Cyber Resilience and Data Act
In future, manufacturers of networked devices will have to fulfil the requirements of several new directives: the Cyber Resilience Act, the Data Act and the new Radio Equipment Directive. Who is affected? How can the requirements be implemented most efficiently?
New regulations
Several new regulations from the EU are keeping manufacturers of networked devices busy: The Cyber Resilience Act, which makes devices more robust against cyber attacks, the Data Act, which gives customers sovereignty over their data, and the Radio Equipment Directive, which was given an addition for internet-connected devices in 2022.
Data Act
Although the Cyber Resilience Act is more present in the media, the Data Act is likely to affect more manufacturers. From September 2025, when the Act comes into force, the data stored and transmitted by a device will belong to the customer. They must be able to use the data themselves and also decide whether they want to pass it on – for example to the manufacturer of the device. The following flowchart shows which products are affected:
Cyber Resilience Act
From the end of 2027, the Cyber Resilience Act will apply: manufacturers will be responsible for the IT security of networked devices – throughout their entire service life. This will be a challenge in many consumer sectors. Many industrial sectors have already taken the first steps. The Machinery Directive, for example, also requires IT security measures. However, there are major differences depending on the sector. The following flowchart shows which products are affected:
Radio Equipment Directive
Until now, the Radio Equipment Directive (RED) has primarily regulated electromagnetic compatibility and personal safety. In 2022, the RED was supplemented with an addition for the cyber security of internet-enabled radio equipment. The new directive will apply from August 2025 and affects all devices, machines and systems with wireless interfaces.
Best Practices
At SCS, we have experience from realised projects in areas such as marine, aviation, rail, medical or energy in how to protect systems against cyber attacks by design (security by design) or how to make data available to users via suitable interfaces (data access by design). Contact us if you want to take a closer look at one of your products to see whether one of the EU directives affects you and how the requirements could be solved.
