158th CoR Plenary Session (29-30 November 2023)

Rapporteur: GRANFALK Pehr, EPP Group / Commission: ECON
The European Committee of the Regions (CoR) welcomes the Commission's proposal for a Regulation to strengthen European cooperation on cybersecurity.
The CoR therefore urges the Member States, the Commission and all local authorities to join together to raise awareness of the need for action, including the need to increase investments in digital resilience, particularly on local and regional levels, and to consider developing protective policy instruments targeting financial ransomware attacks.

The European Commission tabled a proposal for an EU regulatory framework on artificial intelligence (AI) in April 2021. The draft AI act is the first ever attempt to enact a horizontal regulation for AI. The proposed legal framework focuses on the specific utilisation of AI systems and associated risks. The Commission proposes to establish a technology-neutral definition of AI systems in EU law and to lay down a classification for AI systems with different requirements and obligations tailored on a 'risk-based approach'.

New technologies come with new risks, and the impact of cyber-attacks through digital products has increased dramatically in recent years. Increasingly, consumers have fallen victim to security flaws linked to digital products such as baby monitors, robo-vacuum cleaners, Wi-Fi routers and alarm systems. For businesses, the importance of ensuring that digital products in the supply chain are secure has become pivotal, considering three in five vendors have already lost money owing to product security gaps. The European Commission's proposal for a regulation, the 'cyber-resilience act', therefore aims to impose cybersecurity obligations on all products with digital elements whose intended and foreseeable use includes direct or indirect data connection to a device or network.

Cybersecurity experts have urged EU policymakers to reconsider a crucial part of the Cyber Resilience Act (CRA), the vulnerability disclosure requirements, in an open letter published on Tuesday (3 October).

The CRA would require organisations to disclose software vulnerabilities to government agencies within 24 hours of exploitation. However, such recently exploited vulnerabilities are unlikely to be mitigated within such a short time, leading to real-time databases of software with unmitigated vulnerabilities in the possession of potentially dozens of government agencies.

The digital transformation is making the EU institutions and administration more vulnerable to cyber-threats and incidents. Their number has surged dramatically in recent years: there were as many incidents during the first half of 2021 as in the whole of 2020, for instance. Yet an analysis of 20 Union institutions, bodies and agencies showed that their governance, preparedness, cybersecurity capability and maturity vary substantially, weakening the system. This proposal for a regulation would establish a common framework to ensure that similar cybersecurity rules and measures are applied within all Union institutions, bodies, offices and agencies, to improve their resilience and incident-response capacities and rapidly improve the existing situation.

The Network and Information Security (NIS) Directive is the first piece of EU-wide legislation on cybersecurity, and its specific aim was to achieve a high common level of cybersecurity across the Member States. While it increased the Member States' cybersecurity capabilities, its implementation proved difficult, resulting in fragmentation at different levels across the internal market. To respond to the growing threats posed with digitalisation and the surge in cyber-attacks, the Commission has submitted a proposal to replace the NIS Directive and thereby strengthen the security requirements, address the security of supply chains, streamline reporting obligations, and introduce more stringent supervisory measures and stricter enforcement requirements, including harmonised sanctions across the EU.

The present impact assessment (IA) accompanies the proposal for horizontal cybersecurity requirements for products with digital elements. The IA's strong points include a well-substantiated problem definition, an evidence base that appears to be recent and relevant, and a transparent account of the assumptions and limitations of the analysis.

The present proposal includes targeted amendments to the scope of the Cybersecurity Act, seeking to enable managed security services schemes by means of Commission implementing acts.