New rules to protect mobile phones and apps against cyberattacks

Late last night, negotiators from Member States and the European Parliament agreed on the EU's new Cyber Resilience Act, a law that unifies cybersecurity requirements for all digital hardware and software on the European market. This includes devices such as personal computers or mobile phones and the applications that run on them. The Cyber Resilience Act creates a need for hardware and software developers and manufacturers to keep their products up to date.

"This law is a crucial milestone for a more secure digital environment in Europe. For the first time, we are creating uniform rules for all digital products, including hardware and software that are sold in the European Union. The new rules will ensure that products are safer and competition is fairer in the EU's single market," said Henna Virkkunen MEP, the EPP Group's lead negotiator on the new law.

"At present, many products from third countries enter the EU single market without any guarantee that they are cyber-secure or regularly kept up to date with the latest software. In the future, products will have to comply with the Cyber Resilience Act. They will carry a 'CE' mark. Manufacturers will be required to effectively handle the vulnerabilities in the products they place on the market for a specified period of time. This period will be determined by the reasonable expectations of users, the nature of the product, its intended purpose and the relevant EU legislation determining the lifetime of digital products. All digital products sold in the EU must be cyber secure, and software updates must be available," Virkkunen explained.

"At the same time, we have ensured that the new rules do not create unnecessary bureaucracy for businesses, especially small and medium-sized enterprises. Member States must also provide helpdesk support for microenterprises and SMEs. Cybersecurity has become increasingly important for the overall safety of our societies. The new rules will significantly reduce the vulnerabilities and risks associated with digital products that are essential in our daily lives," stressed Virkkunen, a member of the European Parliament's Industry, Research and Energy Committee.

Yesterday's agreement must still be formally adopted by Member States and the European Parliament. This is expected to happen early next year.