Cyber Resilience Act

Chapter I — GENERAL PROVISIONS

• 1Subject matter
• 2Scope
• 3Definitions
• 4Free movement
• 5Procurement or use of products with digital elements
• 6Requirements for products with digital elements
• 7Important products with digital elements
• 8Critical products with digital elements
• 9Stakeholder consultation
• 10Enhancing skills in a cyber resilient digital environment
• 11General product safety
• 12High-risk AI systems

Chapter II — OBLIGATIONS OF ECONOMIC OPERATORS AND PROVISIONS IN RELATION TO FREE AND OPEN-SOURCE SOFTWARE

• 13Obligations of manufacturers
• 14Reporting obligations of manufacturers
• 15Voluntary reporting
• 16Establishment of a single reporting platform
• 17Other provisions related to reporting
• 18Authorised representatives
• 19Obligations of importers
• 20Obligations of distributors
• 21Cases in which obligations of manufacturers apply to importers and distributors
• 22Other cases in which obligations of manufacturers apply
• 23Identification of economic operators
• 24Obligations of open-source software stewards
• 25Security attestation of free and open-source software
• 26Guidance

Chapter III — CONFORMITY OF THE PRODUCT WITH DIGITAL ELEMENTS

• 27Presumption of conformity
• 28EU declaration of conformity
• 29General principles of the CE marking
• 30Rules and conditions for affixing the CE marking
• 31Technical documentation
• 32Conformity assessment procedures for products with digital elements
• 33Support measures for microenterprises and small and medium-sized enterprises, including start-ups
• 34Mutual recognition agreements

Chapter IV — NOTIFICATION OF CONFORMITY ASSESSMENT BODIES

• 35Notification
• 36Notifying authorities
• 37Requirements relating to notifying authorities
• 38Information obligation on notifying authorities
• 39Requirements relating to notified bodies
• 40Presumption of conformity of notified bodies
• 41Subsidiaries of and subcontracting by notified bodies
• 42Application for notification
• 43Notification procedure
• 44Identification numbers and lists of notified bodies
• 45Changes to notifications
• 46Challenge of the competence of notified bodies
• 47Operational obligations of notified bodies
• 48Appeal against decisions of notified bodies
• 49Information obligation on notified bodies
• 50Exchange of experience
• 51Coordination of notified bodies

Chapter V — MARKET SURVEILLANCE AND ENFORCEMENT

• 52Market surveillance and control of products with digital elements in the Union market
• 53Access to data and documentation
• 54Procedure at national level concerning products with digital elements presenting a significant cybersecurity risk
• 55Union safeguard procedure
• 56Procedure at Union level concerning products with digital elements presenting a significant cybersecurity risk
• 57Compliant products with digital elements which present a significant cybersecurity risk
• 58Formal non-compliance
• 59Joint activities of market surveillance authorities
• 60Sweeps

Chapter VI — DELEGATED POWERS AND COMMITTEE PROCEDURE

• 61Exercise of the delegation
• 62Committee procedure

Chapter VII — CONFIDENTIALITY AND PENALTIES

• 63Confidentiality
• 64Penalties
• 65Representative actions

Chapter VIII — TRANSITIONAL AND FINAL PROVISIONS

• 66Amendment to Regulation (EU) 2019/1020
• 67Amendment to Directive (EU) 2020/1828
• 68Amendment to Regulation (EU) No 168/2013
• 69Transitional provisions
• 70Evaluation and review
• 71Entry into force and application

Annexes

• IESSENTIAL CYBERSECURITY REQUIREMENTS
• IIINFORMATION AND INSTRUCTIONS TO THE USER
• IIIIMPORTANT PRODUCTS WITH DIGITAL ELEMENTS
• IVCRITICAL PRODUCTS WITH DIGITAL ELEMENTS
• VEU DECLARATION OF CONFORMITY
• VISIMPLIFIED EU DECLARATION OF CONFORMITY
• VIICONTENT OF THE TECHNICAL DOCUMENTATION
• VIIICONFORMITY ASSESSMENT PROCEDURES