Negotiators from the Council of the European Union and the European Parliament will meet on Thursday 30 November to attempt to reach an interinstitutional agreement on legislation concerning cybersecurity requirements for connected objects (‘Cyber Resilience Act’). On Tuesday 28 November, the dossier’s rapporteur, Nicola Danti (Renew Europe, Italian), estimated that an interinstitutional political agreement was possible by this deadline, provided that “the Council makes a move towards the Parliament” on certain points.
During the last inter-institutional negotiations (‘trilogues’) on 9 November, the co-legislators validated the work carried out at technical level. Still on the table are the provisions relating to critical products with digital components (Article 6) and, above all, manufacturers’ declaration obligations (Article 11).
“We need a European approach that can only be guaranteed with a strong Article 11, which takes account of the role of the European Union Agency for Cybersecurity (ENISA)”, commented Mr Danti.
As a reminder, the European Parliament would like ENISA to be responsible for receiving notifications from manufacturers of actively exploited vulnerabilities. The Member States, for their part, would like alerts to be sent to the national computer security incident response teams (CSIRT) (see EUROPE 13291/8).
In addition, the Parliament and the Council of the EU will also have to agree on the criteria for defining whether or not an object should be considered critical. The positions of Member States and MEPs have long been far apart on this issue. A compromise could be reached by means of a legal text specifying the methodology, while maintaining a list of critical products in an appendix. This is one of the European Parliament’s priorities (see EUROPE 13226/3).
At the last trilogue, the European Parliament and the Council of the EU agreed to set the period during which manufacturers will be required to provide patches and security updates at 5 years. This period would be appropriate for items with a lifespan of less than 5 years. (Original version in French by Thomas Mangin)