Article 5 Procurement or use of products with digital elements

This Regulation shall not prevent Member States from subjecting products with digital elements means a software or hardware product and its remote data processing solutions, including software or hardware components being placed on the market separately; to additional cybersecurity means cybersecurity as defined in Article 2, point (1), of Regulation (EU) 2019/881; requirements for the procurement or use of those products for specific purposes, including where those products are procured or used for national security or defence purposes, provided that such requirements are consistent with Member States’ obligations laid down in Union law and that they are necessary and proportionate for the achievement of those purposes.

Without prejudice to Directives 2014/24/EU and 2014/25/EU, where products with digital elements means a software or hardware product and its remote data processing solutions, including software or hardware components being placed on the market separately; that fall within the scope of this Regulation are procured, Member States shall ensure that compliance with the essential cybersecurity means cybersecurity as defined in Article 2, point (1), of Regulation (EU) 2019/881; requirements set out in Annex I to this Regulation, including the manufacturers means a natural or legal person who develops or manufactures products with digital elements or has products with digital elements designed, developed or manufactured, and markets them under its name or trademark, whether for payment, monetisation or free of charge;’ ability to handle vulnerabilities means a weakness, susceptibility or flaw of a product with digital elements that can be exploited by a cyber threat; effectively, are taken into consideration in the procurement process.