Member States had discussed, during a meeting of the Working Party on Cyber Issues on Wednesday 15 March, the Swedish Presidency of the EU Council’s new compromise text on the Cyber Resilience Act (see EUROPE 13122/16). As a reminder, this text is intended to introduce common cybersecurity rules for manufacturers and developers of all products with digital and connected elements (see EUROPE 13022/9).
In this latest version of the compromise text, the Swedish Presidency of the EU Council has removed the minimum period of 5 years of product life during which suppliers and manufacturers are required to continue to implement cybersecurity patches.
This five-year threshold was originally proposed by the Commission and represented a minimum duration. Its deletion thus implies that this period is extended to the entire life of the products.
In addition, the Swedish Presidency’s compromise document proposes that connected devices falling within the scope must, if they change during their lifetime, comply with the provisions of the future regulation, even if they were placed on the market before the regulation came into force. These changes to the object concerned could appear in different forms, including functional updates.
Finally, the document also specifies that only connected objects and products that are marketed and that aim to generate revenues that are not limited to covering their maintenance costs would be covered by the text. (Original version in French by Thomas Mangin)