The European Parliament and the Council of the EU have published Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements, amending Regulation (EU) No 168/2013 and Regulation (EU) 2019/1020 and Directive (EU) 2020/1828.

Scope of the regulation

The regulation covers products with digital elements, including any direct or indirect data connection to a device or network.

It lays down:

1. Rules to ensure the cybersecurity of products with digital elements placed on the market.

2. Cybersecurity requirements for products with digital elements at the design, development and production stages.

3. Cybersecurity requirements for vulnerability handling processes.

4. Obligations of economic operators with respect to the cybersecurity of products and their associated processes.

5. Rules on market surveillance.

Entry into force

The regulation applies from 11 December 2027. Some of its provisions, however, become mandatory on 11 June 2026 and 11 September 2026.

EU type examination certificates and approval decisions issued for the cybersecurity requirements for products with digital elements may be used until 11 June 2028 unless they expire earlier. Where a certified product undergoes substantial modification, the regulation must be complied with from 11 December 2027.

Regardless of the certification requirements, manufacturers of products with digital elements must meet their obligations under Article 14, reporting obligations of manufacturers, whether the product is placed on the market before or after 11 December 2027.