Source: OJ L 2024/2847, 20.11.2024

Current language: EN

Article 9 Stakeholder consultation


Summary What does Article 9 of the CRA regulation say?

This article establishes the Commission's obligation to engage in structured stakeholder consultation when preparing implementation measures under the regulation.

It identifies a broad range of groups whose views must be sought, and ties that consultation requirement to specific tasks already referenced elsewhere in the regulation, such as preparing guidance and updating product category lists.

The article also locks in a minimum cadence of engagement by requiring at least annual consultation sessions.

Important points:

  • The Commission is required to consult a wide range of stakeholders — including SMEs, the open-source community, consumer associations, and academia — when developing implementation measures.
  • Structured consultation is specifically linked to tasks under Articles 7, 8, and 26, meaning this article directly supports those provisions.
  • The Commission must organise at least one consultation and information session per year to gather stakeholder views on implementation.

Springlex's summary of the article, a reading aid, not a substitute for the legal text.

    1. When preparing measures for the implementation of this Regulation, the Commission shall consult and take into account the views of relevant stakeholders, such as relevant Member State authorities, private sector undertakings, including microenterprises and small and medium-sized enterprises, the open-source software community, consumer associations, academia, and relevant Union agencies and bodies as well as expert groups established at Union level. In particular, the Commission shall, in a structured manner, where appropriate, consult and seek the views of those stakeholders when:

      1. preparing the guidance referred to in Article 26;

      2. preparing the technical descriptions of the product categories set out in Annex III in accordance with Article 7(4), assessing the need for potential updates of the list of product categories in accordance with Article 7(3) and Article 8(2), or carrying out the assessment of the potential market impact referred to in Article 8(1), without prejudice to Article 61;

      3. undertaking preparatory work for the evaluation and review of this Regulation.

    1. The Commission shall organise regular consultation and information sessions, at least once a year, to gather the views of the stakeholders referred to in paragraph 1 on the implementation of this Regulation.

We're continuously improving our platform to serve you better.

Your feedback matters! Let us know how we can improve.

Found a bug?

Springflod is a Swedish boutique consultancy firm specialising in cyber security within the financial services sector.

We offer professional services concerning information security governance, risk and compliance.

Crafted with ❤️ by Springflod