Members of the European Parliament’s Committee on Industry, Research and Energy (ITRE) held a political meeting on Wednesday 5 July to discuss the latest version of the compromise text on the ‘Cyber Resilience Act’ (see EUROPE 13199/5). The vote in the European Parliament Committee is scheduled for 19 July.
The latest version of the compromise text proposed by the dossier’s rapporteur, Nicola Danti (Renew Europe, Italian), first of all goes back to the question of the scope of application and provides for the inclusion of functionalities located in the object cloud. The text also confirms that ‘open-source’ software will be excluded, provided it is not used for commercial purposes.
In addition, the text returns to the obligations incumbent on manufacturers and the thorny issue of the vulnerabilities of objects and products. If manufacturers were to introduce components that they had not developed themselves, they would still be responsible for ensuring compliance with cyber security rules. They should also correct any vulnerabilities detected in products and inform the developer of the patch used.
On the other hand, manufacturers should also allow users and other stakeholders to report problems and weaknesses in the system. The Computer Security Incident Response Team (CSIRT) could also be tasked with collecting reports.
In addition, the initial approach was based on the fact that cybersecurity standards should cover the objects concerned by the legislation throughout the life of these products, and that security updates and other assistance should be available to users for a period of at least 5 years. The text proposes that this decision be left to the manufacturers. They could also offer this type of update and support for a period longer than the estimated life of the product.
Finally, the deadline for the text to come into force has been revised upwards. The latest version of the compromise text proposes that a period of 40 months be applied, compared with the initial 24 months. (Original version in French by Thomas Mangin)