The Commission has today taken steps to improve the cyber security of wireless devices available on the European market. As mobile phones, smart watches, activity monitors and wireless toys become more and more present in our daily lives, cyber threats pose a growing risk to every consumer. Act delegated to the Radio Equipment Directive, adopted today, aims to ensure that all wireless devices are secure before being sold on the EU market. This Act establishes new legal requirements for cyber security guarantees, which manufacturers will have to take into account when designing and manufacturing the products concerned. It will also protect the privacy and personal data of citizens, prevent the risks of currency fraud and ensure greater resilience of our communications networks.
Margrethe Vestager , Executive Vice President for a Europe Ready for the Digital Age, said: “ We want your connected products to be secure. If they are unsure, how can you rely on them to communicate for business or private purposes? We are now developing new legal obligations to protect the cyber security of electronic devices . “
Thierry Breton , Commissioner for the Internal Market, said: “ Cyber threats are evolving rapidly ; they are increasingly complex and adaptable. With the requirements we introduce today, we will significantly improve the security of a wide range of products and strengthen our resilience to cyber threats, in line with our digital ambitions in Europe. This is an important step in establishing a comprehensive set of common European cybersecurity standards for products (including connected objects) and services placed on our market . “
The measures proposed today will target wireless devices such as mobile phones, tablets and other products capable of communicating via the Internet; childcare toys and equipment, such as baby monitors; as well as a range of portable devices such as smart watches or activity monitoring devices.
The new measures will contribute to:
- Improving network resilience : Wireless devices and products will need to include features to avoid damaging communications networks and to prevent devices from being used to disrupt the operation of the website or other services.
- Better protection of consumers’ privacy : Wireless devices and products will need to have features that guarantee the protection of personal data. The protection of children’s rights will become an essential element of this legislation. For example, manufacturers will have to implement new measures to prevent unauthorized access to or transmission of personal data.
- Reducing the risk of currency fraud: Wireless devices and products will need to include features to minimize the risk of fraud when making electronic payments. For example, they will need to have better control over user authentication to avoid fraudulent payments.
The delegated act will be complemented by a legislative act on cyber resilience, recently announced by President von der Leyen in his State of the Union address , which will aim to include more products, focusing on the full life cycle. Today’s proposal, as well as the forthcoming cyber resilience act, continues the actions announced in the new EU Cyber Security Strategy presented in December 2020.
The next steps
The delegated act shall enter into force after a period of two months’ examination, unless the Council and Parliament object.
After entry into force, manufacturers will have a transitional period of 30 months to start complying with the new legal requirements. This will give the industry enough time to adapt the relevant products before the new requirements become applicable, which is expected in mid-2024.
The Commission will also support manufacturers in meeting the new requirements by asking European standardization organizations to develop relevant standards. Alternatively, manufacturers will also be able to demonstrate the conformity of their products by ensuring their assessment by the relevant notified bodies.
Context
Wireless devices have become an essential part of citizens’ lives. They access our personal information and use communication networks. The COVID-19 pandemic has had a huge impact on increasing the level of use of radio equipment, either for professional or personal purposes.
In recent years, studies by the Commission and various national authorities have identified an increasing number of wireless devices that pose cybersecurity risks. Such studies have shown, for example, the risk posed by toys that spy on children’s actions or conversations; unencrypted personal data stored in our devices, including payment-related data, which can be easily accessed; and even equipment that can misuse network resources and therefore reduce their capacity.
