<\/p>\n\n\n\n
Regulation (EU) 2024\/2847 (the Cyber Resilience Act) introduces a harmonized European
framework on cybersecurity applicable to products with digital elements.<\/p>\n\n\n\n
The new regulation forms part of the European Union\u2019s broader strategy to strengthen the cyber
resilience of the internal market. It complements the existing regulatory framework \u2013 particularly
the NIS 2 Directive, which focuses on security measures for networks and information systems within
regulated organizations \u2013 with the objective of ensuring a high and consistent level of cybersecurity
for products throughout their entire lifecycle.<\/p>\n\n\n\n
The Cyber Resilience Act applies to all products with digital elements<\/strong> \u2013 namely, any hardware As of 11 September 2026, manufacturers of products with digital elements will be required to:<\/p>\n\n\n\n As of 11 December 2027, manufacturers of products with digital elements will be subject to a number of specific obligations, including, by way of example, the requirement to:<\/p>\n\n\n\n For products that also qualify as high-risk AI systems<\/strong>, the Cyber Resilience Act introduces an Regulation (EU) 2024\/2847 (the Cyber Resilience Act) introduces a harmonized Europeanframework on cybersecurity applicable to products with digital elements. The new regulation forms part of the European Union\u2019s broader strategy to strengthen the cyberresilience of the internal market. It complements the existing regulatory framework \u2013 particularlythe NIS 2 Directive, which focuses on security measures for […]<\/p>\n","protected":false},"author":36,"featured_media":29688,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_eb_attr":"","footnotes":""},"categories":[448,452,458],"tags":[],"ppma_author":[482],"class_list":["post-29690","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-client-alert-en","category-compliance-en","category-legal-tech-en"],"acf":[],"authors":[{"term_id":482,"user_id":36,"is_guest":0,"slug":"pavesio-studio-legale","display_name":"Pavesio Studio Legale","avatar_url":"https:\/\/pavesioassociati.it\/wp-content\/uploads\/2022\/02\/100x100px.jpg","user_url":"","last_name":"","first_name":"","job_title":"","description":""}],"_links":{"self":[{"href":"https:\/\/pavesioassociati.it\/en\/wp-json\/wp\/v2\/posts\/29690","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pavesioassociati.it\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pavesioassociati.it\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pavesioassociati.it\/en\/wp-json\/wp\/v2\/users\/36"}],"replies":[{"embeddable":true,"href":"https:\/\/pavesioassociati.it\/en\/wp-json\/wp\/v2\/comments?post=29690"}],"version-history":[{"count":5,"href":"https:\/\/pavesioassociati.it\/en\/wp-json\/wp\/v2\/posts\/29690\/revisions"}],"predecessor-version":[{"id":29704,"href":"https:\/\/pavesioassociati.it\/en\/wp-json\/wp\/v2\/posts\/29690\/revisions\/29704"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/pavesioassociati.it\/en\/wp-json\/wp\/v2\/media\/29688"}],"wp:attachment":[{"href":"https:\/\/pavesioassociati.it\/en\/wp-json\/wp\/v2\/media?parent=29690"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pavesioassociati.it\/en\/wp-json\/wp\/v2\/categories?post=29690"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pavesioassociati.it\/en\/wp-json\/wp\/v2\/tags?post=29690"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/pavesioassociati.it\/en\/wp-json\/wp\/v2\/ppma_author?post=29690"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
or software product, as well as related remote data-processing solutions \u2013 whose intended purpose
or reasonably foreseeable use includes a logical or physical connection<\/strong> (whether direct or
indirect) to a device or network.
Excluded from the scope of the Regulation are products with digital elements that are
already governed by equivalent sector<\/strong> – specific legislation, including, by way of example,
regulations concerning medical devices and in vitro diagnostic medical devices, motor vehicles
subject to automotive type-approval requirements (categories M, N, and O), and aircraft.<\/p>\n\n\n\nManufacturers\u2019 Obligations<\/h2>\n\n\n\n
\n
\n
\n
\n
<\/li>\n\n\n\n
<\/li>\n\n\n\n
<\/li>\n\n\n\n
<\/li>\n\n\n\n
<\/li>\n\n\n\n
important principle of regulatory alignment and integration of requirements. Compliance with the
cybersecurity requirements of the Cyber Resilience Act may also serve to demonstrate compliance
with the corresponding cybersecurity requirements under the AI Act,<\/strong> thereby avoiding unnecessary
duplication of obligations. In essence, the cybersecurity requirements set out in the AI Act are
deemed to be fulfilled where the product complies with the essential cybersecurity requirements and
the related organizational processes established under Annex I of the Cyber Resilience Act.<\/p>\n\n\n\n
The Cyber Resilience Act represents a significant paradigm shift, requiring economic operators to
embed cybersecurity as a structural component of digital products<\/strong>. Cybersecurity is no
longer treated merely as a technical requirement but as a strategic market factor and a key element
of accountability throughout the entire product lifecycle.
Against this backdrop, organizations should assess whether they place on the market products with
digital elements that fall within the scope of the Cyber Resilience Act. Such an assessment is essential
to ensure that the necessary measures are implemented in a timely manner to achieve compliance
with both the formal and substantive obligations introduced by the Regulation.<\/p>\n\n\n\n<\/span><\/h2><\/div><\/div><\/div>\n","protected":false},"excerpt":{"rendered":"