Article 70 Evaluation and review

This article sets out the Commission's obligations to review and report on the regulation's implementation and effectiveness.

It establishes two distinct reporting duties: a broader evaluation of the regulation as a whole, and a more targeted assessment of the single reporting platform established under Article 16, which is the centralised mechanism for manufacturers to notify vulnerabilities and incidents.

Important points:

• The Commission is required to submit a general evaluation and review report to the European Parliament and Council by 11 December 2030, and every four years after that, with all reports made public.
• The Commission must also submit a separate, earlier report by 11 September 2028, specifically assessing the effectiveness of the single reporting platform referenced in Article 16.
• The second report must be prepared after consulting ENISA and the CSIRTs network, and must examine how CSIRTs designated as coordinators have applied cybersecurity-related grounds to delay dissemination of notifications.