Cyber Security Mandated for Wireless Equipment in Europe

As wireless devices, such as mobile phones, smartwatches, fitness trackers and wireless toys are more and more present in our everyday life, cyber threats pose a growing risk for every consumer. Also, the Corona pandemic has dramatically increased the use of wireless equipment for both professional and personal purposes. In view of this, the European Commission has taken action to improve the cybersecurity of wireless devices available on the European market.

The legal instrument used is a so called Delegated Regulation, which is supplementing the Radio Equipment Directive 2014/52/EU activating Articles 3(3)(d), (e) and (f) of the Directive for certain categories of radio equipment to increase the level of cybersecurity, personal data protection and privacy for the users.

The new requirements shall help to ensure that wireless devices are secure before being sold in Europe, as regards:

Network resilience: Features to avoid harming communication networks and prevent the possibility that the
devices are used to disrupt website or other services functionality.
Protection of privacy: Features to guarantee the protection of personal data, including new measures to
prevent unauthorized access or transmission of personal data.
Reduced risk of monetary fraud: Features to minimize the risk of fraud when making electronic payments, e.g. ensure better authentication control of the user.

If the EU Council or Parliament do not raise any objections during a two-month scrutiny period (from 1 November), the new act will be approved.

Then comes a transition period of 30 months to give the industry sufficient time to adapt relevant products before the new requirements become applicable, probably mid-2024.

The Commission will also support the manufacturers to comply with the new requirements by asking the
European Standardisation Organisations to develop relevant standards. Alternatively, manufacturers will be able to prove the conformity of their products by ensuring their assessment by relevant Notified Bodies, such as Nemko.
The Commission’s full announcement may be seen here.

(Blog is based on text provided by Vina Karai, Nemko Canada, edited by T.Sollie)