Title | Cyber Resilience Act – Proposal for a regulation on cybersecurity requirements for products with digital elements |
---|---|
Proposed |
The Cyber Resilience Act (CRA) is an EU regulation proposed on 15 September 2022 by the European Commission for improving cybersecurity and cyber resilience in the EU through common cybersecurity standards, such as required incident reports and security updates, for products with digital elements in the EU.[1], which mainly refer to hardware and software whose "intended and foreseeable use includes direct or indirect data connection to a device or network".[2]
After publication of the draft proposal, multiple open source organizations criticized CRA for creating a "chilling effect on open source software development".[3] The European Commission reached political agreement of the CRA as of 1 December 2023, after a series of amendments.[4] The revised bill received relief and applause from many open source organizations, and introduced the "open source steward", a new economic concept.[5] The CRA agreement must now receive formal approval by European Parliament and the Council prior to being enforced.[6]
The background, purposes and motivations for the proposed policy include:[7]
According to The Washington Post, the CRA could make the EU a leader on cybersecurity and "change the rules of the game globally".[14]
The policy requires software that are "reasonably expected" to have automatic updates should roll out security updates automatically by default while allowing users to opt out.[16] Companies need to conduct cyber risk assessments before a product is put on the market and throughout 5 years or its expected lifecycle.[17] Products assessed as 'critical' will need to undergo external audits.[16][14] Companies would have to notify EU cybersecurity agency ENISA of any incidents within 24 hours of becoming aware of them, and take measures to resolve them.[11] Products are categorized via two classes of risks.[18] Products carrying the CE certifications would "meet a minimum level of cybersecurity checks".[8]
Once the law has passed, manufacturers would have two years to adapt to the new requirements and one year to implement vulnerability and incident reporting. Failure to comply could result in fines of up to €15 million or 2.5 percent of the offender's total worldwide annual turnover for the preceding financial year.[13][10][11]
Euractiv has reported on novel drafts or draft-changes that includes changes like the "removal of time obligations for products' lifetime and limiting the scope of reporting to significant incidents".[19][16] The first compromise amendment will be discussed on 22 May 2023 until which groups reportedly could submit written comments. Euractiv has provided a summary overview of the proposed changes.[20]
The main political groups in the European Parliament are expected to agree on the Cyber Resilience Act at a meeting on 5 July 2023. Lawmakers will discuss open source considerations, support periods, reporting obligations, and the implementation timeline. The committee vote is scheduled for 19 July 2023.[21][22]
The Spanish presidency of the EU Council has released a revised draft that simplifies the regulatory requirements for connected devices. It would reduce the number of product categories that must comply with specific regulations, mandate reporting of cybersecurity incidents to national CSIRTs, and include provisions for determining product lifetime and easing administrative burdens for small companies. The law also clarifies that spare parts with digital elements supplied by the original manufacturer are exempt from the new requirements.[23][22]
The Council text further stipulates that prior to seeking compulsory certification, the European Union executives must undertake an impact assessment to evaluate both the supply and demand aspects of the internal market, as well as the member states' capacity and preparedness for implementing the proposed schemes.[24][22]
European institutions have successfully concluded negotiations on the Cyber Resilience Act (CRA), paving the way for its anticipated completion in early 2024. The finalized text, yet to be released, will be followed by a detailed summary.[22]
Initially, the proposed act was heavily criticized by open-source advocates.[25]
Amendments were released on 1 December 2023, as part of political agreement between co-legislators,[32] to the acclaim of open-source advocates.[5] As Mike Milinkovich, executive director of the Eclipse foundation,[33] wrote:[32]
The revised legislation has vastly improved its exclusion of open source projects, communities, foundations, and their development and package distribution platforms. It also creates a new form of economic actor, the “open source steward,” which acknowledges the role played by foundations and platforms in the open source ecosystem. This is the first time this has appeared in a regulation, and it will be interesting to see how this evolves.
— Mike Milinkovich, "Good News on the Cyber Resilience Act"