Call for clear scope of applicability of the Cyber Resilience Act

On 14 November, ESBG submitted its input to the European Commission’s call for feedback on the proposed Cyber Resilience Act, which was published in September. All feedback received will be summarised by the Commission and presented to the European Parliament and Council with the aim of feeding into the legislative debate.

On 15 September, the Commission published a proposal for a Cyber Resilience Act, which aims to protect consumers and businesses from products with inadequate security features. The Cyber Resilience Act introduces mandatory cybersecurity requirements for products with digital elements. It will ensure that digital products, such as wireless and wired products and software, are more secure for consumers across the EU. In addition to increasing the responsibility of manufacturers by obliging them to provide security support and software updates to address identified vulnerabilities, it will enable consumers to have sufficient information about the cybersecurity of the products they buy and use.

In the position paper, ESBG members welcome the Commission proposal and support the goal of only having secure software on the internal market. However, members believe that the Cyber Resilience Act leaves too much room for interpretation regarding its scope of applicability and therefore proposes that the Commission should make a clear scope-statement that would dissolve any uncertainty whether the software developed, operated, or marketed by financial institutions is in scope of this Act.

In addition, there are vertical initiatives that already regulate the cyber-resilience of hardware and software products used by certain sectors. This is the case of the Digital Operational Resilience Act (DORA) for the financial sector, a regulatory framework specifically designed and developed to ensure the digital operational resilience of the financial sector. Extending the scope of the Cyber Resilience Act to products manufactured by credit institutions may place additional burdens onto banks, on top of the already existing tight regulatory corset.