters (e.g. changing credentials, dealing with banks or credit card providers, etc). Apart from the one in (i), the other two costs are mostly not quantifiable. 5)Indirect costs/benefits: a)Reputational damage, with related loss of customers and value for investors; b)Users’ trust in the Digital Single Market and related sales and costs of internet-connected and/or wearable radio equipment; 6)Improved functioning of the Internal Market by ensuring that a level playing field is maintained without the emergence of national divergent legislation; 7)Competitiveness of EU industry in the digital economy. Limitations of the analysis In all considered policy options there are risks of fines issued by data protection authorities due to the non-compliance of the equipment with regulatory requirements under the GDPR. The fines are significant, up to EUR 20 million, or up to 4% of the annual worldwide turnover of the preceding financial year, whichever may be greater. These costs affect the data controller, who is often not the manufacturer of the equipment. For the purposes of this impact assessment, it cannot be excluded that in some cases the protection of the equipment may have helped mitigating the privacy risks, avoiding the fines. The obligation for manufacturers of ensuring “security by design” of the equipment, demonstrated as a market access condition may in turn facilitate compliance efforts for the controller of the data under the GDPR (by ensuring a certain baseline of security features in the equipment). In the absence of precise information on the extent of fines which were due to lack of safeguards in the equipment, costs generated by fines under the GDPR are herein not reported. With respect to compliance costs of the different options, in general, economic operators found it hard to estimate them, in the absence of the text of the delegated acts and the related specifications to comply with. Moreover, they assumed that different costs could be faced depending on whether future harmonised technical standards would contain common minimum generic requirements for all categories of internet-connected and/or wearable radio equipment, or whether these would be more product-specific. It was also unclear in their view how far future harmonised technical standards are likely to be based on existing technical standards, such as international standards and industry standards. In such case, it was also seen as difficult to differentiate between the costs of either Articles 3(3)(e) or 3(3)(f) as most technical standards focus on strengthening cybersecurity in general, by preventing unauthorised penetration. Some further responses from the economic operators highlighted that it is still uncertain whether the same test would ensure compliance with other EU legislation and the RED. Examples in this regard are (i) data protection by design and default (which includes “security by design” aspects) under the GDPR and/or (ii) voluntary product-specific CSA certification scheme. It was possible to partially overcome this challenge, by: ·Undertaking an assessment of technical solutions that are already available; ·Reviewing good practice guidance produced by ENISA setting out minimum baseline security requirements on specific equipment, i.e. consumer IoT security. These provide an indication as to what baseline security requirements might look like, and have been factored into the impacts; ·Gathering selected examples of compliance costs through product case studies;

·Limiting the assessment to the incremental costs. In fact, manufacturers of internet-connected and/or wearable radio equipment are already under the obligation to incorporate data protection by design and default into their business processes as part of GDPR compliance. A regulatory initiative under the RED will only make enforceable this obligation, hence only the additional costs are to be considered in the net costs. Considered social impacts were: ·General resilience against criminal activities, including avoidance of certain indirect (e.g. personal safety) risks that consumers and citizens may suffer; ·Protection of fundamental rights (e.g. to privacy). Both these impacts include unnegotiable rights and can be related to non-financial aspects, e.g. anxiety, stress or physical harm, as a result of an incident. The inherent subjectivity makes it impossible to quantify possible negative social impacts on the individuals. At the general and aggregated level, however, these social impacts are reflected into the trust in the new technologies and the interconnection of conventional goods which on the contrary could be estimated – see point 5.b. A general remark on environmental benefits is that, compared to economic and social benefits, there was less stakeholder feedback. Some large manufacturers commented that there remain some low-quality, cheap and insecure internet-connected radio equipment and/or wearable radio equipment on the European market which may already not meet minimum benchmarks. In their view, removing such products from the market could translate into European consumers purchasing better quality and could help to reduce purchases of low-quality equipment with a shorter product lifecycle. This in turn should help contributing to the circular economy and sustainability by lengthening the average lifespan of the use of such products, reducing unnecessary use of raw materials and the amount of electronic waste. This reasoning applies to all regulatory options. However it was neither confirmed by other stakeholders, nor could be substantiated in more detail. As a consequence, although acknowledging some reasonable elements in it, it is herein assumed that this initiative will not have environmental aspects and for brevity these will be omitted in the following analysis. 6.1.6.1. Policy Option 0 – baseline scenario Under this option equipment manufacturers would need to comply with existing legislation, yet MS will not be able to enforce equipment at the moment of placing on the market. We refer to Sections 2.1 and 2.3 for an assessment of the costs and risks of non-action. The insufficient incentives for manufacturers to incorporate adequate security measures in their products, as described at the end of Section 2.2, will remain, despite the targeted consultation showing that the vast majority of the respondents identified risks, and that there is the possibility to mitigate them. In the consultations, this option was supported by equipment manufacturers only, with Member States, Consumers’ associations and information security industry strongly opposing it. A summary of the different stakeholder positions is contained in Annex 2. 6.2.6.2. Policy Option 1 – voluntary approach Under this option the participating equipment manufacturers would incur some substantive costs (although a large part may be business as usual costs if the ones participating are likely to be the more security-minded) while those not participating would not incur any additional costs. Authorities would not incur additional enforcement costs, but they would also not have corrective measures against insecure products. As regards the other costs analysed above (costs of data breaches for industry and consumers, reputational costs, trust), it is noted that, as of the launch of the Inception Impact Assessment for this initiative, the Commission Services in charge have not received any commitment on the possible implementation of a voluntary approach. Moreover, in the discussions in the Expert Group on Radio Equipment or in the interviews with stakeholders, no information was provided by the represented associations of stakeholders on a possible scope, date of applicability and content of a possible voluntary approach and supporting stakeholders. The application of a voluntary certification scheme under the CSA has been considered under this option, but no indications have been given on the willingness of manufacturers to take it up, when available. In any case, a voluntary labelling scheme would not fully address the identified risks, e.g. with respect to enforcement. It is consequently not possible to assess the impact of any concrete voluntary initiatives. In particular, it is not possible to estimate whether their benefits would compensate for the costs of non-action described in the previous Section. Finally, a voluntary initiative might cover only part of the manufacturers while others may prefer to avoid additional costs. It is likely that the producers of the most problematic cheap equipment would not join a voluntary initiative as this would not be in line with their business strategy, which would seriously hamper the effectiveness of voluntary action. This would be detrimental for the establishment of consumer trust and a level playing field among manufacturers. It is also not possible to estimate how the Internal Market can be preserved, e.g. whether the level of voluntary commitment would be sufficient to avoid national legislation. 6.3.6.3. Policy Option 2 – Article 3(3)(e), focus on protection of privacy and personal data This option foresees to activate Article 3(3)(e) of the RED, with mandatory requirements to ensure that internet-connected and/or wearable radio equipment integrates safeguards to ensure that the personal data and privacy of users are protected. Compared to the baseline scenario, there will be costs for manufacturers of equipment and economic operators in general. Most of the economic operators saw little differences in these costs under Policy Option 2, 3 or 4 and replied under the assumption that Option 4 would be adopted. Findings are consequently presented in Section 6.5. In more general terms, existing technical solutions related to the protection of privacy problems also relate to the protection of the network and the protection against fraud. An example is reported in section 6.6, based on an existing European (and international) standard. Feedback was received from economic operators through the targeted consultation about the administrative costs. It should be noted that whilst 56 responses were received to this survey, the questions on administrative costs and burdens were answered only by economic operators, and the survey cohort is therefore 28. This is a relatively low number, but the survey responses have been cross-checked against the feedback from interviews with manufacturers carried out as part of the product case studies. Economic operators were almost unanimous in stating that there would be additional administrative costs related to new regulatory requirements on data protection and privacy. With regards to the “Business as Usual” costs, the related obligations under the RED will be applicable in any case. The extra administrative costs will be on (i) familiarising with the new requirements, (ii) updating the Declaration of conformity, (iii) the technical file and (iv) information to the users. No quantitative information was provided in this respect, although in Section 6.5 is reported a synoptic – figure 5 – of the perceived severity of the costs in case of adoption of both Articles 3(3)(e) and 3(3)(f). It is not possible to break it down to the individual acts. Economic operators were mostly concerned by the impact on testing costs. The particular lack of harmonised standards was flagged as a key factor, which could raise or remove costs significantly, also for Small and Medium Enterprises (SMEs). This severity also stems clearly from the above-mentioned synoptic figure and, quantitatively has been provided in aggregate for Articles 3(3)(e) and 3(3)(f), hence it is reported Section 6.5.

The costs of internal testing and third-party conformity assessment are considered one of the major areas of costs associated with demonstrating compliance with the essential requirements. In some cases, also other substantive compliance costs (e.g. costs of redesigning products) were reported as a source of concern. However, it was not possible to collect the information on the extra costs that will be caused by the introduction of regulatory requirements under the RED in addition to the costs that manufacturers have already incurred to comply with the GDPR. In any case, in order to mitigate these costs, the Commission services have already started a discussion with the ESOs, asking in particular a mapping of potentially applicable solutions in order to develop an understanding of (i) the risks that can be covered already and (ii) the gaps that may require additional efforts to ensure a smooth functioning of the Internal Market of radio equipment. A working draft document has been distributed to and discussed in the Expert Group on Radio Equipment for comments and general awareness. Many technical solutions identified in this mapping are in common to the GDPR and/or the CSA. Whilst the GDPR does not impose technical solutions for market access, the CSA schemes are voluntary and manufacturers have always the discretion to apply harmonised standards, the Commission services will spend increased attention to ensure coherency between the implementation of these (and other possibly applicable) pieces