+▼C1 REGULATION (EU) 2024/2847 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements and amending Regulations (EU) No 168/2013 and (EU) 2019/1020 and Directive (EU) 2020/1828 (Cyber Resilience Act) ▼B (Text with EEA relevance)
---+CHAPTER I GENERAL PROVISIONS
------+Article 1 Subject matter
------+Article 2 Scope
---------+Article 2 1.
---------+Article 2 2.
---------+Article 2 3.
---------+Article 2 4.
---------+Article 2 5.
---------+Article 2 6.
---------+Article 2 7.
---------+Article 2 8.
------+Article 3 Definitions
------+Article 4 Free movement
---------+Article 4 1.
---------+Article 4 2.
---------+Article 4 3.
---------+Article 4 4.
------+Article 5 Procurement or use of products with digital elements
---------+Article 5 1.
---------+Article 5 2.
------+Article 6 Requirements for products with digital elements
------+Article 7 Important products with digital elements
---------+Article 7 1.
---------+Article 7 2.
---------+Article 7 3.
---------+Article 7 4.
------+Article 8 Critical products with digital elements
---------+Article 8 1.
---------+Article 8 2.
------+Article 9 Stakeholder consultation
---------+Article 9 1.
---------+Article 9 2.
------+Article 10 Enhancing skills in a cyber resilient digital environment
------+Article 11 General product safety
------+Article 12 High-risk AI systems
---------+Article 12 1.
---------+Article 12 2.
---------+Article 12 3.
---------+Article 12 4.
---+CHAPTER II OBLIGATIONS OF ECONOMIC OPERATORS AND PROVISIONS IN RELATION TO FREE AND OPEN-SOURCE SOFTWARE
------+Article 13 Obligations of manufacturers
---------+Article 13 1.
---------+Article 13 2.
---------+Article 13 3.
---------+Article 13 4.
---------+Article 13 5.
---------+Article 13 6.
---------+Article 13 7.
---------+Article 13 8.
---------+Article 13 9.
---------+Article 13 10.
---------+Article 13 11.
---------+Article 13 12.
---------+Article 13 13.
---------+Article 13 14.
---------+Article 13 15.
---------+Article 13 16.
---------+Article 13 17.
---------+Article 13 18.
---------+Article 13 19.
---------+Article 13 20.
---------+Article 13 21.
---------+Article 13 22.
---------+Article 13 23.
---------+Article 13 24.
---------+Article 13 25.
------+Article 14 Reporting obligations of manufacturers
---------+Article 14 1.
---------+Article 14 2.
---------+Article 14 3.
---------+Article 14 4.
---------+Article 14 5.
---------+Article 14 6.
---------+Article 14 7.
---------+Article 14 8.
---------+Article 14 9.
---------+Article 14 10.
------+Article 15 Voluntary reporting
---------+Article 15 1.
---------+Article 15 2.
---------+Article 15 3.
---------+Article 15 4.
---------+Article 15 5.
------+Article 16 Establishment of a single reporting platform
---------+Article 16 1.
---------+Article 16 2.
---------+Article 16 3.
---------+Article 16 4.
---------+Article 16 5.
---------+Article 16 6.
------+Article 17 Other provisions related to reporting
---------+Article 17 1.
---------+Article 17 2.
---------+Article 17 3.
---------+Article 17 4.
---------+Article 17 5.
---------+Article 17 6.
------+Article 18 Authorised representatives
---------+Article 18 1.
---------+Article 18 2.
---------+Article 18 3.
------+Article 19 Obligations of importers
---------+Article 19 1.
---------+Article 19 2.
---------+Article 19 3.
---------+Article 19 4.
---------+Article 19 5.
---------+Article 19 6.
---------+Article 19 7.
---------+Article 19 8.
------+Article 20 Obligations of distributors
---------+Article 20 1.
---------+Article 20 2.
---------+Article 20 3.
---------+Article 20 4.
---------+Article 20 5.
---------+Article 20 6.
------+Article 21 Cases in which obligations of manufacturers apply to importers and distributors
------+Article 22 Other cases in which obligations of manufacturers apply
---------+Article 22 1.
---------+Article 22 2.
------+Article 23 Identification of economic operators
---------+Article 23 1.
---------+Article 23 2.
------+Article 24 Obligations of open-source software stewards
---------+Article 24 1.
---------+Article 24 2.
---------+Article 24 3.
------+Article 25 Security attestation of free and open-source software
------+Article 26 Guidance
---------+Article 26 1.
---------+Article 26 2.
---------+Article 26 3.
---+CHAPTER III CONFORMITY OF THE PRODUCT WITH DIGITAL ELEMENTS
------+Article 27 Presumption of conformity
---------+Article 27 1.
---------+Article 27 2.
---------+Article 27 3.
---------+Article 27 4.
---------+Article 27 5.
---------+Article 27 6.
---------+Article 27 7.
---------+Article 27 8.
---------+Article 27 9.
------+Article 28 EU declaration of conformity
---------+Article 28 1.
---------+Article 28 2.
---------+Article 28 3.
---------+Article 28 4.
---------+Article 28 5.
------+Article 29 General principles of the CE marking
------+Article 30 Rules and conditions for affixing the CE marking
---------+Article 30 1.
---------+Article 30 2.
---------+Article 30 3.
---------+Article 30 4.
---------+Article 30 5.
---------+Article 30 6.
------+Article 31 Technical documentation
---------+Article 31 1.
---------+Article 31 2.
---------+Article 31 3.
---------+Article 31 4.
---------+Article 31 5.
------+Article 32 Conformity assessment procedures for products with digital elements
---------+Article 32 1.
---------+Article 32 2.
---------+Article 32 3.
---------+Article 32 4.
---------+Article 32 5.
---------+Article 32 6.
------+Article 33 Support measures for microenterprises and small and medium-sized enterprises, including start-ups
---------+Article 33 1.
---------+Article 33 2.
---------+Article 33 3.
---------+Article 33 4.
---------+Article 33 5.
------+Article 34 Mutual recognition agreements
---+CHAPTER IV NOTIFICATION OF CONFORMITY ASSESSMENT BODIES
------+Article 35 Notification
---------+Article 35 1.
---------+Article 35 2.
------+Article 36 Notifying authorities
---------+Article 36 1.
---------+Article 36 2.
---------+Article 36 3.
---------+Article 36 4.
------+Article 37 Requirements relating to notifying authorities
---------+Article 37 1.
---------+Article 37 2.
---------+Article 37 3.
---------+Article 37 4.
---------+Article 37 5.
---------+Article 37 6.
------+Article 38 Information obligation on notifying authorities
---------+Article 38 1.
---------+Article 38 2.
------+Article 39 Requirements relating to notified bodies
---------+Article 39 1.
---------+Article 39 2.
---------+Article 39 3.
---------+Article 39 4.
---------+Article 39 5.
---------+Article 39 6.
---------+Article 39 7.
---------+Article 39 8.
---------+Article 39 9.
---------+Article 39 10.
---------+Article 39 11.
---------+Article 39 12.
------+Article 40 Presumption of conformity of notified bodies
------+Article 41 Subsidiaries of and subcontracting by notified bodies
---------+Article 41 1.
---------+Article 41 2.
---------+Article 41 3.
---------+Article 41 4.
------+Article 42 Application for notification
---------+Article 42 1.
---------+Article 42 2.
---------+Article 42 3.
------+Article 43 Notification procedure
---------+Article 43 1.
---------+Article 43 2.
---------+Article 43 3.
---------+Article 43 4.
---------+Article 43 5.
---------+Article 43 6.
------+Article 44 Identification numbers and lists of notified bodies
---------+Article 44 1.
---------+Article 44 2.
------+Article 45 Changes to notifications
---------+Article 45 1.
---------+Article 45 2.
------+Article 46 Challenge of the competence of notified bodies
---------+Article 46 1.
---------+Article 46 2.
---------+Article 46 3.
---------+Article 46 4.
------+Article 47 Operational obligations of notified bodies
---------+Article 47 1.
---------+Article 47 2.
---------+Article 47 3.
---------+Article 47 4.
---------+Article 47 5.
---------+Article 47 6.
------+Article 48 Appeal against decisions of notified bodies
------+Article 49 Information obligation on notified bodies
---------+Article 49 1.
---------+Article 49 2.
------+Article 50 Exchange of experience
------+Article 51 Coordination of notified bodies
---------+Article 51 1.
---------+Article 51 2.
---+CHAPTER V MARKET SURVEILLANCE AND ENFORCEMENT
------+Article 52 Market surveillance and control of products with digital elements in the Union market
---------+Article 52 1.
---------+Article 52 2.
---------+Article 52 3.
---------+Article 52 4.
---------+Article 52 5.
---------+Article 52 6.
---------+Article 52 7.
---------+Article 52 8.
---------+Article 52 9.
---------+Article 52 10.
---------+Article 52 11.
---------+Article 52 12.
---------+Article 52 13.
---------+Article 52 14.
---------+Article 52 15.
---------+Article 52 16.
------+Article 53 Access to data and documentation
------+Article 54 Procedure at national level concerning products with digital elements presenting a significant cybersecurity risk
---------+Article 54 1.
---------+Article 54 2.
---------+Article 54 3.
---------+Article 54 4.
---------+Article 54 5.
---------+Article 54 6.
---------+Article 54 7.
---------+Article 54 8.
---------+Article 54 9.
------+Article 55 Union safeguard procedure
---------+Article 55 1.
---------+Article 55 2.
---------+Article 55 3.
---------+Article 55 4.
---------+Article 55 5.
------+Article 56 Procedure at Union level concerning products with digital elements presenting a significant cybersecurity risk
---------+Article 56 1.
---------+Article 56 2.
---------+Article 56 3.
---------+Article 56 4.
---------+Article 56 5.
---------+Article 56 6.
---------+Article 56 7.
------+Article 57 Compliant products with digital elements which present a significant cybersecurity risk
---------+Article 57 1.
---------+Article 57 2.
---------+Article 57 3.
---------+Article 57 4.
---------+Article 57 5.
---------+Article 57 6.
---------+Article 57 7.
---------+Article 57 8.
---------+Article 57 9.
---------+Article 57 10.
---------+Article 57 11.
------+Article 58 Formal non-compliance
---------+Article 58 1.
---------+Article 58 2.
------+Article 59 Joint activities of market surveillance authorities
---------+Article 59 1.
---------+Article 59 2.
---------+Article 59 3.
---------+Article 59 4.
---------+Article 59 5.
------+Article 60 Sweeps
---------+Article 60 1.
---------+Article 60 2.
---------+Article 60 3.
---------+Article 60 4.
---------+Article 60 5.
---+CHAPTER VI DELEGATED POWERS AND COMMITTEE PROCEDURE
------+Article 61 Exercise of the delegation
---------+Article 61 1.
---------+Article 61 2.
---------+Article 61 3.
---------+Article 61 4.
---------+Article 61 5.
---------+Article 61 6.
------+Article 62 Committee procedure
---------+Article 62 1.
---------+Article 62 2.
---------+Article 62 3.
---+CHAPTER VII CONFIDENTIALITY AND PENALTIES
------+Article 63 Confidentiality
---------+Article 63 1.
---------+Article 63 2.
---------+Article 63 3.
---------+Article 63 4.
------+Article 64 Penalties
---------+Article 64 1.
---------+Article 64 2.
---------+Article 64 3.
---------+Article 64 4.
---------+Article 64 5.
---------+Article 64 6.
---------+Article 64 7.
---------+Article 64 8.
---------+Article 64 9.
---------+Article 64 10.
------+Article 65 Representative actions
---+CHAPTER VIII TRANSITIONAL AND FINAL PROVISIONS
------+Article 66 Amendment to Regulation (EU) 2019/1020
------+Article 67 Amendment to Directive (EU) 2020/1828
------+Article 68 Amendment to Regulation (EU) No 168/2013
------+Article 69 Transitional provisions
---------+Article 69 1.
---------+Article 69 2.
---------+Article 69 3.
------+Article 70 Evaluation and review
---------+Article 70 1.
---------+Article 70 2.
------+Article 71 Entry into force and application
---------+Article 71 1.
---------+Article 71 2.
---+ANNEX I ESSENTIAL CYBERSECURITY REQUIREMENTS
------+Part I Cybersecurity requirements relating to the properties of products with digital elements
---------+(1) Products with digital elements shall be designed, developed and produced in such a way that …
---------+(2) On the basis of the cybersecurity risk assessment referred to in Article 13(2) and where …
------------+(a) be made available on the market without known exploitable vulnerabilities;
------------+(b) be made available on the market with a secure by default configuration, unless otherwise agreed …
------------+(c) ensure that vulnerabilities can be addressed through security updates, including, where …
------------+(d) ensure protection from unauthorised access by appropriate control mechanisms, including but not …
------------+(e) protect the confidentiality of stored, transmitted or otherwise processed data, personal or …
------------+(f) protect the integrity of stored, transmitted or otherwise processed data, personal or other …
------------+(g) process only data, personal or other, that are adequate, relevant and limited to what is …
------------+(h) protect the availability of essential and basic functions, also after an incident, including …
------------+(i) minimise the negative impact by the products themselves or connected devices on the …
------------+(j) be designed, developed and produced to limit attack surfaces, including external interfaces;
------------+(k) be designed, developed and produced to reduce the impact of an incident using appropriate …
------------+(l) provide security related information by recording and monitoring relevant internal activity …
------------+(m) provide the possibility for users to securely and easily remove on a permanent basis all data …
------+Part II Vulnerability handling requirements
---------+(1) identify and document vulnerabilities and components contained in products with digital …
---------+(2) in relation to the risks posed to products with digital elements, address and remediate …
---------+(3) apply effective and regular tests and reviews of the security of the product with digital …
---------+(4) once a security update has been made available, share and publicly disclose information about …
---------+(5) put in place and enforce a policy on coordinated vulnerability disclosure;
---------+(6) take measures to facilitate the sharing of information about potential vulnerabilities in their …
---------+(7) provide for mechanisms to securely distribute updates for products with digital elements to …
---------+(8) ensure that, where security updates are available to address identified security issues, they …
---+ANNEX II INFORMATION AND INSTRUCTIONS TO THE USER
---+ANNEX III IMPORTANT PRODUCTS WITH DIGITAL ELEMENTS
---+ANNEX IV CRITICAL PRODUCTS WITH DIGITAL ELEMENTS
---+ANNEX V EU DECLARATION OF CONFORMITY
---+ANNEX VI SIMPLIFIED EU DECLARATION OF CONFORMITY
---+ANNEX VII CONTENT OF THE TECHNICAL DOCUMENTATION
---+ANNEX VIII CONFORMITY ASSESSMENT PROCEDURES
 English - European Union - ICT - Cybersecurity -

▼C1 REGULATION (EU) 2024/2847 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements and amending Regulations (EU) No 168/2013 and (EU) 2019/1020 and Directive (EU) 2020/1828 (Cyber Resilience Act) ▼B (Text with EEA relevance)

▼C1

REGULATION (EU) 2024/2847 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

of 23 October 2024

on horizontal cybersecurity requirements for products with digital elements and amending Regulations (EU) No 168/2013 and (EU) 2019/1020 and Directive (EU) 2020/1828 (Cyber Resilience Act)

▼B

(Text with EEA relevance)

This Regulation shall be binding in its entirety and directly applicable in all Member States.

1. Overview

,
CHAPTER I GENERAL PROVISIONS CHAPTER I GENERAL PROVISIONS
CHAPTER II OBLIGATIONS OF ECONOMIC OPERATORS AND PROVISIONS IN RELATION TO FREE AND OPEN-SOURCE SOFTWARE CHAPTER II OBLIGATIONS OF ECONOMIC OPERATORS AND PROVISIONS IN RELATION TO FREE AND OPEN-SOURCE SOFTWARE
CHAPTER III CONFORMITY OF THE PRODUCT WITH DIGITAL ELEMENTS CHAPTER III CONFORMITY OF THE PRODUCT WITH DIGITAL ELEMENTS
CHAPTER IV NOTIFICATION OF CONFORMITY ASSESSMENT BODIES CHAPTER IV NOTIFICATION OF CONFORMITY ASSESSMENT BODIES
CHAPTER V MARKET SURVEILLANCE AND ENFORCEMENT CHAPTER V MARKET SURVEILLANCE AND ENFORCEMENT
CHAPTER VI DELEGATED POWERS AND COMMITTEE PROCEDURE CHAPTER VI DELEGATED POWERS AND COMMITTEE PROCEDURE
CHAPTER VII CONFIDENTIALITY AND PENALTIES CHAPTER VII CONFIDENTIALITY AND PENALTIES
CHAPTER VIII TRANSITIONAL AND FINAL PROVISIONS CHAPTER VIII TRANSITIONAL AND FINAL PROVISIONS
ANNEX I ESSENTIAL CYBERSECURITY REQUIREMENTS

ANNEX I

ESSENTIAL CYBERSECURITY REQUIREMENTS
ANNEX II INFORMATION AND INSTRUCTIONS TO THE USER



ANNEX II

INFORMATION AND INSTRUCTIONS TO THE USER

At minimum, the product with digital elements shall be accompanied by:

1. 

the name, registered trade name or registered trademark of the manufacturer, and the postal address, the email address or other digital contact as well as, where available, the website at which the manufacturer can be contacted;

2. 

the single point of contact where information about vulnerabilities of the product with digital elements can be reported and received, and where the manufacturer’s policy on coordinated vulnerability disclosure can be found;

3. 

name and type and any additional information enabling the unique identification of the product with digital elements;

4. 

the intended purpose of the product with digital elements, including the security environment provided by the manufacturer, as well as the product’s essential functionalities and information about the security properties;

5. 

any known or foreseeable circumstance, related to the use of the product with digital elements in accordance with its intended purpose or under conditions of reasonably foreseeable misuse, which may lead to significant cybersecurity risks;

6. 

where applicable, the internet address at which the EU declaration of conformity can be accessed;

7. 

the type of technical security support offered by the manufacturer and the end-date of the support period during which users can expect vulnerabilities to be handled and to receive security updates;

8. 

detailed instructions or an internet address referring to such detailed instructions and information on:

(a) 

the necessary measures during initial commissioning and throughout the lifetime of the product with digital elements to ensure its secure use;

(b) 

how changes to the product with digital elements can affect the security of data;

(c) 

how security-relevant updates can be installed;

(d) 

the secure decommissioning of the product with digital elements, including information on how user data can be securely removed;

(e) 

how the default setting enabling the automatic installation of security updates, as required by Part I, point (2)(c), of Annex I, can be turned off;

(f) 

where the product with digital elements is intended for integration into other products with digital elements, the information necessary for the integrator to comply with the essential cybersecurity requirements set out in Annex I and the documentation requirements set out in Annex VII.

9. 

If the manufacturer decides to make available the software bill of materials to the user, information on where the software bill of materials can be accessed.
ANNEX III IMPORTANT PRODUCTS WITH DIGITAL ELEMENTS



ANNEX III

IMPORTANT PRODUCTS WITH DIGITAL ELEMENTS

Class I

1. Identity management systems and privileged access management software and hardware, including authentication and access control readers, including biometric readers

2. Standalone and embedded browsers

3. Password managers

4. Software that searches for, removes, or quarantines malicious software

5. Products with digital elements with the function of virtual private network (VPN)

6. Network management systems

7. Security information and event management (SIEM) systems

8. Boot managers

9. Public key infrastructure and digital certificate issuance software

10. Physical and virtual network interfaces

11. Operating systems

12. Routers, modems intended for the connection to the internet, and switches

13. Microprocessors with security-related functionalities

14. Microcontrollers with security-related functionalities

15. Application specific integrated circuits (ASIC) and field-programmable gate arrays (FPGA) with security-related functionalities

16. Smart home general purpose virtual assistants

17. Smart home products with security functionalities, including smart door locks, security cameras, baby monitoring systems and alarm systems

18. Internet connected toys covered by Directive 2009/48/EC of the European Parliament and of the Council ( 4 ) that have social interactive features (e.g. speaking or filming) or that have location tracking features

19. Personal wearable products to be worn or placed on a human body that have a health monitoring (such as tracking) purpose and to which Regulation (EU) 2017/745 or (EU) No 2017/746 do not apply, or personal wearable products that are intended for the use by and for children

Class II

1. Hypervisors and container runtime systems that support virtualised execution of operating systems and similar environments

2. Firewalls, intrusion detection and prevention systems

3. Tamper-resistant microprocessors

4. Tamper-resistant microcontrollers
ANNEX IV CRITICAL PRODUCTS WITH DIGITAL ELEMENTS



ANNEX IV

CRITICAL PRODUCTS WITH DIGITAL ELEMENTS

1. Hardware Devices with Security Boxes

2. Smart meter gateways within smart metering systems as defined in Article 2, point (23) of Directive (EU) 2019/944 of the European Parliament and of the Council ( 5 ) and other devices for advanced security purposes, including for secure cryptoprocessing

3. Smartcards or similar devices, including secure elements
ANNEX V EU DECLARATION OF CONFORMITY



ANNEX V

EU DECLARATION OF CONFORMITY

The EU declaration of conformity referred to in Article 28, shall contain all of the following information:

1. 

Name and type and any additional information enabling the unique identification of the product with digital elements

2. 

Name and address of the manufacturer or its authorised representative

3. 

A statement that the EU declaration of conformity is issued under the sole responsibility of the provider

4. 

Object of the declaration (identification of the product with digital elements allowing traceability, which may include a photograph, where appropriate)

5. 

A statement that the object of the declaration described above is in conformity with the relevant Union harmonisation legislation

6. 

References to any relevant harmonised standards used or any other common specification or cybersecurity certification in relation to which conformity is declared

7. 

Where applicable, the name and number of the notified body, a description of the conformity assessment procedure performed and identification of the certificate issued

8. 

Additional information:

Signed for and on behalf of:

(place and date of issue):

(name, function) (signature):
ANNEX VI SIMPLIFIED EU DECLARATION OF CONFORMITY



ANNEX VI

SIMPLIFIED EU DECLARATION OF CONFORMITY

The simplified EU declaration of conformity referred to in Article 13(20) shall be provided as follows:

Hereby, … [name of manufacturer] declares that the product with digital elements type … [designation of type of product with digital element] is in compliance with Regulation (EU) 2024/2847 ( 6 ).
The full text of the EU declaration of conformity is available at the following internet address: …
ANNEX VII CONTENT OF THE TECHNICAL DOCUMENTATION



ANNEX VII

CONTENT OF THE TECHNICAL DOCUMENTATION

The technical documentation referred to in Article 31 shall contain at least the following information, as applicable to the relevant product with digital elements:

1. 

a general description of the product with digital elements, including:

(a) 

its intended purpose;

(b) 

versions of software affecting compliance with essential cybersecurity requirements;

(c) 

where the product with digital elements is a hardware product, photographs or illustrations showing external features, marking and internal layout;

(d) 

user information and instructions as set out in Annex II;

2. 

a description of the design, development and production of the product with digital elements and vulnerability handling processes, including:

(a) 

necessary information on the design and development of the product with digital elements, including, where applicable, drawings and schemes and a description of the system architecture explaining how software components build on or feed into each other and integrate into the overall processing;

(b) 

necessary information and specifications of the vulnerability handling processes put in place by the manufacturer, including the software bill of materials, the coordinated vulnerability disclosure policy, evidence of the provision of a contact address for the reporting of the vulnerabilities and a description of the technical solutions chosen for the secure distribution of updates;

(c) 

necessary information and specifications of the production and monitoring processes of the product with digital elements and the validation of those processes;

3. 

an assessment of the cybersecurity risks against which the product with digital elements is designed, developed, produced, delivered and maintained pursuant to Article 13, including how the essential cybersecurity requirements set out in Part I of Annex I are applicable;

4. 

relevant information that was taken into account to determine the support period pursuant to Article 13(8) of the product with digital elements;

5. 

a list of the harmonised standards applied in full or in part the references of which have been published in the Official Journal of the European Union, common specifications as set out in Article 27 of this Regulation or European cybersecurity certification schemes adopted pursuant to Regulation (EU) 2019/881 pursuant to Article 27(8) of this Regulation, and, where those harmonised standards, common specifications or European cybersecurity certification schemes have not been applied, descriptions of the solutions adopted to meet the essential cybersecurity requirements set out in Parts I and II of Annex I, including a list of other relevant technical specifications applied. In the event of partly applied harmonised standards, common specifications or European cybersecurity certification schemes, the technical documentation shall specify the parts which have been applied;

6. 

reports of the tests carried out to verify the conformity of the product with digital elements and of the vulnerability handling processes with the applicable essential cybersecurity requirements as set out in Parts I and II of Annex I;

7. 

a copy of the EU declaration of conformity;

8. 

where applicable, the software bill of materials, further to a reasoned request from a market surveillance authority provided that it is necessary in order for that authority to be able to check compliance with the essential cybersecurity requirements set out in Annex I.
ANNEX VIII CONFORMITY ASSESSMENT PROCEDURES



ANNEX VIII

CONFORMITY ASSESSMENT PROCEDURES

Part I Conformity assessment procedure based on internal control (based on module A)

1. Internal control is the conformity assessment procedure whereby the manufacturer fulfils the obligations set out in points 2, 3 and 4 of this Part, and ensures and declares on its sole responsibility that the products with digital elements satisfy all the essential cybersecurity requirements set out in Part I of Annex I and the manufacturer meets the essential cybersecurity requirements set out in Part II of Annex I.

2. The manufacturer shall draw up the technical documentation described in Annex VII.

3. Design, development, production and vulnerability handling of products with digital elements

The manufacturer shall take all measures necessary so that the design, development, production and vulnerability handling processes and their monitoring ensure compliance of the manufactured or developed products with digital elements and of the processes put in place by the manufacturer with the essential cybersecurity requirements set out in Parts I and II of Annex I.

4. Conformity marking and declaration of conformity

4.1. The manufacturer shall affix the CE marking to each individual product with digital elements that satisfies the applicable requirements set out in this Regulation.

4.2. The manufacturer shall draw up a written EU declaration of conformity for each product with digital elements in accordance with Article 28 and keep it together with the technical documentation at the disposal of the national authorities for 10 years after the product with digital elements has been placed on the market or for the support period, whichever is longer. The EU declaration of conformity shall identify the product with digital elements for which it has been drawn up. A copy of the EU declaration of conformity shall be made available to the relevant authorities upon request.

5. Authorised representatives

The manufacturer’s obligations set out in point 4 may be fulfilled by its authorised representative, on its behalf and under its responsibility, provided that the relevant obligations are specified in the mandate.

Part II EU-type examination (based on module B)

1. EU-type examination is the part of a conformity assessment procedure in which a notified body examines the technical design and development of a product with digital elements and the vulnerability handling processes put in place by the manufacturer, and attests that a product with digital elements meets the essential cybersecurity requirements set out in Part I of Annex I and that the manufacturer meets the essential cybersecurity requirements set out in Part II of Annex I.

2. EU-type examination shall be carried out by assessing the adequacy of the technical design and development of the product with digital elements through the examination of the technical documentation and supporting evidence referred to in point 3, and the examination of specimens of one or more critical parts of the product (combination of production type and design type).

3. The manufacturer shall lodge an application for EU-type examination with a single notified body of its choice.

The application shall include:

3.1. 

the name and address of the manufacturer and, if the application is lodged by the authorised representative, the name and address of that authorised representative;

3.2. 

a written declaration that the same application has not been lodged with any other notified body;

3.3. 

the technical documentation, which shall make it possible to assess the conformity of the product with digital elements with the applicable essential cybersecurity requirements as set out in Part I of Annex I and the manufacturer’s vulnerability handling processes set out in Part II of Annex I and shall include an adequate analysis and assessment of the risks. The technical documentation shall specify the applicable requirements and cover, as far as relevant for the assessment, the design, manufacture and operation of the product with digital elements. The technical documentation shall contain, wherever applicable, at least the elements set out in Annex VII;

3.4. 

the supporting evidence for the adequacy of the technical design and development solutions and vulnerability handling processes. This supporting evidence shall mention any documents that have been used, in particular where the relevant harmonised standards or technical specifications have not been applied in full. The supporting evidence shall include, where necessary, the results of tests carried out by the appropriate laboratory of the manufacturer, or by another testing laboratory on its behalf and under its responsibility.

4. The notified body shall:

4.1. 

examine the technical documentation and supporting evidence to assess the adequacy of the technical design and development of the product with digital elements with the essential cybersecurity requirements set out in Part I of Annex I and of the vulnerability handling processes put in place by the manufacturer with the essential cybersecurity requirements set out in Part II of Annex I;

4.2. 

verify that specimens have been developed or manufactured in conformity with the technical documentation, and identify the elements which have been designed and developed in accordance with the applicable provisions of the relevant harmonised standards or technical specifications, as well as the elements which have been designed and developed without applying the relevant provisions of those standards;

4.3. 

carry out appropriate examinations and tests, or have them carried out, to check that, where the manufacturer has chosen to apply the solutions in the relevant harmonised standards or technical specifications for the requirements set out in Annex I, they have been applied correctly;

4.4. 

carry out appropriate examinations and tests, or have them carried out, to check that, where the solutions in the relevant harmonised standards or technical specifications for the requirements set out in Annex I have not been applied, the solutions adopted by the manufacturer meet the corresponding essential cybersecurity requirements;

4.5. 

agree with the manufacturer on a location where the examinations and tests will be carried out.

5. The notified body shall draw up an evaluation report that records the activities undertaken in accordance with point 4 and their outcomes. Without prejudice to its obligations vis-à-vis the notifying authorities, the notified body shall release the content of that report, in full or in part, only with the agreement of the manufacturer.

6. Where the type and the vulnerability handling processes meet the essential cybersecurity requirements set out in Annex I, the notified body shall issue an EU-type examination certificate to the manufacturer. The certificate shall contain the name and address of the manufacturer, the conclusions of the examination, the conditions (if any) for its validity and the necessary data for identification of the approved type and vulnerability handling processes. The certificate may have one or more annexes attached.

The certificate and its annexes shall contain all relevant information to allow the conformity of manufactured or developed products with digital elements with the examined type and vulnerability handling processes to be evaluated and to allow for in-service control.

Where the type and the vulnerability handling processes do not satisfy the applicable essential cybersecurity requirements set out in Annex I, the notified body shall refuse to issue an EU-type examination certificate and shall inform the applicant accordingly, giving detailed reasons for its refusal.

7. The notified body shall keep itself apprised of any changes in the generally acknowledged state of the art which indicate that the approved type and the vulnerability handling processes may no longer comply with the applicable essential cybersecurity requirements set out in Annex I, and shall determine whether such changes require further investigation. If so, the notified body shall inform the manufacturer accordingly.

The manufacturer shall inform the notified body that holds the technical documentation relating to the EU-type examination certificate of all modifications to the approved type and the vulnerability handling processes that may affect the conformity with the essential cybersecurity requirements set out in Annex I, or the conditions for validity of the certificate. Such modifications shall require additional approval in the form of an addition to the original EU-type examination certificate.

8. The notified body shall carry out periodic audits to ensure that the vulnerability handling processes as set out in Part II of Annex I are implemented adequately.

9. Each notified body shall inform its notifying authorities concerning the EU-type examination certificates and any additions thereto which it has issued or withdrawn, and shall, periodically or upon request, make available to its notifying authorities the list of certificates and any additions thereto refused, suspended or otherwise restricted.

Each notified body shall inform the other notified bodies concerning the EU-type examination certificates and any additions thereto which it has refused, withdrawn, suspended or otherwise restricted, and, upon request, concerning the certificates and additions thereto which it has issued.

The Commission, the Member States and the other notified bodies may, on request, obtain a copy of the EU-type examination certificates and any additions thereto. On request, the Commission and the Member States may obtain a copy of the technical documentation and the results of the examinations carried out by the notified body. The notified body shall keep a copy of the EU-type examination certificate, its annexes and additions, as well as the technical file including the documentation submitted by the manufacturer, until the expiry of the validity of the certificate.

10. The manufacturer shall keep a copy of the EU-type examination certificate, its annexes and additions together with the technical documentation at the disposal of the national authorities for 10 years after the product with digital elements has been placed on the market or for the support period, whichever is longer.

11. The manufacturer’s authorised representative may lodge the application referred to in point 3 and fulfil the obligations set out in points 7 and 10, provided that the relevant obligations are specified in the mandate.

Part III Conformity to type based on internal production control (based on module C)

1. Conformity to type based on internal production control is the part of a conformity assessment procedure whereby the manufacturer fulfils the obligations set out in points 2 and 3 of this Part, and ensures and declares that the products with digital elements concerned are in conformity with the type described in the EU-type examination certificate and satisfy the essential cybersecurity requirements set out in Part I of Annex I and that the manufacturer meets the essential cybersecurity requirements set out in Part II of Annex I.

2. Production

The manufacturer shall take all measures necessary so that the production and its monitoring ensure conformity of the manufactured products with digital elements with the approved type described in the EU-type examination certificate and with the essential cybersecurity requirements as set out in Part I of Annex I and ensures that the manufacturer meets the essential cybersecurity requirements set out in Part II of Annex I.

3. Conformity marking and declaration of conformity

3.1. 

The manufacturer shall affix the CE marking to each individual product with digital elements that is in conformity with the type described in the EU-type examination certificate and satisfies the applicable requirements set out in this Regulation.

3.2. 

The manufacturer shall draw up a written declaration of conformity for a product model and keep it at the disposal of the national authorities for 10 years after the product with digital elements has been placed on the market or for the support period, whichever is longer. The declaration of conformity shall identify the product model for which it has been drawn up. A copy of the declaration of conformity shall be made available to the relevant authorities upon request.

4. Authorised representative

The manufacturer’s obligations set out in point 3 may be fulfilled by its authorised representative, on its behalf and under its responsibility, provided that the relevant obligations are specified in the mandate.

Part IV Conformity based on full quality assurance (based on module H)

1. Conformity based on full quality assurance is the conformity assessment procedure whereby the manufacturer fulfils the obligations set out in points 2 and 5 of this Part, and ensures and declares on its sole responsibility that the products with digital elements or product categories concerned satisfy the essential cybersecurity requirements set out in Part I of Annex I and that the vulnerability handling processes put in place by the manufacturer meet the requirements set out in Part II of Annex I.

2. Design, development, production and vulnerability handling of products with digital elements

The manufacturer shall operate an approved quality system as specified in point 3 for the design, development and final product inspection and testing of the products with digital elements concerned and for handling vulnerabilities, maintain its effectiveness throughout the support period, and shall be subject to surveillance as specified in point 4.

3. Quality system

3.1. 

The manufacturer shall lodge an application for assessment of its quality system with the notified body of its choice, for the products with digital elements concerned.

The application shall include:

(a) 

the name and address of the manufacturer and, if the application is lodged by the authorised representative, the name and address of that authorised representative;

(b) 

the technical documentation for one model of each category of products with digital elements intended to be manufactured or developed. The technical documentation shall, wherever applicable, contain at least the elements as set out in Annex VII;

(c) 

the documentation concerning the quality system; and

(d) 

a written declaration that the same application has not been lodged with any other notified body.

3.2. 

The quality system shall ensure compliance of the products with digital elements with the essential cybersecurity requirements set out in Part I of Annex I and compliance of the vulnerability handling processes put in place by the manufacturer with the requirements set out in Part II of Annex I.

All the elements, requirements and provisions adopted by the manufacturer shall be documented in a systematic and orderly manner in the form of written policies, procedures and instructions. That quality system documentation shall permit a consistent interpretation of the quality programmes, plans, manuals and records.

It shall, in particular, contain an adequate description of:

(a) 

the quality objectives and the organisational structure, responsibilities and powers of the management with regard to design, development, product quality and vulnerability handling;

(b) 

the technical design and development specifications, including standards, that will be applied and, where the relevant harmonised standards or technical specifications will not be applied in full, the means that will be used to ensure that the essential cybersecurity requirements set out in Part I of Annex I that apply to the products with digital elements will be met;

(c) 

the procedural specifications, including standards, that will be applied and, where the relevant harmonised standards or technical specifications will not be applied in full, the means that will be used to ensure that the essential cybersecurity requirements set out in Part II of Annex I that apply to the manufacturer will be met;

(d) 

the design and development control, as well as design and development verification techniques, processes and systematic actions that will be used when designing and developing the products with digital elements pertaining to the product category covered;

(e) 

the corresponding production, quality control and quality assurance techniques, processes and systematic actions that will be used;

(f) 

the examinations and tests that will be carried out before, during and after production, and the frequency with which they will be carried out;

(g) 

the quality records, such as inspection reports and test data, calibration data and qualification reports on the personnel concerned;

(h) 

the means of monitoring the achievement of the required design and product quality and the effective operation of the quality system.

3.3. 

The notified body shall assess the quality system to determine whether it satisfies the requirements referred to in point 3.2.

It shall presume conformity with those requirements in respect of the elements of the quality system that comply with the corresponding specifications of the national standard that implements the relevant harmonised standard or technical specification.

In addition to experience in quality management systems, the auditing team shall have at least one member experienced as an assessor in the relevant product field and product technology concerned, and shall have knowledge of the applicable requirements set out in this Regulation. The audit shall include an assessment visit to the manufacturer’s premises, where such premises exist. The auditing team shall review the technical documentation referred to in point 3.1 (b), to verify the manufacturer’s ability to identify the applicable requirements set out in this Regulation and to carry out the necessary examinations with a view to ensuring compliance of the product with digital elements with those requirements.

The manufacturer or its authorised representative shall be notified of the decision.

The notification shall contain the conclusions of the audit and the reasoned assessment decision.

3.4. 

The manufacturer shall undertake to fulfil the obligations arising out of the quality system as approved and to maintain it so that it remains adequate and efficient.

3.5. 

The manufacturer shall keep the notified body that has approved the quality system informed of any intended change to the quality system.

The notified body shall evaluate any proposed changes and decide whether the modified quality system will continue to satisfy the requirements referred to in point 3.2 or whether a reassessment is necessary.

It shall notify the manufacturer of its decision. The notification shall contain the conclusions of the examination and the reasoned assessment decision.

4. Surveillance under the responsibility of the notified body

4.1. 

The purpose of surveillance is to make sure that the manufacturer duly fulfils the obligations arising out of the approved quality system.

4.2. 

The manufacturer shall, for assessment purposes, allow the notified body access to the design, development, production, inspection, testing and storage sites, and shall provide it with all necessary information, in particular:

(a) 

the quality system documentation;

(b) 

the quality records as provided for by the design part of the quality system, such as results of analyses, calculations and tests;

(c) 

the quality records as provided for by the manufacturing part of the quality system, such as inspection reports and test data, calibration data and qualification reports on the personnel concerned.

4.3. 

The notified body shall carry out periodic audits to make sure that the manufacturer maintains and applies the quality system and shall provide the manufacturer with an audit report.

5. Conformity marking and declaration of conformity

5.1. 

The manufacturer shall affix the CE marking, and, under the responsibility of the notified body referred to in point 3.1, the latter’s identification number to each individual product with digital elements that satisfies the requirements set out in Part I of Annex I.

5.2. 

The manufacturer shall draw up a written declaration of conformity for each product model and keep it at the disposal of the national authorities for 10 years after the product with digital elements has been placed on the market or for the support period, whichever is longer. The declaration of conformity shall identify the product model for which it has been drawn up.

A copy of the declaration of conformity shall be made available to the relevant authorities upon request.

6. The manufacturer shall, for a period ending at least 10 years after the product with digital elements has been placed on the market or for the support period, whichever is longer, keep at the disposal of the national authorities:

(a) 

the technical documentation referred to in point 3.1;

(b) 

the documentation concerning the quality system referred to in point 3.1;

(c) 

the change referred to in point 3.5, as approved;

(d) 

the decisions and reports of the notified body referred to in points 3.5 and 4.3.

7. Each notified body shall inform its notifying authorities of quality system approvals issued or withdrawn, and shall, periodically or upon request, make available to its notifying authorities the list of quality system approvals refused, suspended or otherwise restricted.

Each notified body shall inform the other notified bodies of quality system approvals which it has refused, suspended or withdrawn, and, upon request, of quality system approvals which it has issued.

8. Authorised representative

The manufacturer’s obligations set out in points 3.1, 3.5, 5 and 6 may be fulfilled by its authorised representative, on its behalf and under its responsibility, provided that the relevant obligations are specified in the mandate.

A statement has been made with regard to this act and can be found in OJ C, 2024/6786, 20.11.2024, ELI: http://data.europa.eu/eli/C/2024/6786/oj.

1.1 References

1.2 Identified Requirements

1.3 Related Standards

2. Identified Requirements

Requirements

3. Related Standards

Standards