European Commission introduces Cyber Resilience Act proposal

The European Commission has published its proposal for the EU Cyber Resilience Act. The proposed legislation would increase the standards for cybersecurity rules and promote "more secure hardware and software." The law seeks to address weak cybersecurity vulnerabilities within "products with digital elements" and better inform users on the right products for enhancing security. In addition, the law would require software and hardware manufacturers to improve the security of their products from the design phase through its life cycle. In her State of the Union address, Ursula von der Leyen introduced the proposed Cyber Resilience Act, which she said would "protect consumers and businesses from products with inadequate security features" 

Last week EURACTIV reported the European Commission will introduce the proposal for the Cyber Resilience Act, which lays out cybersecurity standards for connected devices. The proposed regulation will cover digital products and their data processing solutions with exemptions for products covered by sector-specific legislation, such as medical devices. Security requirements for the design and development of connected devices include ensuring the confidentiality of data, encryption and purpose limitation principles. If passed, the proposal would be applicable 24 months after its entry into force; manufacturer reporting obligations would apply 12 months after enactment.