Article 13

Pursuant to Article 13(4), Manufacturers of Products with Digital Elements may deviate from the essential cybersecurity requirements set out in Annex I for the following products:

(a)Products placed on the market after 11 December 2027 under a business-to-business agreement concluded prior to 20 November 2024, where compliance with Annex I is either inapplicable, would impose a disproportionate financial burden, or would result in significant delivery delays due to the advanced stage of design, development, and production.

(b)Products placed on the market after 11 December 2027 that are expected to interface with products placed on the market before that date (e.g., project extensions necessitating integration of new units, subsystems, or systems with existing railway infrastructure), where compliance with Annex I would jeopardize interoperability or compatibility between the legacy system and the extension.

Such deviation shall be justified by manufacturers, by providing a technical justification within the cybersecurity risk assessment, and, where relevant, by proposing compensating controls based on a risk-based approach.