December 1, 2024

EU: Cyber Resilience Act published in EU Official Journal

AI Featured, AI Governance, AI Regulation, AI Risk, News

In this article:

Introduction of the CRA: Published on November 20, 2024, the EU Cyber Resilience Act (CRA) is the first harmonizing regulation to safeguard consumers and businesses against cybersecurity threats, forming a central pillar of the EU’s Cybersecurity Strategy for the Digital Decade.
Scope and Coverage: The CRA applies to all economic operators involved with products with digital elements (PDEs) sold in the EU, including manufacturers, importers, distributors, and retailers. It covers hardware and software products connected to networks, excluding some regulated sectors like medical devices and aviation systems.
Key Obligations for Manufacturers: Manufacturers must ensure PDEs meet essential cybersecurity standards, assess and document cybersecurity risks, maintain compliant vulnerability handling processes, and report incidents within strict timeframes. High-risk products, such as firewalls and operating systems, require stringent third-party conformity assessments.
Alignment with AI and Other Laws: The CRA aims to harmonize cybersecurity requirements across EU legislation. PDEs classified as high-risk AI systems under the AI Act are deemed compliant with AI Act cybersecurity requirements if CRA obligations are fulfilled. However, overlaps exist with laws like DORA, so there is the potential for overlap for those caught by DORA.
Enforcement Mechanisms: Enforcement includes sweeps, administrative fines (up to €15 million or 2.5% of global turnover), and corrective measures such as product recalls. Cross-border cooperation and coordination among EU authorities are key to ensuring compliance.
Phased Implementation Timeline: Notification of conformity bodies begins June 11, 2026, reporting obligations start September 11, 2026, and full compliance is required by December 11, 2027. Organizations should proactively assess cybersecurity measures and plan compliance strategies.
Click the link to read more details

https://www.jdsupra.com/legalnews/eu-cyber-resilience-act-published-in-eu-4696877/

EU: Cyber Resilience Act published in EU Official Journal

About Us

Resources

Join Us

Connect with Us

Contact Expert Request Form

EU: Cyber Resilience Act published in EU Official Journal

Related Posts

GAO report says DHS, other agencies need to up their game in AI risk assessment

The Ethical AI Dilemma: Innovation vs. Sustainability

Ethical Approach to Artificial Intelligence Use Adopted by Council

About Us

Resources

Join Us

Connect with Us

Contact Expert Request Form