Cyber Resilienc Act - ZVEI recommendations for the trilogue

On 15 September 2022, the European Commission published the draft of the Cyber Resilience Act (CRA). ZVEI has been intensively involved in the informal discussions between the European legislator and other stakeholders and supported the principal idea of the CRA as a horizontal product regulation in the established New Legislative Framework.

The goal of increasing the overall cyber resilience level in Europe is a very desirable one, but the realistic feasibility must also always be considered in view of the enormous scope of products affected and complex technical challenges.

The formal trilogue negotiations have now begun at the end of September 2023. The ZVEI has also drawn up extensive recommendations for these negotiations. The most important aspects from the perspective of the electro and digital industry are:

• The classification logic of so-called "critical products" according to Article 6, which restricts the choice of possible conformity assessment procedures.
• The possibility for manufacturers to transparently determine a security support period for the product.
• The coherent establishment of the Cyber Resilience Act as a central reference point for the cybersecurity of products.
• Legally compliant requirements on vulnerabilities in products.
• Realistic transition periods of at least 48 months in view of the very ambitious regulatory target.

With this paper, ZVEI has now proposed solutions to resolve these and other issues.

Download