The clock is ticking - feedback period for new EU cyber rules ends soon
Summary
There are only few days left until the feedback period closes on the European Commission’s proposal for a Cyber Resilience Act (“CRA”) – it isn’t too late to provide a response. It seeks to impose horizontal cybersecurity requirements and more traditional product safety style concepts, such as conformity assessment and CE marking, together with recall and reporting obligations, to cyber risks posed by “ “. We expect it to have a big impact on many businesses who will have to rethink the way they conceive, design, and manufacture connected products and software to ensure an adequate level of cybersecurity and a system to address possible vulnerabilities. Under the proposed CRA, Member States would be able to impose administrative fines up to EUR 15 million or 2.5% of the worldwide annual turnover in case of non-compliance with the essential cybersecurity requirements. Such administrative fines are similar to those set out in the GDPR and the NIS2 Directive, but are a new and significant development in the area of product safety legislation, which typically does not provide for such thresholds.