Article 56 Procedure at Union level concerning products with digital elements presenting a significant cybersecurity risk

Where the Commission has sufficient reason to consider, including based on information provided by ENISA, that a product with digital elements means a software or hardware product and its remote data processing solutions, including software or hardware components being placed on the market separately; that presents a significant cybersecurity risk means a cybersecurity risk which, based on its technical characteristics, can be assumed to have a high likelihood of an incident that could lead to a severe negative impact, including by causing considerable material or non-material loss or disruption; does not comply with the requirements laid down in this Regulation, it shall inform the relevant market surveillance authorities means a market surveillance authority as defined in Article 3, point (4), of Regulation (EU) 2019/1020;. Where the market surveillance authorities means a market surveillance authority as defined in Article 3, point (4), of Regulation (EU) 2019/1020; carry out an evaluation of that product with digital elements means a software or hardware product and its remote data processing solutions, including software or hardware components being placed on the market separately; that may present a significant cybersecurity risk means a cybersecurity risk which, based on its technical characteristics, can be assumed to have a high likelihood of an incident that could lead to a severe negative impact, including by causing considerable material or non-material loss or disruption; in respect of its compliance with the requirements laid down in this Regulation, the procedures referred to in Articles 54 and 55 shall apply.

Where the Commission has sufficient reason to consider that a product with digital elements means a software or hardware product and its remote data processing solutions, including software or hardware components being placed on the market separately; presents a significant cybersecurity risk means a cybersecurity risk which, based on its technical characteristics, can be assumed to have a high likelihood of an incident that could lead to a severe negative impact, including by causing considerable material or non-material loss or disruption; in light of non-technical risk means the potential for loss or disruption caused by an incident and is to be expressed as a combination of the magnitude of such loss or disruption and the likelihood of occurrence of the incident; factors, it shall inform the relevant market surveillance authorities means a market surveillance authority as defined in Article 3, point (4), of Regulation (EU) 2019/1020; and, where appropriate, the competent authoritiesas defined in Article 46 designated or established pursuant to Article 8 of Directive (EU) 2022/2555 and cooperate with those authorities as necessary. The Commission shall also consider the relevance of the identified risks means the potential for loss or disruption caused by an incident and is to be expressed as a combination of the magnitude of such loss or disruption and the likelihood of occurrence of the incident; for that product with digital elements means a software or hardware product and its remote data processing solutions, including software or hardware components being placed on the market separately; in view of its tasks regarding the Union level coordinated security risk means the potential for loss or disruption caused by an incident and is to be expressed as a combination of the magnitude of such loss or disruption and the likelihood of occurrence of the incident; assessments of critical supply chains provided for in Article 22 of Directive (EU) 2022/2555, and consult, as necessary, the Cooperation Group means a group as defined in Article 2, point (11), of Directive 2013/34/EU; established pursuant to Article 14 of Directive (EU) 2022/2555 and ENISA.

In circumstances which justify an immediate intervention to preserve the proper functioning of the internal market and where the Commission has sufficient reason to consider that the product with digital elements means a software or hardware product and its remote data processing solutions, including software or hardware components being placed on the market separately; referred to in paragraph 1 remains non-compliant with the requirements laid down in this Regulation and no effective measures have been taken by the relevant market surveillance authorities means a market surveillance authority as defined in Article 3, point (4), of Regulation (EU) 2019/1020;, the Commission shall carry out an evaluation of compliance and may request ENISA to provide an analysis to support it. The Commission shall inform the relevant market surveillance authorities means a market surveillance authority as defined in Article 3, point (4), of Regulation (EU) 2019/1020; accordingly. The relevant economic operators means the manufacturer, the authorised representative, the importer, the distributor, or other natural or legal person who is subject to obligations in relation to the manufacture of products with digital elements or to the making available of products with digital elements on the market in accordance with this Regulation; shall cooperate with ENISA as necessary.

Based on the evaluation referred to in paragraph 3, the Commission may decide that a corrective or restrictive measure is necessary at Union level. To that end, it shall without delay consult the Member States concerned and the relevant economic operator means the manufacturer, the authorised representative, the importer, the distributor, or other natural or legal person who is subject to obligations in relation to the manufacture of products with digital elements or to the making available of products with digital elements on the market in accordance with this Regulation; or operators.

On the basis of the consultation referred to in paragraph 4 of this Article, the Commission may adopt implementing acts to provide for corrective or restrictive measures at Union level, including requiring the products with digital elements means a software or hardware product and its remote data processing solutions, including software or hardware components being placed on the market separately; concerned to be withdrawn from the market or recalled, within a reasonable period, commensurate with the nature of the risk means the potential for loss or disruption caused by an incident and is to be expressed as a combination of the magnitude of such loss or disruption and the likelihood of occurrence of the incident;. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 62(2).

The Commission shall immediately communicate the implementing acts referred to in paragraph 5 to the relevant economic operator means the manufacturer, the authorised representative, the importer, the distributor, or other natural or legal person who is subject to obligations in relation to the manufacture of products with digital elements or to the making available of products with digital elements on the market in accordance with this Regulation; or operators. Member States shall implement those implementing acts without delay and shall inform the Commission accordingly.

Paragraphs 3 to 6 shall be applicable for the duration of the exceptional situation that justified the Commission’s intervention, provided that the product with digital elements means a software or hardware product and its remote data processing solutions, including software or hardware components being placed on the market separately; concerned is not brought in compliance with this Regulation.