Smart Industry 2021

Smart Business Title Story: The EU Cybersecurity Act
24
We really think
this could be
an added-value
globally – but
we need to do it
right.
Christoph Luykx
Policy director at Orgalim
A New Approach
To improve the internal
market for goods and
strengthen the conditions
for placing a wide
range of products on
the EU market, the new
legislative framework was
adopted in 2008. It is a
package of measures that
aim to improve market
surveillance and boost
the quality of conformity
assessments. It also clarifies
the use of CE marking
and creates a toolbox
of measures for use in
product legislation.
the European Council. Inaction
by Brussels could push individual
countries to bring into force national-level
legislation, fragmenting
the common market.
That calculation has resulted in a
move to use a delegated act from
RED to activate provisions that require
manufacturers of wireless devices
to fulfil cybersecurity requirements
by protecting consumers
from fraud and ensuring their privacy.
Such a move is acknowledged
to have numerous shortcomings.
For a start, it will cover only Internet-connected
radio equipment
and wearable radio equipment
(estimated at around 75 percent of
the connected-device market) and
will not cover connected products
that only use wires. In addition to
excluding non-radio components
(including processors), it won’t
cover the life cycle of the product
(patches) or require disclosure of
vulnerabilities.
Despite its shortcomings, the RED
delegated act is seen as the fastest
way to introduce a cybersecurity
law in the short term, rather than
having to wait for the development
of a new horizonal law. Industry
groups have identified these ambiguities
in what is to be covered
but they also worry that the regulations
will introduce a mandatory
set of standards and requirements,
only for these to be superseded by
a new law.
“We are completely supportive of
mandatory baseline requirements
under horizontal legislation, or of a
certification scheme [like the CSA]
which is voluntary and is more of
a market-driven mechanism,” said
Alberto Di Felice, director for infrastructure,
privacy and security at
Digital Europe. “What we’re seeing
on the other end of the spectrum
is the RED delegated act. We are
source ©: Euralarm
far more skeptical about activating
that instrument to target cybersecurity.
The potential for overlaps
and inconsistencies is huge.”
An important question is whether
the delegated act will have coherence
with the new horizontal law,
which the European Commission
has indicated is its intention. Da
Silva believes that the rules put in
place by the RED delegated act will
match up new rules at the horizontal
level that are coming, though
overall the new horizontal law will
be much broader in scope.
Overall, there is recognition among
industry groups of the need for
comprehensive regulation governing
cybersecurity – and even its
inevitability, given that the alternative
would be a high degree of
fragmentation – but the hope is to
avoid contradictory or unworkable
rules and develop these within the
NLF, where there is input from industry.
Orgalim, a federation of European
technology industry bodies, has
called for horizontal legislation
under the NLF. Christoph Luykx,
its policy director, says that seeing
such a request coming from industry
may be surprising to a lot of
people. “But it is precisely because
we see a risk of fragmentation,
the increased cost to produce and
manufacture products, the confusion
for the manufacturers and consumers,
that is why we put forward
a proposal for horizontal legislation,”
he explains.
Coherent cybersecurity rules for
the European marketplace can ultimately
help companies gain an advantage
by allowing them to prove
their credentials, both at home and
abroad, believes Luykx. “If we get
this right, and we are coordinated,
and the cost and the bureaucracy of
this is manageable, [manufacturers]
can take cybersecurity into account
from the development of a product
to its rollout and during its lifetime.
So, we really think this could be
an added-value globally – but we
need to do it right and there is still a
lot of work to do.”