Cyber Resilience Act
Important step towards greater cyber security
The ZVEI welcomes the European "Cyber Resilience Act" and has been advocating horizontal regulation from the manufacturer to the user for years in order to create uniform rules. However, the association criticizes an overly broad definition of "critical products", as this makes market access more difficult.
With the Cyber Resilience Act, the EU Commission is tackling the task of standardizing product requirements for cybersecurity and raising the level of resilience in the EU. "Even if it poses enormous challenges for our companies, the European single market needs such a harmonized level playing field in cyber security," says Wolfgang Weber, Chairman of the ZVEI Executive Board. The draft is an important step.
However, the ZVEI is critical of the broad definition of so-called "critical products" and "highly critical products", which also include microcontrollers, industrial automation and control systems or parts of the IIoT, even if they are not used in a critical context. "If companies can only bring such products or products based on them onto the market with difficulty on the basis of this classification, there will be major delays in the use of digital products and components in the EU," says Weber. Instead of keeping pure high-risk lists, the focus should therefore be on the concept of the intended use. In addition, manufacturers of digital products and components must be involved in assigning criticality, as they are best placed to assess potential safety risks and initiate appropriate measures.
The Association of the Electrical and Digital Industry is positive about the fact that the draft regulation follows the principles of the New Legislative Framework (NLF). Weber: "This approach is directly linked to established processes in companies and strengthens the role of European standardization." However, the envisaged transitional period of 24 months for implementing such measures is too short and must be extended. The European Commission should therefore set longer deadlines so that harmonized standards can be listed in good time and a sufficient number of third-party bodies can be designated for conformity assessment.
The ZVEI has been actively advocating horizontal regulation for years. From the manufacturer to the user, everyone involved in the value network must work together and do their part to achieve a high level of cyber resilience.









