Article 13 – Obligations of manufacturers

1 would add wording.

1. 588 +Addition François-Xavier BellamyEPP · ITRE–LIBE “Pursuant to Article 13(4), Manufacturers of Products with Digital Elements may deviate from the essential cybersecurity requirements set out in Annex…”

   2a. Amendment to Regulation (EU) 2024/2847 In Article 13, paragraph 25a (new) is inserted

   Pursuant to Article 13(4), Manufacturers of Products with Digital Elements may deviate from the essential cybersecurity requirements set out in Annex I for the following products:

   (a)Products placed on the market after 11 December 2027 under a business-to-business agreement concluded prior to 20 November 2024, where compliance with Annex I is either inapplicable, would impose a disproportionate financial burden, or would result in significant delivery delays due to the advanced stage of design, development, and production.

   (b)Products placed on the market after 11 December 2027 that are expected to interface with products placed on the market before that date (e.g., project extensions necessitating integration of new units, subsystems, or systems with existing railway infrastructure), where compliance with Annex I would jeopardize interoperability or compatibility between the legacy system and the extension.

   Such deviation shall be justified by manufacturers, by providing a technical justification within the cybersecurity risk assessment, and, where relevant, by proposing compensating controls based on a risk-based approach.

   Tabled by

   François-Xavier Bellamy

   Group

   EPP

   Targets

   Cyber Resilience Act Article 13 – paragraph 25a (new)

   Document

   ITRE–LIBE amendments 527–776 to the draft report

   Source

   Official text, pages 39–40

   Printed header

   Article 1 – paragraph 1 – point 2 a (new) / Regulation (EU) 2024/2847 / Article 13 – paragraph 25a (new)

   Links

   Link to this amendment
   Cite this amendment
   Preview in the full article